Cannabidiol comes from one of two related forms of the cannabis plant: marijuana and hemp. The main difference between the two is that marijuana has much more THC than hemp, and often more CBD, too. It’s also harder to extract CBD from hemp than marijuana. But the chemical structure is the same, regardless of the source, say medical and industry experts, so its effect on the body should be the same, too.

Both THC and CBD come mainly from the leaves, resin, or flowering tops of the plants, not the stem. Nearly all products that contain THC also contain CBD. But CBD is often sold and used on its own.

Importantly, hemp oil—found in soaps, cosmetics, and other products—is not the same as CBD oil. Hemp oil comes primarily from seeds of the plant, and the seeds contain only very small amounts of CBD, says Lanier at the Hemp Industries Association.

So hemp oil and other products made from the plant, such as rope and fabric, have no or only trace amounts of both CBD and THC. But hemp cultivation in the U.S. has long been severely restricted by the federal government, making it hard for U.S. companies to make and sell those products. One goal of the new Farm Bill is to loosen those restrictions.

Clearly, CBD can help treat epilepsy, as shown by the recent approval of Epidiolex.

And a growing body of preliminary research suggests that CBD has properties that could translate into better health. For example, CBD seems to be an anti-inflammatory, which in theory could help with arthritis and some forms of pain. And it has many effects on brain chemistry, which could ease anxiety and depression, among others.

One important area: opioid addiction. Some animal studies and early research in humans suggest that CBD may help treat that problem and other forms of substance abuse. And other reports have shown that states with medical marijuana laws have seen drops in the rates of opioid deaths and use, possibly as people turn to cannabis products (which include CBD) as alternatives.

All of that gets researchers excited, says Ryan Vandrey, Ph.D., a Johns Hopkins researcher who is investigating the potential health benefits of CBD, with some promising early findings. But he’s also realistic about the state of the science. “Other than epilepsy, at this point it’s mostly postulation, not proof,” Vandrey says.

And he worries that excessive enthusiasm may be leading people to expect more from CBD than it can deliver. “States are approving CBD to treat conditions based on anecdotal reports and preliminary data,” he says. “I understand that desire, of wanting to help people who think they don’t have any other option. But it may also be false hope.”

Abrams, the cancer specialist who was on the National Academy of Science’s committee on cannabis, agrees. When he and 15 other experts prepared their report, examining more than 10,000 studies in the process, they found only three conditions for which the evidence in humans, not lab animals or other forms of preliminary research, was strong: pain, nausea related to chemotherapy, and spasticity in patients with multiple sclerosis. (The epilepsy studies were published after the NAS report.) And for those conditions, the research wasn’t for CBD in particular but cannabis in general, Abrams says.

For CBD itself, the evidence is even sparser. Abrams says the NAS report could identify only three small published randomized trials—the gold standard for medical research—that looked at just CBD. And for none of those conditions—anxiety, smoking cessation, and Parkinson’s disease—was the evidence strong enough for the NAS report to conclude that CBD clearly helps.

Abrams and Vandrey both blame that lack of definitive evidence not necessarily on the ineffectiveness of cannabis or CBD, but on government rules that for years prevented scientists from using federal money to research the compound’s possible health benefits.

“I’m hoping that now that Epidiolex has been approved, things will open up,” Vandrey says.

And in fact, some restrictions have recently been lifted. Last year, the National Institutes of Health awarded $140 million toward cannabis research, with $15 million going toward CBD studies.

With so little research into CBD it’s hard to know for certain how safe it is. That may be particularly concerning for women who are pregnant or breastfeeding.

Still, the research to date has identified few risks. And it appears to be safer than THC, with even the FDA saying CBD poses little risk of abuse. Side effects include tiredness, diarrhea, and changes in appetite and weight.

It’s also unclear what doses or forms of CBD might work best for which conditions, notes Joseph Maroon, M.D., a clinical professor of neurological surgery at the University of Pittsburgh Medical Center who authored a recent review of the neurological benefits of CBD alone and with THC. He writes that with more than 1,000 CBD and cannabis products on the market, in multiple forms, “dosing recommendations are nearly impossible.” And most medical studies have used doses of CBD much higher than that what’s included in products consumers typically purchase, according to ConsumerLab, a company that tests health and beauty products.

In addition, some research suggests CBD may interact with several kinds of prescription meds.

So if you do want to try CBD, talk with your doctor first, especially if you take any prescription drugs or are pregnant or breastfeeding. And until more evidence comes in, be wary of turning to CBD in lieu of more proven therapies, especially for serious health problems like cancer.

Finally, while it’s unclear what dosage might work best for your health problem, it’s still worth looking for products that specifically say they contain CBD, not just “cannabinoids.” Products that say they contain that broader class of compounds may not have much if any CBD. Instead they’re likely to contain other compounds found in cannabis plants, especially the stem. In addition, look for products that list the amount of CBD per serving, not just per bottle.

Simple question, not so simple answer.

At the state level, CBD from either marijuana or hemp is clearly legal everywhere other than Idaho, Nebraska, and South Dakota. Every other state, plus Puerto Rico and Washington, D.C, has legalized CBD, either alone (18 jurisdictions) or also with THC (31).

Still, details vary from state to state, with many (at least officially) requiring you to get a doctor’s recommendation. And the health problems that states say CBD (alone or with THC) can be used to treat differ, too. For details, see our map.

From a federal perspective, things are less straightforward, depending on whether the CBD comes from hemp or marijuana.

If the source is marijuana, the feds clearly consider it illegal. That’s because the DEA’s position on marijuana is unambiguous: It classifies anything from the plant, including both THC and CBD, as Schedule I substances, meaning that the agency says they have no known medical use and are addictive—just like ecstasy, heroin, and LSD.

Will the FDA’s approval of Epidiolex prompt the DEA to change its position, at least on the “no medical use” clause? Melvin Patterson, spokesman for the U.S. Drug Enforcement Agency, says that’s not certain. Instead, the agency may just reclassify Epidiolex, not all CBD. The agency has 90 days to decide.

The legal questions get more tangled when CBD comes from hemp.

Under its interpretation of the 2014 Farm Bill, the DEA says CBD from hemp is illegal. Unless, that is, the grower raised the plant “under the auspices of a state agricultural pilot program” for research purposes. Or possibly if it comes not from the flower but the stem. Though in that case, if the CBD is an “extracted resin,” it could be illegal again.

Confused? Don’t worry, you’re not the only one.

“As long as there is conflict between federal and state law, there will continue to be confusion over the legal status of CBD,” says Amanda Reiman, Ph.D., a cannabis policy and public health expert based in California who also works for Flow Kana, a cannabis company.

The current Senate version of the Farm Bill tries to unravel the confusion, in part by clarifying that “hemp” means not just the stems of the plant, but seeds, extracts, and all of its cannabinoids—which would include CBD. One important caveat: As in the past, the plant must have THC levels of 0.3 percent or less.

But even if the law does go into effect, it could take time, and possibly lawsuits, to settle the question.

Both the DEA’s Patterson and Paul Armentano, deputy director of NORML, the marijuana advocacy group, say they know of no cases where consumers faced legal penalties for buying CBD products online.

But they also say that from a federal perspective, online CBD retailers could be at some legal risk, for several reasons. To start with, shipping CBD across state lines could violate federal law.

For another, those products could violate other government rules, particularly from the FDA. For example, products that claim to treat or cure any disease, ranging from migraine to cancer, run afoul of FDA rules saying that such statement can only be made for approved drugs. In other words, Epidiolex can make those claims, but other CBD products cannot.

And CBD products could still be in violation even if they only make more general claims about health, such as the ability to reduce inflammation or improve immune function. While dietary supplements, such as vitamins and minerals, can say such things, the FDA says CBD products aren’t supplements. Why not? Because CBD has been investigated as a drug—and in fact is now approved as one—and therefore can’t be sold as a supplement.

Since 2015, FDA has in fact cracked down on dozens of online CBD retailers, even threatening to seize products, for precisely those reasons.

It’s not easy, though some states do a better job of testing products than others.

The nine states that have legalized both the recreational and medical use of cannabis do require testing of products before they can be sold. Such testing often includes checking for THC and CBD levels, as well as for mold, pesticides, and other contaminants. Some states with only medical cannabis laws also require some testing.

But among those states, standards vary substantially, with some regulating cannabis products, including CBD-only ones, as if they are pharmaceutical products and others as if they are agricultural ones, says Jennifer Liebreich, at the Association of Public Health Laboratories, which works with states and federal agencies on strengthening laboratory systems and testing programs, including those for cannabis.

Reiman says there may be reasons to be particularly cautious about products ordered online. She notes that there may be less oversight of those products than there is of store-bought ones, making their purity and potency less certain.

Research backs her up. For example, a November 2017 study in JAMA, authored by Vandrey, at Johns Hopkins, found that only 26 of 84 samples of CBD oils, tinctures, and vaporization liquids purchased online contained the amount of CBD claimed on their labels. Eighteen of them had THC levels possibly high enough to result in intoxication or impairment, especially among children. And a quarter had less CBD than advertised. Similarly, FDA testing has found several “CBD” products with no CBD at all.

Consumers need to be “mindful that this is an unregulated industry,” Vandrey says. “So you need to do your due diligence, to make sure what you are buying is what you think it is.”

That may not always be easy, though there are some steps you can take.

For example, look for companies located in states that have legalized the recreational and medical use of cannabis, since they tend to have stricter standards.

Some companies that make CBD products say they also contract with third-party testers to do additional analysis, beyond the state requirements. Kevin Liebrock, chief operating officer at Bluebird Botanicals in Louisville, Colo., says that’s what his company does. And, he says that they post the results online, so customers can check to see that they are “getting the advertised amounts of cannabinoids, like CBD, and that the product is free of contaminants.”

Other companies, such as Floyd’s of Leadville, also post their results online. And Maggie Frank, national educator at CV Sciences, maker of PlusCBD Oil, says customers should ask to see the Certificate of Analysis, or COAs, which show the results of those tests. If a company won’t do that, she says, “that’s a red flag.”

Many people do, but that doesn’t mean you can or should, says Armentano, at NORML. That’s because the same concerns about buying it online apply to flying with it. After all, you’re probably crossing state lines.

The U.S. Transportation Safety Administration says that while its agents don’t specifically search for cannabis products, if they find any—including CBD-only ones—they are supposed to refer you to law enforcement.

Even if that doesn’t lead to legal action, it could delay your travel and possibly even hamper future trips through TSA security or jeopardize your ability to qualify for TSA PreCheck.