In the summer of 2019, emergency rooms across the country started seeing a pattern nobody could explain. Young, otherwise healthy people — many of them teenagers — were showing up with severe respiratory distress. Lungs that looked, on CT scans, like they’d been dipped in oil. Doctors called it “popcorn lung.” The CDC scrambled. By February 2020, the official tally stood at 2,807 hospitalizations and 68 deaths.

The culprit: vitamin E acetate, a cheap cutting agent used to thicken cannabis oil in counterfeit vape cartridges. It’s harmless when applied to skin. When inhaled into lung tissue, it coats the alveoli and triggers a cascade of lipoid pneumonia that can be fatal.

That crisis — officially named EVALI, for E-cigarette or Vaping product use-Associated Lung Injury — was supposed to be a turning point. Six years later, the lesson still hasn’t fully landed.

The Black Market Didn’t Disappear. It Got Better at Hiding.

Illicit vape cartridges have become one of the most profitable and persistent corners of the underground cannabis economy. The economics are brutal in their simplicity: a gram of distillate costs roughly $8–$12 wholesale in legal markets. Packaged in a counterfeit Dank Vapes or Runtz cart with a convincing holographic sticker, that same gram retails for $40–$60 on the illicit market. Margins that legal operators — who pay testing fees, excise taxes, and licensing costs — simply cannot match.

What changed after EVALI isn’t that the market shrank. It’s that the market professionalized its deception.

Counterfeit packaging operations have become alarmingly sophisticated. Printing facilities — many operating out of China and shipped through grey-market channels — produce replica boxes, child-resistant bags, and QR codes that scan to fake lab results. The holographic seals are nearly indistinguishable from licensed brands. Some operations have started replicating the exact batch numbers and COA (Certificate of Analysis) formats of legitimate companies, creating documents that look credible to anyone without access to the original lab’s database.

The cartridges themselves are sourced from the same hardware suppliers that serve the legal market. A $2 ceramic-core cart from Shenzhen looks identical whether it ends up in a licensed California dispensary or a grey-market operation in a state with no legal adult-use sales.

What Independent Labs Are Actually Finding

The data from independent lab analysis is sobering. Several academic institutions and harm-reduction organizations have conducted systematic testing of illicit cartridges purchased from unregulated sources over the past three years. The results paint a consistent picture.

Vitamin E acetate remains present in a significant percentage of tested illicit cartridges — estimates from 2024 and 2025 sampling campaigns suggest somewhere between 18–35% of black-market carts still contain detectable levels, despite post-EVALI awareness. The compound is simply too cheap and too effective as a thickener to disappear entirely.

Heavy metals represent a less-publicized but equally serious contamination vector. Cheap cartridge hardware — particularly cartridges with low-quality metal contact points and non-food-grade solder — can leach lead, cadmium, chromium, and nickel directly into heated oil. One 2024 analysis from a consortium of university toxicologists found lead concentrations above California’s legal action level in roughly 40% of illicit cartridges tested, and in approximately 6% of cartridges from legal markets with the least stringent hardware testing requirements.

Pesticides tell a particularly grim story. Myclobutanil — a fungicide commonly used in conventional agriculture — converts to hydrogen cyanide when combusted or vaporized. It’s banned from use on cannabis in every regulated state. It appears regularly in illicit product. Beyond myclobutanil, labs have found bifenazate, abamectin, spiromesifen, and chlorpyrifos in concentrations far above the action levels that trigger failures in regulated markets.

Residual solvents round out the primary contamination categories. Butane, propane, and ethanol are standard extraction solvents that, when purging is inadequate, can remain in final product. More alarming are findings of non-cannabis-industry solvents — including acetone and isopropyl alcohol — in some illicit samples, suggesting improvised extraction setups with no purging process at all.

The contrast between tested legal product and untested illicit product is stark enough that it functions almost as a natural experiment in the consequences of regulatory oversight.

In states with robust testing requirements — California, Colorado, Washington, Illinois — legal cartridges show pesticide failure rates below 1% in post-market audits. Heavy metal contamination above action levels is rare, typically caught through mandatory hardware testing requirements that went into effect in most mature markets between 2022 and 2024. Residual solvent failures in licensed products are similarly uncommon: under 0.5% in most state audit data.

Compare contaminant profiles with our Vape Cartridge Analyzer below to see what testing reveals across different market segments.

Illicit product sampled from the same geographic markets tells a different story. Multiple independent testing campaigns have found pesticide contamination in 60–80% of illicit samples, with a substantial fraction showing contamination at levels ten to fifty times above regulatory action limits. Heavy metal contamination above recognized safety thresholds appears in 35–45% of tested samples. And some fraction of every tested illicit batch shows adulterants — including vitamin E acetate, MCT oil, and polyethylene glycol — that have no place in a cannabis vape cartridge.

The gap between these two populations is not primarily a function of cannabis plant quality. It’s almost entirely a function of whether anyone tested the product before it reached a consumer’s lungs.

The Hardware Problem Nobody Talks About Enough

Even legal cartridges carry a risk category that regulators are still catching up to: the hardware itself.

Cannabis vape cartridges heat oil to temperatures between 200°C and 250°C at the point of the coil. At those temperatures, the materials a cartridge is made from matter enormously. Low-quality cartridges — manufactured primarily in Shenzhen and Guangzhou for global export — frequently use coil housings with lead-containing solder, metal contact points with insufficient plating thickness, and plastics in the oil pathway that off-gas at vaping temperatures.

The issue is that cartridge hardware exists in a regulatory grey zone. Cannabis is tested by state-licensed labs. The cartridges themselves are manufactured overseas, imported through normal electronics channels, and subject to consumer product safety standards that weren’t written with inhalable cannabis oil in mind.

California moved first, implementing mandatory heavy metals testing on cannabis-containing oil-hardware combinations in 2022. Several other states have followed. But in states with newer or less developed regulatory programs, hardware safety requirements remain minimal or nonexistent. A compliant cartridge in one state may fail on hardware safety grounds in another.

For consumers, the practical implication is disquieting: even if you buy from a licensed dispensary, the hardware your oil is in may not have been subjected to meaningful safety testing unless your state specifically requires it.

State Testing Requirements: A Patchwork With Consequences

There is no federal standard for cannabis vape cartridge testing. There is no interstate consistency. What gets tested, how it gets tested, and what concentrations trigger a failure varies dramatically depending on which state issued the license.

In mature regulatory markets, a compliant vape cartridge has typically been tested for a comprehensive battery of contaminants: 66 or more pesticides, residual solvents, heavy metals in both oil and hardware, mycotoxins, microbial contaminants, and potency. Action levels are generally calibrated against inhalation risk, not ingestion risk — an important distinction, since inhaled compounds reach the bloodstream faster and bypass digestive metabolism.

In states that legalized more recently, or in states that opted for minimal regulatory frameworks, the required test battery may cover only a handful of pesticides, may use action levels derived from food safety standards rather than inhalation models, and may not include any hardware testing at all.

This isn’t a hypothetical concern. Post-market surveillance programs in several states have identified products that passed testing in their state of origin but would have failed in states with more comprehensive requirements. The contaminants don’t stop at state lines. The regulatory standards do.

How to Spot a Fake: The Honest Limitations of Consumer-Level Detection

The cannabis industry and harm-reduction advocates have invested real effort in consumer education around counterfeit cartridges. Most of that guidance is useful as far as it goes, but it’s important to be honest about its limits.

Things that are genuinely useful to check:

Purchase location matters more than any product feature. A cartridge purchased from a licensed dispensary that requires state-mandated testing has passed through a regulatory filter. A cartridge purchased anywhere else — whether from a delivery service, a friend, a convenience store, or online — has not, regardless of how professional the packaging looks.

QR codes that link to real COAs from verifiable labs are a meaningful signal, but they require effort to verify. The lab named on the COA should be a licensed laboratory in the state where the product was sold. The batch number on the package should match the batch number on the COA. The COA should show a test date within the product’s reasonable shelf life. If any of these elements don’t align, the documentation is likely fabricated.

Oil clarity and color can be suggestive but are not reliable indicators. Legitimate distillate ranges from water-clear to amber depending on refinement level and cannabinoid profile. Illicit product appears across the same spectrum.

Hardware quality — ceramic mouthpiece, glass or ceramic oil reservoir, clean threading — correlates weakly with legitimacy. Counterfeit operations increasingly use hardware that’s indistinguishable from licensed products.

The uncomfortable truth: A sophisticated counterfeit, purchased outside a licensed dispensary, cannot be reliably identified by a consumer without laboratory testing. The packaging, the oil appearance, the QR code, and the hardware may all appear legitimate. The only way to know what’s in a cartridge is to test it.

Harm Reduction Starts With Regulated Markets

The EVALI crisis demonstrated something that public health advocates had argued for years before the outbreak: when cannabis exists outside of regulatory frameworks, consumers bear all of the risk that oversight would otherwise mitigate.

Vitamin E acetate didn’t appear in legal product in meaningful quantities. It appeared almost exclusively in illicit product, primarily in states where legal adult-use markets either didn’t exist or were insufficiently developed to undercut the illicit market on price and accessibility. The CDC’s investigation made this pattern clear: EVALI cases clustered heavily in states without legal adult-use markets, and the case-patients who reported exclusive use of legal dispensary products showed dramatically lower rates of EVALI diagnosis.

This is the core argument for regulated markets, stated in the starkest possible terms: when cannabis is legal, tested, and accessible, people die less from cannabis. When it isn’t, they don’t stop using it — they just use a product that may contain compounds that destroy lung tissue.

That argument doesn’t require anyone to be naive about the limitations of regulatory systems. State testing programs have gaps. Enforcement of licensed-market compliance is inconsistent. Hardware safety requirements lag where they should lead. These are real problems that deserve continued pressure and improvement.

But the alternative — an unregulated market where the only constraint on product quality is the supplier’s conscience — has a known body count attached to it. The 68 people who died from EVALI weren’t casualties of cannabis. They were casualties of contaminated cannabis, sold without testing, in a market that had no mechanism to catch what was in the cartridge before it reached their lungs.

What Needs to Happen

The path forward on vape cartridge safety requires action at multiple levels simultaneously.

Federal rescheduling — the long-anticipated shift of cannabis from Schedule I — would create the preconditions for federal product safety standards that currently cannot exist. The FDA cannot regulate cannabis products the way it regulates tobacco products or food supplements as long as the substance remains federally illegal. Removing that barrier doesn’t automatically produce good regulation, but it creates the legal framework within which good regulation becomes possible.

At the state level, the gaps in testing requirements need to close — particularly around hardware safety, which remains inadequately addressed in most markets. The action levels used for inhalation risk need to reflect actual inhalation toxicology rather than food safety proxies.

At the industry level, the licensed cannabis sector has a direct economic interest in making the quality differential between regulated and illicit product visible and credible to consumers. That means better COA accessibility, better consumer education, and honest engagement with the remaining safety questions inside legal markets rather than treating regulation as a compliance burden to minimize.

And at the consumer level — the harm reduction principle that has always been central to honest cannabis advocacy — people who are going to use vape cartridges regardless of their legal status deserve accurate information about what the risks are and how to reduce them. Buying from licensed dispensaries is the most effective single harm-reduction step available to the average consumer. It’s not a guarantee of safety. It’s a meaningful reduction in a known and measurable risk.

The lung tissue of the people who survived EVALI bears the lasting evidence of what happens when that risk isn’t managed. Six years later, the market conditions that produced the crisis are still substantially in place. The question is whether the policy response is keeping pace.