Medical marijuana is in the news a lot these days, with a compound called CBD, a component of cannabis, and products containing CBD exploding in stores and online.

But not much research has been done, so it’s hard to know whether CBD is effective. And laws vary from state to state, so it can also be difficult to know what’s legal.

Consumer Reports cuts through the confusion and reveals the ABCs of CBD.

CBD comes from hemp or marijuana. The CBD products sold on most store shelves have little to no THC, the chemical that makes you feel high. CBD is often sold as an oil, a cream, a gummy or a pill.

There is promising early research showing that CBD can be helpful for conditions such as pain and anxiety. But at this point, it has only been proven to treat epilepsy. The FDA recently approved the first cannabidiol drug in the U.S., Epidiolex, to treat two rare but severe forms of epilepsy.

But the legality of the CBD products you can buy online, at a store, or at a dispensary can be confusing.

Because the federal government classifies anything that comes from the marijuana plant, including CBD, as a Schedule 1 controlled substance, like heroin or LSD, it is illegal at the federal level. But with growing interest in the possible health benefits of CBD, many states have legalized it.

CBD is regulated differently from state to state, even in states where it’s legal, and regulations can get particularly confusing when you’re looking into products that are sold online.

Last year, a study found that only 26 of 84 products that researchers purchased online contained the amount of CBD claimed on their labels. Some didn’t contain any CBD, while others were found to also have THC.

With so much confusion around CBD, there are a few additional steps you can take.

First, look for CBD companies within states that have legalized the recreational and medical use of cannabis; these states tend to have stricter standards. Also, some states with medical marijuana laws require testing.

Next, look for companies that contract with third-party testers that do additional analysis beyond state requirements. And ask to see a Certificate of Analysis, or COA, that shows the results of testing.