If you are a legal MMJ patient living in a cannabis friendly state, you are most likely already familiar with the process of using some of the more popular dispensary locator tools like Weedmaps and Leafly. Gone are the days of sneaking into the shadows to quickly exchange money for a bag of weed, or hoping a friend’s friend’s cousin can come through for you. Times change, businesses change, and patient’s needs change, but internet magnates such as Yelp, Google and Facebook continue to resist the idea of accepting and focusing on building cannabis-related listings. For the past decade, WeedMaps has been considered to be an effective alternative to the mainstream websites — especially for high-risk clients like dispensaries and delivery services.

Today, dispensary locator tools are used by a majority of dispensaries, delivery services, and even doctors to help drive patients to purchase their products and services. They often offer directory-style listings of dispensaries, along with menus and customer reviews. But how accurate and trustworthy are these sites?

A recent investigation by the Los Angeles Times uncovered multiple disturbing flaws with the largest of these sites, Weedmaps. After discovering that Weedmaps users’ IP addresses were publicly available (a data breach that has since been fixed by Weedmaps), the authenticity of many of the reviews on the site was also brought into question.

Weedmaps Data Breach

According to the LA Times, Weedmaps users’ IP addresses were included in publicly accessible code until the data breach was fixed shortly after the newspaper questioned the security lapse with Weedmaps officials, even though the company had been notified of the breach at least two weeks prior.

“It’s personal information that should be stored in a secure way.” – Andrew Komarov, CTO InfoArmor Inc.

While an IP address alone may not be enough to identify someone, it could potentially reveal a user’s physical address. When patient privacy is at stake, such an oversight is unacceptable — especially from a company that bills themselves as “the oldest and largest technology company” in the cannabis industry. “It’s personal information that should be stored in a secure way,” Andrew Komarov, chief intelligence officer at data security firm InfoArmor Inc., told the LA Times.

Even more disturbing, however, are trends within the breached data that calls into question the authenticity of the reviews being submitted on Weedmaps, and presumably on similar sites such as Weedmaps chief rival, Leafly.

Authenticity of Reviews

There are a large number of dispensaries engaging in questionable practices in hopes of boosting their rank on sites such as WeedMaps and Leafly, and people are starting to take notice. Patients are regularly enticed to leave positive reviews in exchange for either a discount or entirely free products with their next donation. Matt Price, CEO of Medical Jane, says this is a common practice for many dispensaries with listings on services like Weedmaps.

According to Mr. Price, “newer collectives and delivery services are often very impatient and think short-term rather than long-term. They desperately want to appear popular on online services to build their service’s credibility and they know that people tend to make decisions based on what others are saying. Because of this, many [untrustworthy] locations simply do not care if their reviews come from loyal patients who frequently visit their location or if they come from one-time shoppers who are taking advantage of a special offer — people that have no idea about the actual quality of their service. These dispensaries really just want as many positive reviews as possible… and they are willing to pay people for their good praise.”

“Of the 598 dispensaries examined, 70% were found to have at least one batch of reviews from users with the same IP address.”

The LA Times investigation also brings into question the authenticity of the reviews themselves since many of them are “tainted by potentially thousands of fraudulent comments.”

Assisted by a software developer, the Times looked at the listings of 598 dispensaries and found that 70% had at least one batch of reviews from users with the same IP address. A separate software developer looked at the listings of 300 of the most-reviewed dispensaries and found that 43 of the dispensaries had over 100 questionable reviews, with 20% of all reviews coming from a single batch of users.

According to multiple independent analyses of the leaked IP data, 60% or more of the reviews on Weedmaps could be fake, and many of the “real” reviews may be skewed due to dispensaries offering discounts in exchange for positive reviews.

Fakespot, a NY company who finds and identifies fake reviews on Yelp and Amazon, also evaluated the leaked data. They found issues with 62% of the reviews on Weedmaps, enough to earn an F-grade by online shopping standards. In comparison, Fakespot deems approximately 40% of reviews on Amazon are fake.

Who’s to Blame? When Is Enough… Enough?

The LA Times investigation, which started as a data breach story but soon uncovered deceptive product review practices as well, has brought into light a dirty, dark secret that many know about but very few are willing to talk about.

While company executives and stakeholders pad their pockets with advertising dollars collected from dispensaries listing on Weedmaps, cannabis patients suffer from unreliable information and their private data is at risk of being exposed to the masses. Meanwhile, many dispensary owners are taking advantage of patients by boosting their popularity — and profits — by offering incentives to customers posting “positive” reviews. Let’s not get into how dispensaries on Weedmaps use their power to have negative reviews removed from their listing; that’s a completely different can of worms you are welcome to investigate.

Patients’ well being, privacy and, most importantly, access to accurate information, should be the primary focus of those who wish to be industry leaders within the cannabis community. Unfortunately, the reality is much different.

One thing is for sure: Patients deserve better.