Is CBD legal?

Technically yes, but the answer isn't quite so cut and dried. 

The cannabis plant comes in many different varieties. For decades though, the US Drug Enforcement Administration (DEA) treated them all the same, classifying cannabis as a Schedule I substance. Schedule I drugs are considered to have "no currently accepted medical use and a high potential for abuse" and are thus illegal to produce or possess. 

However, the Agriculture Improvement Act of 2018 (aka the Farm Bill) changed all that. The Farm Bill legalized "hemp," which the legislation defined as cannabis that contains no more than 0.3% THC, nationwide. 

Cannabis that contains higher levels of THC is now listed as "marijuana" and remains a Schedule I drug. 

CBD products are sold online, or at dispensaries in states where cannabis is legalized.

In other words, if a CBD oil product comes from a hemp plant, it's legal; if it comes from a marijuana plant, it's federally illegal, despite local laws. And even if it does come from a hemp plant, there's often no guarantee it won't contain THC, thanks to things like cross-pollination and the absence of industry regulation (see "What are the risks of taking CBD?" below).

The Food and Drug Administration is currently trying to figure out how to regulate CBD, which now falls under their purview. But in the meantime, experts recommend buying CBD products from companies located in states like Indiana and Utah that require cannabis products to be tested for potency and purity