From the outside, the store is clearly marked. Inside, rows of colorful products are on display. As far as any average shopper on this street in California can tell, this is a legal cannabis shop.

But it’s not.

Even in a state where it’s legal to buy, sell and use recreational cannabis, the California Bureau of Cannabis Control (CBCC) says there are still unlicensed and illegal stores operating openly — selling untested, potentially dangerous products, including THC vaping cartridges.

“It is difficult for consumers to know which shops are operating legally,” said Mark Hoashi, founder of Doja, an app that has been called the Yelp of cannabis.

Hoashi walks through a legal cannabis shop called Chronic Pain Releaf. It looks like a hip pharmacy complete with exposed brick and staffers they call budtenders. Throughout the visit, he repeats his mantra: “Buy legal.”

“I believe that legal vape cartridges are safe. Every drop of cannabis, from the seed all the way to when it’s consumed, is documented and reported to the state — not to mention all of the testing that is required for a product to make it to a legal dispensary,” Hoashi said.

But Hoashi cautions it’s not that easy to know if you’re buying from the legal market since some illegal shops can look just like the legal ones, even displaying counterfeit licenses and charging tax to make them seem legitimate.

This poses a danger to consumers, Hoashi said. About a year ago, he noticed that users on his app were reporting symptoms such as headache and nausea after vaping various cartridges. So he started having cartridges from unlicensed stores tested at a certified lab and posting the results on Instagram. What he found was that most contained illegal levels of pesticides and heavy metals. Hoashi said many of them also contain cutting agents that help keep the price down.

While all black market cartridges might not test positive for these illegal amounts of particular substances, the current nationwide outbreak of vaping-related illnesses and deaths is underlining a need for transparency when it comes to the products consumers are buying.

CNN obtained five THC cartridges from an illegal vape shop and had their contents tested at BelCosta Labs, one of California’s certified labs that approves cannabis products for consumer use. The results showed that the cartridges all contained a variety of pesticides that exceed the legal amount.

“When you concentrate the THC, you concentrate everything along with it,” said Myron Ronay, who runs BelCosta Labs. “So every pesticide that could’ve been in that plant material — if it went from, let’s just say 20% THC, and now you’ve concentrated it to 80% THC — you’ve also concentrated the pesticides that same amount.”

Finding the culprit

Official testing laboratories in California are required to test for cannabinoids, the active ingredient in cannabis, but also a number of substances including pesticides, various fungal and bacterial contaminants, heavy metals and other chemicals, according to the CBCC.

The US Centers for Disease Control and Prevention’s investigation into a recent outbreak of vaping-related injuries identified vitamin E acetate as a chemical of concern, although officials have said there may be more than one cause and that they are investigating many different substances and product sources.

Vitamin E acetate is generally considered harmless in foods, supplements and lotions, but inhaling it “may interfere with normal lung functioning,” according to the CDC. In THC-containing vaping products, it has been used as a thickening agent — a way to pass what’s known as “the bubble test.”

“You take a cartridge and you flip it over,” Ronay explained. If the bubble moves too fast, people might assume it’s been diluted with some kind of additive. So some black market sellers turned to vitamin E acetate — which is more viscous and resembles THC distillate — to cut their product while still passing the bubble test.

The CBCC doesn’t currently require labs to test for vitamin E acetate, but said it’s now under consideration.

Ronay said a product’s potency is one good way to tell if there’s a cutting agent present. A typical legal THC cartridge might have 70-90% pure THC distillate with the rest containing terpenes — aromatic oils which give it flavor. Illegally cut cartridges might have only 40-50% pure THC distillate, with the rest being filled with terpenes and something like vitamin E acetate.

Ronay said it’s hard to keep up because the black market is a moving target and vitamin E acetate is already being used less frequently than it was a few months ago.

“From what I’m hearing now, it’s going away. And we’re not seeing as much, even in the illicit market. But it’s still a major issue,” he said. “They may be on to the next cutting agent.”

Spotting a fake

Think you can tell a black market THC product from one that’s made legally? It might be harder than you think.

“The black market very much looks like a regular market in packaging,” said Art Kushkyan, founder of Pure, a legal THC vaping product manufacturer. “It has a name. It has a nice logo. It has colorful packaging.”

Just like illegal stores, illegal products look good on the surface. They might be professionally packaged and they are sometimes counterfeits of legitimate brands, like the fake Louis Vuitton bags of the vaping world.

Kushkyan experienced this first-hand when he realized replicas of his brand’s own packaging were available for purchase online.

“It was infuriating to find out that anyone could purchase … packaging and a cartridge that looks like ours, fill it and sell it without us even knowing it,” Kushkyan said. “It definitely affects us as a brand. It affects our reputation. It affects our bottom line. But most importantly, it creates a possible danger [to] the public, consuming products that are untested.”

So how can you tell something is a legal, tested product?

First, it would come from a legal store — assuming, of course, that you’re in the District of Columbia or one of the 11 states where recreational THC use is legal: Alaska, California, Colorado, Illinois, Maine, Massachusetts, Michigan, Nevada, Oregon, Vermont and Washington.

In California, the best way to know if a store is legal is to look up a business on the Bureau of Cannabis Control’s website.

Other states with legal recreational cannabis industries also keep public registries of businesses with licenses to sell marijuana products, including the Oregon Liquor Control Commission⁠ and the Colorado Department of Revenue⁠.

In California, there should be a certificate of analysis for each product, which stores are obligated to provide. This will show a product’s lab results.

On the packaging itself, there are elements that are legally required in California. It’s important to note that legal products are not allowed to be marketed to children, so any label featuring a cartoon is a red flag.

But the black market is tricky, creating convincing packaging and even boosting fake brands with extensive social media presences.

The CDC says that THC cartridges sold under the Dank Vapes brand have been the most commonly reported in relation to THC lung injury cases and deaths, though there is no single source that has been linked to every case. CNN was unable to find any working contact information on any website with the Dank Vapes name, nor any business named Dank Vapes in the CBCC’s registry database.

“Dank Vapes is a well-known illicit brand,” Ronay added. “It does not have actual ownership or known licensing in any state.”

The federal government, along with state and local agencies, have been trying to track down the source of these materials that have led to this outbreak. The US Food and Drug Administration and the Drug Enforcement Administration recently announced they seized 44 websites that were advertising the sale of vaping cartridges containing THC.

“We need to fully understand the causes of vaping related lung injuries,” said FDA Commissioner Dr. Stephen Hahn in a press statement. “Moreover, it is a federal crime to advertise the sale of illicit THC vaping cartridges online, and by seizing these websites today, we are able to focus on other online and in-person sources of illegal and potentially dangerous vaping products.”

To ban or not to ban?

When recreational cannabis came on the market in California almost two years ago, Pure Vape’s Kushkyan was eager to experience what has been called California’s Green Rush.

“I think cannabis offered a new opportunity of a brand new industry coming straight out of prohibition that was wide open for entrepreneurs to come and be creative and explore all of the possibilities, and that was very exciting for us to start in there,” he said.

But while Kushkyan’s company took the necessary steps to become licensed under the new, tougher laws, CBCC’s Alex Traverso said not everyone has followed suit.

“Medical cannabis was legal in California for 20 years before any regulations came into place. It allowed the market to really become established and to have a lot of operators out there in the medical market,” he said. The challenge became transitioning those companies to operate legally in the recreational market, which faced more regulations.

Traverso said the grace period is over, so the bureau will be cracking down even harder on illegal operators, but that educating consumers is also important to solving this crisis.

“We are trying to run a public education campaign to change consumer behavior, because for a long time, the consumer was driven by the cost. What’s the price?” Traverso said. “Just because they’re cheap doesn’t mean they’re a good deal for you. It can turn out to be a very bad deal.”

With vaping-related lung injuries now reported in all 50 states, there are questions about whether bans on vaping products are the answer. Doja app founder Hoashi still believes encouraging people to buy legal is the way forward.

“With the overregulation and the overtaxation of the legal market, people are already drawn to the black market due to price,” Hoashi said. “With the vaping ban, it would only drive more people to the black market. People need education and awareness about the dangers of the illicit market.”

The CDC has some advice too: Don’t vape THC-containing e-cigarettes, or vaping products, particularly from informal sources like friends, family, or in-person or online dealers. In addition, people should not add any substances to e-cigarette or vaping products that are not intended by the manufacturer, including third-party products purchased through retailers.