As of today, CBD oil is still a Schedule I controlled substance under the Controlled Substances Act. There is currently only one product which can legally be sold at the federal level - Epidiolex. Note that this is a Schedule V substance, meaning that it must be prescribed by a doctor.
The Food and Drug Administration considers hemp to be "generally recognized as safe." Therefore, hemp products can be sold via interstate commerce so long as the source was legal. Generally speaking, the 2018 Farm Bill made industrial hemp much easier to grow legally, which should reasonably eliminate questions about the legality of the source for these hemp products (that was the issue pre-bill).
Businesses that sell CBD Oil are *going* to tell you that it's legal - they're sick of getting hassled and/or having no place to bank. Trouble is - they're either lying to get a bank account or lying to consumers to capitalize on the cannabis marketing trend. If they're selling *real* CBD, it's still illegal federally. If they're selling "hemp extract" marketed as CBD, then it's not real CBD. From a SAR filing perspective, selling real CBD is more obviously problematic, whereas questionable advertising is a bit more of a gray area.
I'll give an example. I went to a gas station that was selling a product purporting to be "CBD Gummies." Out of curiosity, I looked at the ingredients. Reading the package, I saw one of the main ingredients was l-theanine, a calming/anti-anxiety amino acid most well-known for being in green tea. The product was supposedly tested by an independent lab, but who knows since it's not regulated. Why would a manufacturer bother to spend money adding that to *real* CBD product, which is supposed to have an even stronger calming effect?
Anyway, bottom line, CBD is not federally legal yet. And any product manufacturer making that claim is either selling real CBD illegally or selling fake CBD.