Date of Last Revision: January 12, 2026

Verano Holdings Corp. (“Verano”, “our”, “us”, or “we”) takes protecting your privacy seriously and wants to help you better understand how we collect, use, protect, and share your Personal Data. This Privacy Policy is designed to help you understand your privacy choices when you visit our Websites or use any of our Products. This Privacy Policy does not apply to any third party, including through any application or content (including advertising), that may link to or be accessible from or through the Websites.

We encourage you to read this Privacy Policy carefully and take the time to get to know our privacy practices. By accessing the Websites and/or the Products, you are bound by all terms and conditions in this Privacy Policy. If you do not wish to be bound, you may not access the Websites and/or the Products.

Definitions.
1. Information Types.
  1. “Browser Information” means data or information provided by a browser, including the IP address, the website visited, and network connection.
  2. “Contact Information” means basic personal and business information, such as first and last name, company name, email address, postal address, phone number, and may include social media account information.
  3. “Device Information” means information about your device, such as device ID number, model, and manufacturer, version of your operating system and geographical region, collected from any devices when accessing our Websites or any of our Products.
  4. “Usage Information” means information collected when you interact with the Verano Websites or any of our Products, including functionalities accessed, pages visited, and other interaction data.
2. “Controller” means an entity that determines the purposes and means of the Processing of Personal Data.
3. “Cookie” means a small file that resides on your computer’s hard drive that often contains an anonymous unique identifier that is accessible by the website that placed it there, but is not accessible by other sites.
4. “Personal Data” or “Personal Information” means information that (i) relates to an identified or identifiable natural person, or (ii) identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer.
5. “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, including, but not limited to, alteration, collection, organization, recording, retrieval, storage, transmission, and use.
6. “Processor” means the entity that processes Personal Data on behalf of the Controller.
7. “Products” means all Verano content, products, services, and materials located on or accessible through the Websites.
8. “Third-Party Products” means any third-party information, website, product, service, or materials referenced in, accessible through, or provided in connection with, the Websites or Products.
9. “Visitor” means an entity or natural person that visits or interacts with the Websites.
10. “Websites” means the Verano website located at https://verano.com/ and all Verano affiliated websites.
How Do We Collect Information and What Information Do We Collect?
1. When Visitors visit our Websites, or engage in communications with us online or offline, we may collect Browser Information, Contact Information, Device Information, Personal Information, and Usage Information.
2. We may collect the following types of information from you or your device(s):
  1. identifiers, such as Browser Information and Device Information;
  2. commercial information, such as Contact Information and Usage Information;
  3. internet or network information, such as Browser Information and Device Information;
  4. geolocation data, such as Browser Information and Device Information;
  5. other Personal Information, including driver’s license and medical customer identification; and/or
  6. information derived from other categories, which could include your preferences, interests, and other information used to personalize your experience; and
  7. Site search and on-site queries. When you use our on-site search function, we collect the text of your query. The full page URL of the results page, which may contain your search term is the query string, may be sent to our analytics service provider, Google Analytics, to help us measure search performance and improve relevance. See “Cookies” and “How Do We Share the Information we Collect” for details and controls.
3. In accordance with applicable state regulations governing cannabis businesses, we comply with state-specific data privacy laws. These laws differ from state to state, and your state may provide for rights in addition to those described in this policy. To comply with state law we collect, process, and store personal data including customer purchase history, identification verification, and, where applicable, medical cannabis customer data. If you are a medical cannabis customer, additional protections may apply to your personal data.
How Do We Use the Information We Collect?

We use the information we collect in our role as data Controller to:
1. provide our Products;
2. confirm identities;
3. to communicate with you, including required communications regarding updates to our Products or polices;
4. to administer your participation in the Rewards Program, including earning, redeeming, and tracking points and tiers/status, and providing member benefits and Rewards offers;
5. to send promotional communications;
6. for advertising and marketing,
7. to send you invoices for products and services you purchase
8. to resolve incidents or problems reported by you related to the use of our Websites and Products;
9. for reporting to state regulatory agencies;
10. to comply with legal requirements;
11. perform analytics, which help us understand how visitors use the site, including how the search feature is used (e.g., the search terms entered and the pages visited afterwards), so we can troubleshoot, prevent abuse, and improve content and navigation. Analytics are performed with Google Analytics acting as our service provider under contract;
12. as may be necessary in a business transaction concerning the sale or transfer of our assets; and/or
13. in other cases where the Visitor has given express consent.
Medical Cannabis Customer Data

Certain state laws require cannabis businesses to collect and retain data from customers who are medical cannabis users, including identification numbers and purchase records. Verano follows industry best practices for securing this information. We take data security seriously and comply with state-specific cannabis regulations regarding medical cannabis data.
How Do We Share the Information We Collect?

Verano works with select third-party service providers to support our business operations, including payment processing, marketing, compliance reporting, and inventory tracking. We only share personal data with these partners when necessary to deliver services, and all partners must adhere to strict confidentiality and security agreements.

We may share personal information with:
1. Point-of-Sale (POS) & Compliance Tracking:
  1. Third-party service providers supporting order processing, inventory tracking, and compliance with state regulatory requirements.
  2. State and local regulatory agencies for mandatory reporting on sales, purchases, and medical user data, as required by law.
2. Marketing & Customer Engagement:
  1. Authorized marketing platforms for email and SMS campaigns, only with explicit consent.
  2. Analytics and tracking tools for website performance analysis, campaign optimization, and customer experience improvements.
  3. Digital advertising networks for paid search, display advertising, and performance tracking. Users can manage preferences via ad settings.
  4. Analytics and measurement (Service Provider). We use Google Analytics to measure and improve website performance, including how visitors use the site’s search function. We configure Google Analytics to operate as our service provider/processor, and we do not permit Google to use the data for its own independent purposes. Google Analytics receives page information (including full page URLs, which may contain a search query) and pseudonymous identifiers (e.g., cookie IDs). Learn about Google Analytics’ data practice and opt-out tools in “Cookies”.
  5. Advertising and Campaign measurement. When we run paid campaigns (for example, with X), we may enable conversation measures so the platform can report ad effectiveness. Depending on settings and your choices, these tools may receive page information and pseudonymous identifiers (e.g., cookie IDs). See “Ad Networks,” “Cookies,” and “California Notice at Collection” for opt-out options.
3. Event & Giveaway Management:
  1. Platforms facilitating event invitations, sweepstakes, and promotions.
  2. Survey and feedback tools used to gather customer insights and improve services.
4. Additional Service Providers & Future Platforms:
  1. We may also use additional analytics, advertising, and operational platforms as needed to support Verano’s business functions. Any such platforms are required to adhere to applicable privacy and security standards.
5. Your Privacy Choices
  1. We do not sell your personal data to third parties.
  2. You can opt out of marketing-related data sharing by emailing privacy@verano.com with the subject line “Marketing Opt-Out.” You cannot opt out of data sharing required by law for regulatory compliance purposes.
  3. Third parties may have their own privacy policies. We encourage reviewing their policies before interacting with their services.
How Do We Store the Information We Collect?

Verano retains personal information for the period required by applicable state cannabis regulations or for as long as necessary to fulfill business or legal obligations. Specifically:
1. Medical cannabis customer records are retained in compliance with state laws, which may require storage for up to 7 years.
2. Purchase and transaction history for recreational cannabis is stored as required by state tax and regulatory authorities (typically 3-5 years).
3. Marketing and promotional data is retained only as long as necessary to provide services and will be deleted upon request.
4. Event-level analytics data associated with cookies and user identifiers is retained by Google Analytics for 14 months (configured in our GA4 property, after which it is automatically deleted by the platform).
If you wish to request deletion of your personal data, you may contact us at privacy@verano.com with the subject line “Data Deletion Request.” Please note that in some cases, we may be required to retain certain data for legal or compliance reasons.
Promotional Offers from the Company

Verano offers promotional communications via email, SMS (text messages), and push notifications. We comply with the Telephone Consumer Protection Act (TCPA), the CAN-SPAM Act, and state-specific marketing laws.

Opt-In Requirements:

By signing up for SMS, email, or push notifications, you expressly consent to receive marketing messages from Verano and its affiliates, including Zen Leaf and MÜV dispensaries. For SMS marketing, explicit written consent is required.

Opt-Out Instructions:

You may opt out of marketing communications at any time:
Opting out will not affect transactional or regulatory communications required for compliance (e.g., order confirmations, receipts, or account security alerts).
Ad Networks

If we purchase interest-based targeted advertising through third-party programmatic advertising networks (such as X, PubMatic or DoubleClick), those networks may collect data about your interactions with our Websites and other sites, and use that data to deliver targeted ads to you on third-party websites that you may visit. See “California Notice at Collection” for your opt-out rights and “Cookies” for controls. Users can opt out of some types of targeted advertising through the Network Advertising Initiative (NAI) opt-out page, or by adjusting ad preferences in their browser or device settings. Currently, Verano does not purchase targeted advertising through third-party programmatic advertising networks, but if this changes, this Privacy Policy will be updated accordingly. If and when our advertising settings meet the CPRA definition of “sharing,” California residents may opt out at any time.
Data Subject Rights

Depending on your state of residence, you may have certain rights regarding your personal information under applicable privacy laws, including:
1. Access & Correction: You may request a copy of your personal data or ask us to correct inaccurate information.
2. Deletion: You may request that we delete your personal data, subject to certain legal and regulatory retention requirements.
3. Data Portability: You may request a copy of your data in a structured, machine-readable format.
4. Opt-Out of Data Processing: You may opt out of the sale of personal data (if applicable) or the processing of your data for targeted advertising.
5. Limit the Use of Sensitive Data: Some states allow consumers to restrict the use of sensitive personal data, such as geolocation or medical information.
  
  How to Submit a Request
  
  To exercise your rights, contact us at:
  
  Email: privacy@verano.com (Subject: “Data Subject Request”)
  
  Mail: Verano Holdings Corp., 224 W Hill Street, Suite 400, Chicago, IL 60610
  
  If you submit a deletion, correction, or access request, we may need to verify your identity before processing your request. This may include confirming details such as your name, address, and recent transactions.
  
  Limitations on Data Deletion
  
  Verano may be required to retain certain information to comply with state cannabis regulations, tax laws, and legal obligations. For example:
  - Medical cannabis records may need to be retained for up to 7 years in some states.
  - Transaction history may be kept for compliance with tax and regulatory agencies.
  If we are unable to verify your identity or if your request conflicts with legal requirements, we may deny your request and will notify you accordingly.
California Notice at Collection

We collect personal information as defined by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Categories collected may include identifiers (e.g., IP address, cookie IDs), internet or network activity (e.g., page views, search queries you enter on our site), device information, and approximate geolocation. Purposes include providing and securing the Websites, performing analytics (including via Google Analytics), improving the user experience, and measuring the effectiveness of our communications. Recipients include our services providers (e.g., Google for analytics), and, where applicable, advertising partners when we run paid campaigns (see “Ad Networks” and “How Do We Share the Information We Collect?” above. We do not sell personal information and we do not “share” personal information for cross-context behavioral advertising unless expressly stated in this Policy and subject to your choices. Retention periods appear in the “How Do We Share the Information We Collect?” Section above. California residents also have certain data subject rights. These rights include:
1. Right to Know: You can request a list of the categories of personal information we collect, use, and disclose.
2. Right to Access: You can request a copy of the personal data we have collected about you.
3. Right to Delete: You can request that we delete your personal data, subject to legal retention requirements.
4. Right to Correct: You can request that we correct inaccurate personal information.
5. Right to Opt-Out of Data Sharing: We do not sell personal information. We also do not “share” personal information for cross-context behavioral advertising unless we enable advertising features that meet CPRA’s definition (e.g., linking analytics data with ad targeted). If and when we do engage in such “sharing,” you may opt out at any time via “Do Not Sell or Share My Personal Information” link that we will make available as required by law.
6. Right to Limit Use of Sensitive Personal Data: You may request restrictions on how we use certain sensitive information (e.g., ID verification data).
To exercise any of these rights, contact us at:
- Email: privacy@verano.com (Subject: “California Privacy Request”)
- Mail: Verano Holdings Corp., 224 W Hill Street, Suite 400, Chicago, IL 60610
For identity verification, we may request additional details such as your name, address, or past transactions before processing your request.
Rights of Users from the European Economic Area and the United Kingdom

If you are a resident of the United Kingdom (“UK”), European Union, or European Economic Area (“EEA”), you may have certain data protection rights. “GDPR” means the European Union General Data Protection Regulation (EU) 2016/679, and the United Kingdom Data Protection Act 2018. Information that you provide may be transferred or accessed by entities around the world as described in this Privacy Policy. If you are located in the EEA or UK, you freely consent to the transfer of personal information outside of the EEA and UK. Your consent to this Privacy Policy together with your submission of personal information constitute your agreement to these transfers. If you are accessing or using the Websites from within the EEA or UK, you may have the following rights under the GDPR (as well as other rights). If you wish to exercise any of these rights, you may do so by contacting us as provided in this Privacy Policy.
Credit Card Information

Verano does not process credit card information for payment for any Products you may order from our Websites. Verano contracts with a third party service provider that complies with the payment card industry data security standards (PCI DSS) to collect and process your credit card information. We do not store or maintain any credit card information.
Cookies

Verano and its third-party service providers use cookies, web beacons, and similar tracking technologies to enhance user experience, analyze website traffic, and support marketing efforts.

Types of Cookies We Use:
- Essential Cookies – Necessary for website functionality (e.g., login, security).
- Functional Cookies – Improve user experience (e.g., remembering preferences).
- Analytics Cookies – Help us analyze how users interact with our website.
- Advertising Cookies – Used for marketing and retargeting (if applicable).
We use Google Analytics 4 (GA4) to understand website usage. GA4 receives page information (including the page URL by default, which may include search terms in the query string) and pseudonymous identifiers (e.g., Cookie IDs). GA4 documentation states it does not log or store IP addresses. You can learn more about and control GA4 via the Google Analytics Opt-Out Browser Add-On and our Preferences link below.

Managing Cookies & Tracking Preferences:

You can control or disable cookies through your browser or device settings. The method varies by platform:

Web Browsers:
- Google Chrome: Manage Cookies
- Apple Safari: Manage Cookies
- Mozilla Firefox: Manage Cookies
- Microsoft Edge: Manage Cookies
- Google Analytics: You may opt out of tracking using the Google Analytics Opt-Out Tool.
iOS Apps:

If you use our iOS app, Apple may require us to obtain your consent before tracking your data across apps and websites. You can manage app tracking preferences in: Settings → Privacy & Security → Tracking on your iPhone.

Progressive Web App (PWA):

If you access our website as a PWA, tracking technologies function similarly to a standard web browser. You may need to clear site data manually in your browser settings to remove stored information.

By continuing to use our website or apps, you consent to our use of cookies as described in this Privacy Policy. If you have any questions, contact privacy@verano.com.
Do Not Track

Do Not Track is a privacy preference that Visitors can set in their web browsers. When a Visitor turns on the Do Not Track signal, the browser sends a message to websites requesting them not to track the Visitor. At this time, we do not respond to web browser “do not track” settings or signals. We may deploy technologies on our Products to collect information about you and your browsing activity, even if you have turned on the Do Not Track signal.
Protecting Your Personal Information

Verano implements commercially reasonable security measures to protect personal information from unauthorized access, use, and disclosure. However, no system is completely secure. In the event of a data breach involving personal information, Verano will comply with applicable federal and state laws regarding breach notification. For questions about data security, you may contact us at privacy@verano.com.
Transfer of Data

Your Personal Information may be transferred to–and maintained on–computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. We will take steps reasonably designed to treat your Personal Information securely and in accordance with this Privacy Policy, as further described below.
Updates

We may update this Privacy Policy from time to time in response to changing legal, technical or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws. You can see when this Privacy Policy was last updated by checking the “Date of Last Revision” date displayed at the top of this Privacy Policy.
Contact Us

For questions about this Privacy Policy or to exercise your privacy rights, you can contact us using the following methods:
- Email: privacy@verano.com
- Mail: Verano Holdings Corp. 224 W Hill Street, Suite 400 Chicago, IL 60610
- Phone: (866) 905-1005
If submitting a privacy-related request, please include your full name, contact information, and the nature of your request so we can process it efficiently.

Featured Brands

About Zen Leaf

Find Us

Savings & Deals

New to Cannabis?

Cannabis Education

Resources

Help & FAQs

Privacy Policy