State-Specific Provisions

While most state privacy laws share common elements, some states have unique requirements. Effective Date: October 2025

California

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• The right to limit use and disclosure of sensitive personal information
• The right to know what personal information is sold or shared and to whom
• Additional “Shine the Light” rights regarding third-party marketing

See our California Privacy Supplement for complete details.

Colorado, Connecticut, and Virginia

These states provide similar comprehensive privacy protections, including:

The right to appeal a company’s decision regarding your privacy request

Recognition of universal opt-out mechanisms

Requirements for data protection assessments for high-risk processing activities

Maryland

Maryland’s law includes stricter data minimization requirements:

• Collection limited to what is “reasonably necessary and proportionate” to provide requested products or services
• For sensitive data, collection limited to what is “strictly necessary”
• Complete prohibition on the sale of sensitive personal data
  
  

Minnesota

Minnesota provides additional rights:

• The right to be informed about and question automated decision-making
• The right to know the reasoning behind profiling decisions
• The right to access data used in automated decisions
• The right to learn about actions you can take to secure a different decision
  
  

Utah

Utah’s law provides more limited consumer rights:

• The right to delete only personal data that the consumer has provided
• No right to correct inaccurate personal data
• 
  
  

Sensitive Data Processing

Several state privacy laws have specific requirements regarding the processing of sensitive personal data, which generally includes:

• Data revealing racial or ethnic origin
• Religious beliefs
• Mental or physical health diagnosis
• Sexual orientation
• Citizenship or immigration status
• Genetic or biometric data
• Precise geolocation data
• Personal data of children under 16
• Financial account information

Depending on your state of residence, we may be required to:

• Obtain your explicit consent before processing sensitive data
• Provide clear notice and the opportunity to opt out of sensitive data processing
• Limit the collection and use of sensitive data to what is strictly necessary
• Implement additional safeguards for sensitive data
  
  

Universal Opt-Out Mechanisms

For residents of states that require recognition of universal opt-out mechanisms (such as Texas, Oregon, Montana, Colorado, Connecticut, Delaware, Nebraska, Minnesota, New Hampshire, New Jersey, and Maryland), we honor opt-out preference signals (such as Global Privacy Control) that communicate your choice to opt out of sales of personal data and targeted advertising.

Data Protection Assessments

For states that require data protection assessments (such as Texas, Oregon, Montana, Virginia, Colorado, Connecticut, New Jersey, Maryland, and Minnesota), we conduct and document assessments for processing activities that present heightened risks to consumers, including targeted advertising, sale of personal data, processing of sensitive data, and certain profiling activities.

How to Exercise Your State Privacy Rights

To exercise any of these rights under state privacy laws, visit www.covetrus.com/legal/privacy-request. We will respond to your request in accordance with applicable law. If your request is denied, you have the right to appeal the decision. We will provide instructions for appealing a denial when we respond to your request. If your appeal is denied, we will provide you with an online mechanism or other method to contact the appropriate state attorney general to submit a complaint. We do not discriminate against you for exercising any of these rights. However, we may be unable to provide certain products or services if you choose to exercise your rights to delete or opt out of certain processing of your personal information.