Missouri

15 CSR 60-18, Attorney General Age Verification Rule

Missouri Attorney General rule declaring it an unfair practice under the Merchandising Practices Act for a commercial entity to operate a website or application where a substantial portion (33 percent or more) of content is pornographic for minors without reasonable age verification of users as 18 or older.

HB 1839 (HCS HBs 1839, 2921 and 3015), Age Verification on Adult Websites

Codifies the age verification requirement for commercial websites where at least one third of published material is harmful to minors into statute, requiring reasonable age verification, a bar on retaining identifying information, and mandated warning notices about mental health resources, enforced by the Attorney General. Signed by the governor on July 9, 2026; effective August 28, 2026.

Notice of security breach of personal information

Any person, defined to include an individual, corporation, or other legal or commercial entity as well as a government, governmental subdivision, agency, or instrumentality, that owns or licenses personal information of a Missouri resident, or that conducts business in Missouri and owns or licenses such information, must notify the affected consumer of a breach of security without unreasonable delay.

Personal information is limited to a name combined with a Social Security number, a driver's license or other unique government identification number, a financial account or card number with an access code, a unique electronic identifier or routing code with an access code, medical information, or health insurance information, and excludes information lawfully obtained from publicly available sources or government records made available to the general public; it carries no biometric, genetic, or student-data element.

A person providing notice to more than 1,000 consumers at one time must also notify the Attorney General's office and every nationwide consumer reporting agency without unreasonable delay. The Attorney General has exclusive authority to bring an action for actual damages for a willful and knowing violation and may seek a civil penalty of up to $150,000 per breach or series of related breaches, and the statute creates no private right of action.

Genetic information, insurer and employer restrictions, confidentiality duty

Within the insurance code, Missouri separately restricts the use and disclosure of genetic information, defined as the results of a genetic test (Sec. 375.1300).

An insurer may not, in connection with the offer, sale, or renewal of a health plan, require or request a person or their blood relative to provide genetic information or take a genetic test, or consider genetic information or a genetic test without the person's approval, in determining eligibility, premiums, or coverage (Sec. 375.1303, effective since August 28, 1998); a violation is enforced as an unfair trade practice.

An employer may not use an employee's or job applicant's genetic information or genetic test results to discriminate against them or restrict a right or benefit otherwise due them, except for underwriting individual or group life, disability income, or long-term care insurance, action required by law, action taken with written permission, or use of information directly related to job responsibilities (Sec. 375.1306).

Any person who, in the ordinary course of business, a profession, or rendering a service, creates, stores, receives, or furnishes genetic information must hold it as a confidential medical record and may not disclose it without the individual's or their authorized representative's written authorization, except for de-identified statistical data, federally regulated health research, release under legal or regulatory process, or body identification (Sec. 375.1309).

Sections 375.1306 and 375.1309 were both added by the original 1998 enactment and substantially amended by Laws 2007, S.B. 66, effective August 28, 2007. Neither the employer restriction nor the confidentiality duty is limited to private employers or private handlers of genetic information on its face.

Enforcement of Secs. 375.1303, 375.1306, and 375.1309 runs to the Director of the Department of Commerce and Insurance, who may issue administrative orders or bring a civil action for an injunction and other relief under Mo. Rev. Stat. Secs. 374.046 and 374.048; none of these sections creates a private right of action.