Missouri

United States law applies in Missouri Missouri is a state of the United States, whose 32 researched instruments are listed on the United States page, not here. The law of Missouri, described on this page below, applies here too.

8 of 10 named instruments researched to a stage, across four of the six areas of law we track: 8 in force. As of 15 September 2026.

When they take effect8 of 8 carry a date. Earlier is before 2014.

in forceenacted but not yet in forceproposedrepealed, withdrawn or blocked

AI law 2
Privacy law 2
Scraping law 2
Cybersecurity law none researched
Age gating law 2
News aggregation law none researched

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

AI law2 instruments, 2 in force

Research summary (291 words)

Missouri has no general AI-transparency or output-labeling statute requiring disclosure that content is AI-generated or that a user is interacting with a chatbot, and no comprehensive AI-risk-management or high-risk-system act has been enacted. Missouri does prohibit two AI-enabled harms outright.

Its child sexual abuse material definition, amended in 2026, reaches a computer-generated or AI-generated image that is, or is indistinguishable from, an actual minor engaged in sexually explicit conduct, regardless of whether a real minor was involved, and promoting or possessing such material is a felony under the same offense structure that already governs photographic child sexual abuse material.

Separately, disclosing or threatening to disclose a realistic, digitally created or altered intimate depiction of an identifiable person, made with intent to harass or harm them or with knowledge or reckless disregard that it will cause harm, is a felony offense that applies regardless of whether the depiction carries a disclaimer that it is fabricated or unauthorized; an online service provider is not liable for good-faith efforts to restrict access to such depictions.

Both provisions took effect August 28, 2026.

A 2026 bill reported by contemporaneous coverage as prohibiting an artificial intelligence system from being advertised or represented as a licensed mental health professional or therapy provider, generally described as riding on House Bill 2372, does not appear in the truly agreed to and finally passed text of either House Bill 2372 or its companion Senate Bill 1019, both signed into law this session; neither bill's enacted text contains an artificial intelligence, chatbot, or therapy-related provision, so no such duty is catalogued here.

Several other 2026 bills addressing AI legal personhood and liability, standalone chatbot disclosure, and AI use in political advertising were introduced and died at adjournment without passing both chambers.

AI prohibited practices

Child sexual abuse material offenses, computer-generated and AI-indistinguishable images included

Mo. Rev. Stat. Secs. 573.010, 573.023 to 573.037official Missouri statute text, Revised Statutes of Missouri sections 573.010 and 573.025

In force 26 days, effective 28 August 2026. Binds public and private bodies.

What this law does

Missouri's definition of child sexual abuse material, amended in 2026, includes a digital image, computer image, or computer-generated image that is, or is indistinguishable from, that of a minor engaging in sexually explicit conduct, where an ordinary person viewing it would conclude it depicts an actual minor, regardless of whether the minor was actually engaged in that conduct.

Promoting such material in the first degree, meaning possessing it with intent to promote or promoting it, where the depicted or apparent child is under fourteen, is a class B felony, rising to a class A felony if knowingly promoted to a minor, with three years of parole and probation ineligibility.

Promoting the same material where the depicted or apparent child is under eighteen is the lesser offense of promoting in the second degree, a class D felony rising to a class B felony if knowingly promoted to a minor. Possessing such material is a class D felony for a single still image, rising to a class B felony for more than twenty images, for one video, or on a repeat offense, with separate punishment for each item possessed.

The statute does not require a provider of electronic communication or remote computing services to monitor users or their communications.

What it requires

Disclosure of an intimate digital depiction

Mo. Rev. Stat. Sec. 573.570official Missouri statute text, Revised Statutes of Missouri section 573.570

In force 26 days, effective 28 August 2026. Binds public and private bodies.

What this law does

A person commits disclosure of an intimate digital depiction by disclosing, or threatening to disclose, a realistic depiction of an identifiable individual created or altered through digital manipulation that shows uncovered genitals or similar intimate anatomy, the transfer of bodily sexual fluids, or the individual engaging in sexually explicit conduct, where the person intends to harass, threaten, or harm the depicted individual, or knows or recklessly disregards that the disclosure will cause them harm.

Disclosure is a class D felony and a threat to disclose is a class E felony, each rising to a class C felony on a second or subsequent violation, or where the depiction could reasonably be expected to affect a government or election proceeding or facilitate violence. A disclaimer stating the depiction is unauthorized or fabricated is not a defense.

An interactive computer service provider is not liable under this section for good-faith efforts to restrict access to such depictions or for giving others the technical means to do so.

What it requires

Privacy law2 instruments, 2 in force

Research summary (348 words)

Missouri has no comprehensive consumer personal-data-protection statute. Multiple bills, including SB 731 (2024) and the Enhanced Personal Privacy Act, HB 3537 (2026), have been introduced and none has reached the governor. Missouri's general breach notification duty, Mo.

Rev. Stat. Sec. 407.1500, in effect since August 28, 2009, has a personal information definition (a name combined with a Social Security number, a driver's license or government identification number, a financial account or card number with an access code, medical information, or health insurance information) that carries no biometric, genetic, or student-data element, so it imposes no heightened restriction on biometric or genetic data itself.

Missouri does separately regulate genetic information within its insurance code: an insurer may not require, request, or consider an individual's genetic information or a genetic test in a health-plan eligibility, premium, or coverage decision (Mo.

Rev. Stat. Sec. 375.1303, since August 28, 1998); an employer may not use an employee's or job applicant's genetic information or genetic test results to discriminate against them or restrict a right or benefit, subject to statutory exceptions (Sec. 375.1306, since August 28, 2007); and any person who creates, stores, receives, or furnishes genetic information in the ordinary course of business, a profession, or a service must hold it as a confidential medical record and disclose it only with the individual's written authorization (Sec. 375.1309, since August 28, 2007).

A cluster of Illinois Biometric Information Privacy Act (BIPA)-style biometric bills (SB 554, HB 407, HB 500, HB 1970, SB 1359) has been introduced across the 2025 and 2026 sessions, each with a private right of action modeled on the Illinois statute, but none has passed a floor vote in either chamber.

The breach statute's own definition of person includes government, so its notification duty binds both private and government data holders, and the Missouri Attorney General has exclusive authority to bring an action for a willful and knowing violation; enforcement of the genetic-information provisions likewise runs to a state regulator, the Director of the Department of Commerce and Insurance, and neither the breach statute nor the genetic-information provisions create a private right of action.

Breach notification

Notice of security breach of personal information

Mo. Rev. Stat. Sec. 407.1500official Missouri statute text, Revised Statutes of Missouri section 407.1500

In force since 28 August 2009. Binds public and private bodies.

What this law does

Any person, defined to include an individual, corporation, or other legal or commercial entity as well as a government, governmental subdivision, agency, or instrumentality, that owns or licenses personal information of a Missouri resident, or that conducts business in Missouri and owns or licenses such information, must notify the affected consumer of a breach of security without unreasonable delay.

Personal information is limited to a name combined with a Social Security number, a driver's license or other unique government identification number, a financial account or card number with an access code, a unique electronic identifier or routing code with an access code, medical information, or health insurance information, and excludes information lawfully obtained from publicly available sources or government records made available to the general public; it carries no biometric, genetic, or student-data element.

A person providing notice to more than 1,000 consumers at one time must also notify the Attorney General's office and every nationwide consumer reporting agency without unreasonable delay. The Attorney General has exclusive authority to bring an action for actual damages for a willful and knowing violation and may seek a civil penalty of up to $150,000 per breach or series of related breaches, and the statute creates no private right of action.

What it requires

Sensitive categories

Genetic information, insurer and employer restrictions, confidentiality duty

Mo. Rev. Stat. Secs. 375.1300, 375.1303, 375.1306, 375.1309official Missouri statute text, Revised Statutes of Missouri sections 375.1300, 375.1303, 375.1306, and 375.1309

In force since 28 August 1998, effective 28 August 2007. Binds public and private bodies.

What this law does

Within the insurance code, Missouri separately restricts the use and disclosure of genetic information, defined as the results of a genetic test (Sec. 375.1300).

An insurer may not, in connection with the offer, sale, or renewal of a health plan, require or request a person or their blood relative to provide genetic information or take a genetic test, or consider genetic information or a genetic test without the person's approval, in determining eligibility, premiums, or coverage (Sec. 375.1303, effective since August 28, 1998); a violation is enforced as an unfair trade practice.

An employer may not use an employee's or job applicant's genetic information or genetic test results to discriminate against them or restrict a right or benefit otherwise due them, except for underwriting individual or group life, disability income, or long-term care insurance, action required by law, action taken with written permission, or use of information directly related to job responsibilities (Sec. 375.1306).

Any person who, in the ordinary course of business, a profession, or rendering a service, creates, stores, receives, or furnishes genetic information must hold it as a confidential medical record and may not disclose it without the individual's or their authorized representative's written authorization, except for de-identified statistical data, federally regulated health research, release under legal or regulatory process, or body identification (Sec. 375.1309).

Sections 375.1306 and 375.1309 were both added by the original 1998 enactment and substantially amended by Laws 2007, S.B. 66, effective August 28, 2007. Neither the employer restriction nor the confidentiality duty is limited to private employers or private handlers of genetic information on its face.

Enforcement of Secs. 375.1303, 375.1306, and 375.1309 runs to the Director of the Department of Commerce and Insurance, who may issue administrative orders or bring a civil action for an injunction and other relief under Mo. Rev. Stat. Secs. 374.046 and 374.048; none of these sections creates a private right of action.

What it requires

Scraping law2 instruments, 2 in force

Research summary (172 words)

Missouri's computer-crime statutes track the federal Computer Fraud and Abuse Act's bare without-authorization test rather than Virginia's narrower malicious-intent-or-deceptive-means standard: RSMo Sections 569.095 to 569.099 criminalize accessing, examining, disclosing, taking, modifying, or destroying computer data, equipment, or network access without authorization or without reasonable grounds to believe authorization exists, and no Missouri case law addresses how a state court would read that phrase for automated collection of a public, unauthenticated web page.

Section 537.525 adds an independent state-law civil action for compensatory damages and attorney's fees against a violator of those sections, on top of the federal Computer Fraud and Abuse Act (CFAA)'s own private right of action.

Missouri has no text-and-data-mining statute, no sui generis or other state database right, and no state biometric-privacy or public-personal-data-scraping statute; copyright, database rights, and personal-data-in-scraped-content questions are governed by federal law alone, already addressed in the federal document for this topic. robots.txt carries no independent legal weight under Missouri law, and no reported Missouri decision addresses terms-of-service enforceability, browsewrap versus clickwrap, or trespass to chattels in an automated-collection dispute.

Computer misuse

Civil action for tampering with computer data, computer equipment, or computer users

Mo. Rev. Stat. Sec. 537.525official Missouri statute text, Revised Statutes of Missouri section 537.525

In force since 28 August 1987. Binds public and private bodies.

What this law does

In addition to any other civil remedy, the owner or lessee of a computer system, network, program, service, or data may bring a civil action for compensatory damages, including the expense of verifying the system was not altered, damaged, or deleted, against any person who violates Sections 569.095 to 569.099. A court may award reasonable attorney's fees to a prevailing plaintiff.

This is an independent state-law civil remedy on top of, not a substitute for, the federal Computer Fraud and Abuse Act's own private right of action.

What it requires

Tampering with computer data, computer equipment, and computer users

Mo. Rev. Stat. Secs. 569.095 to 569.099official Missouri statute text, Revised Statutes of Missouri sections 569.095 to 569.099

In force since 1 January 2017. Binds public and private bodies.

What this law does

A person commits tampering with computer data, computer equipment, or computer users if, knowingly and without authorization or without reasonable grounds to believe he or she has authorization, the person modifies, destroys, discloses, or takes computer data, programs, or supporting documentation; discloses or takes a password or other information controlling access to a system; accesses a computer and intentionally examines information about another person; accesses, modifies, destroys, damages, or takes computer equipment or a computer, system, or network; or denies computer system services to an authorized user.

Each offense is a class A misdemeanor unless committed to defraud or obtain property worth 750 dollars or more, or (for tampering with computer equipment) causes damage of 750 dollars or more, in which case it is a class E felony, rising to a class D felony where the equipment damage reaches 25,000 dollars or more.

The without-authorization test is undefined by the statute and, unlike Virginia's parallel statute, carries no separate requirement of malicious intent or intentionally deceptive means; no Missouri appellate decision was located applying it to automated collection of a public, unauthenticated web page.

What it requires

Age gating law2 instruments, 2 in force

Research summary (69 words)

Missouri's Attorney General adopted an age verification rule for pornographic websites in late 2025 under the Merchandising Practices Act, and the legislature codified similar requirements in statute in 2026, signed July 9, 2026 and effective August 28, 2026. No social media minor access law, app store verification law, or design code has been enacted, though several social media age verification bills were considered and died in the 2026 session.

Adult content age verification (AV)

15 CSR 60-18, Attorney General Age Verification Rule

15 CSR 60-18.010 to 15 CSR 60-18.070, authority section 407.020, RSMo Supp. 2025, and section 407.145, RSMo 2016Official Missouri Secretary of State Code of State Regulations text

In force 10 months, effective 30 November 2025. Binds private bodies.

What this law does

Missouri Attorney General rule declaring it an unfair practice under the Merchandising Practices Act for a commercial entity to operate a website or application where a substantial portion (33 percent or more) of content is pornographic for minors without reasonable age verification of users as 18 or older.

Note and primary source

HB 1839 (HCS HBs 1839, 2921 and 3015), Age Verification on Adult Websites

Section 407.3405, RSMo, as created by 2026 Mo. Laws, HCS HBs 1839, 2921 & 3015Official Missouri House of Representatives enrolled bill text (Truly Agreed To and Finally Passed, HCS HBs 1839, 2921 & 3015)

In force 26 days, effective 28 August 2026. Binds private bodies.

What this law does

Codifies the age verification requirement for commercial websites where at least one third of published material is harmful to minors into statute, requiring reasonable age verification, a bar on retaining identifying information, and mandated warning notices about mental health resources, enforced by the Attorney General. Signed by the governor on July 9, 2026; effective August 28, 2026.

Note and primary source

This page covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted in the head and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.