HB 3185, the Social Media User Rights and Deletion Act, requires large social media platforms (those with over $100 million in annual revenue) operating in the state to provide a clear, visible "Delete Account" button that allows users to permanently remove their accounts and all associated personal information. The bill mandates that this button must be immediately accessible within the platform, with a simple deletion process, and prohibits platforms from using deceptive design (like confusing menus or "dark patterns") to delay or block deletions. It also specifies that logging back into an account after requesting deletion does not cancel the request. Violations would be treated as unlawful business practices under existing consumer protection laws, with enforcement handled by the attorney general. The bill is currently in early legislative stages, having been introduced in February 2026.
HB 3409 establishes that Missouri agricultural producers own data generated from their fields, livestock, and equipment, regardless of whether they operate the land directly or lease it. It requires companies collecting farm data (like equipment manufacturers or platforms) to clearly disclose what data is gathered, obtain written consent for use, and provide producers with their data in digital formats upon request. Producers also gain the right to demand data deletion and receive fair compensation for data transactions. The law prohibits companies from using hidden terms (like standard "clickwrap" agreements) to override these ownership rights without explicit, written consent.
HB 3537 creates new rules for private companies handling biometric data like fingerprints, facial scans, or voiceprints. It requires companies to get customer consent (which can be implied through actions like using a service) before collecting or using this data for commercial purposes (not security, employment, or healthcare), store it securely, and destroy it within one year or after the customer's last interaction. The law excludes healthcare data protected by federal HIPAA, financial data under the Gramm-Leach-Bliley Act, and biometric data used for employment or security purposes. Companies must follow reasonable security standards for this data but cannot be sued for violations under this law.
HB 2862 prohibits creating AI-generated videos or audio that falsely impersonate a person to deceive others, excluding artistic expression like satire. It allows any resident of the state to seek a court order within two years if their likeness is used without consent in deceptive digital content, with expedited relief (within 2 days) available for severe harms like sexual content or reputational damage. The law protects platforms from liability for user content and requires proof that the impersonation was deceptive and not consensual. It does not apply to artistic works, public figures in most cases, or content that’s clearly labeled as fake.
HB 2735 requires health digital services (like apps tracking reproductive or sexual health) to obtain explicit user consent before sharing, selling, or using sensitive health data - including pregnancy status, birth control usage, or gender transition care details. It prohibits government entities from demanding this data for most investigations, except limited criminal cases unrelated to abortion, pregnancy outcomes, or gender transition care. The bill directly affects health apps, their users, and state/local law enforcement agencies. Key provisions mandate affirmative consent for each data use instance and restrict government access to protect privacy around reproductive and sexual health information.
HB 1970 establishes Missouri's "Biometric Information Privacy Act," requiring businesses (private entities) that collect biometric data - such as fingerprints or facial scans - to create public policies for how long they retain and permanently destroy this information. The law mandates specific written consent from individuals for collecting biometric data, limited to purposes like secure access control or tracking work hours without location monitoring. It excludes government agencies, courts, and health-related data (e.g., medical scans under HIPAA) from its scope.
SB 1359 creates legal protection for private companies (like businesses or apps) that collect biometric data (such as fingerprints or facial scans) if they follow specific rules. To avoid liability for accidental or careless data leaks, companies must post clear notices, explain why they collect the data, create a plan to destroy it after use or within three years, and protect it as securely as other sensitive information. The bill explicitly excludes medical data under HIPAA, genetic testing results, and financial data covered by federal laws from its scope. It does not change existing legal processes for court cases involving biometric data or override other privacy laws.
HB 1676 prohibits the state from implementing or enforcing any laws requiring digital identification, such as digital ID systems or mandates for using digital IDs to access government services, benefits, or private facilities. It directly affects individuals who might otherwise be required to provide digital ID for transactions, including accessing public services or private entities that rely on state-verified identification. Key provisions ban state-sponsored digital ID systems, requirements for digital ID use, the use of biometrics for identification, and sharing digital ID data without explicit consent. This bill prevents the state from enforcing any requirement for digital identification in any context, focusing on individual privacy protections.
HB 2321, the "AI-Generated Content Accountability and Privacy Protection Act of 2026," would require explicit written consent before publishing AI-generated content that alters a person's appearance, voice, or likeness. Violations could result in fines up to $110,000 or up to five years in prison, with higher penalties for sexual or pornographic content without consent. The law exempts artistic, educational, or research content if clearly labeled as AI-generated, and platforms hosting such content face increased fines. It also mandates privacy safeguards for verification systems, prohibiting third parties from retaining or selling biometric data. The Attorney General must report on the law's effectiveness by August 2028.
HB 2361 makes it a crime to create, share, or possess nonconsensual digital alterations of a person's sexual images (like deepfakes showing someone in explicit acts they never participated in). It targets platforms hosting user-generated content (e.g., social media, apps) by requiring them to establish a clear removal process for such content by December 2026, allowing victims to request takedowns within 48 hours. Violators face a class C felony charge, and victims can sue for $10,000 or actual damages plus legal fees. The law explicitly states disclaimers about lack of consent do not prevent criminal liability. It directly affects individuals whose images are manipulated without consent and platforms that host such content.
