Missouri — No AI-Specific Statute; MMPA + Age-Verification + Breach + AI-CSAM Surfaces: AI Compliance Requirements

The MMPA is the instrument the Missouri Attorney General has actually aimed at AI. In July 2025 the AG issued demand letters to Google, Meta, Microsoft and OpenAI citing the MMPA and asking whether their chatbots "were trained to distort historical facts and produce biased results while advertising themselves to be neutral", with a 2025-07-23 response deadline. The AG's own rulemaking describes the Act as prohibiting "unlawful, fraudulent and unfair practices in connection with any trade or commerce in the State of Missouri", quoting Ports Petroleum Co. v. Nixon, 37 S.W.3d 237, 240 (Mo. banc 2001) that its literal words "cover every practice imaginable and every unfairness to whatever degree", and Huch v. Charter Communications, 290 S.W.3d 721, 725 (Mo. banc 2009) that a violation of any other law presenting a risk of substantial injury to consumers is itself an MMPA violation. Practical AI duties in Missouri: do not represent an AI chatbot as a human or as a licensed professional; substantiate every AI capability and accuracy claim used in marketing; do not use AI output to conceal, suppress or omit a material fact in a sale; and preserve the training/curation records an MMPA civil investigative demand will ask for, because the July 2025 letters demanded exactly that. Note the MMPA reaches AI conduct that no AI-specific statute in Missouri covers — Missouri has none.

A commercial entity that knowingly and intentionally publishes or distributes material on an internet website, INCLUDING A SOCIAL MEDIA PLATFORM, more than one-third of which is sexual material harmful to minors, must use a THIRD PARTY to perform reasonable age-verification methods confirming the individual is eighteen or older. Permitted methods: digital identification, or a commercial age-verification system that verifies age using government-issued identification or "a commercially reasonable method that relies on public or private transactional data". The third party performing the verification "shall not retain any identifying information of the individual". Carve-outs: bona fide news or public-interest broadcast, website video, report or event, and the rights of a news-gathering organization; and an ISP, its affiliates or subsidiaries, a search engine, or a cloud service provider is not liable solely for providing access or connection to content not under its control. AI relevance: the one-third threshold is content-share based, so a generative-image or companion-AI platform whose output library crosses it is squarely in scope; and the "no retention" rule constrains AI age-estimation vendors, which cannot keep the face or document images they score.

Independently of the 2026 statute, the Attorney General promulgated an age-verification rule under the MMPA that has been in force since 2025-11-30. The chapter runs 15 CSR 60-18.010 (definitions), .020 (operation of an internet platform, application, or search engine — declaring it "an unfair, deceptive, fraudulent... practice" to operate without reasonable age-verification methods where sexual material harmful to minors is accessible to minors), .030 (reasonable age-verification methods), .040 (applicability, with news-organization and ISP exemptions), .050 (counting violations, with a daily cap), .060 (requirement to create a device-side verification option — a duty aimed at large mobile operating systems), and .070 (severability, construction and effective date). The rule's stated theory is that violating Missouri's existing furnishing-pornography-to-minors statutes (RSMo §§ 573.030-.040) is itself an MMPA violation. Two consequences for AI/platform operators: the rule reaches search engines and applications, not just websites, so it bites more broadly than § 407.3405; and 15 CSR 60-18.060 pushes age assurance down to the operating-system layer, which is where AI age-estimation models are deployed.

Any person that owns or licenses personal information of Missouri residents must notify affected consumers of a breach of security "without unreasonable delay" and "consistent with the legitimate needs of law enforcement". A person that maintains or possesses records containing personal information it does NOT own or license — the posture of most AI vendors and model hosts — must notify the owner or licensee IMMEDIATELY following discovery. Where notice goes to more than one thousand consumers at one time, the Attorney General's office and the nationwide consumer reporting agencies must also be notified. "Personal information" is first name or first initial plus last name in combination with SSN, driver's licence number, financial account number, medical information, or health insurance information, where that data is not encrypted or redacted. AI relevance: training corpora, fine-tuning datasets, embeddings/vector stores and prompt-and-response logs that contain those combinations are covered records, and the immediate-notice duty on non-owning holders is the clause that binds an AI processor to its enterprise customer.

Missouri needs no AI statute to criminalise AI-generated CSAM: the definition of child sexual abuse material in RSMo § 573.010 expressly covers any visual depiction of sexually explicit conduct where "such visual depiction is a digital image, computer image, or computer-generated image that is, or is indistinguishable from, that of a minor engaging in sexually explicit conduct", and material that "has been created, adapted, or modified to show that an identifiable minor is engaging in sexually explicit conduct" — the latter reaching face-swap and nudification outputs built on a real child's likeness. "Visual depiction" includes data stored on computer disk or by electronic means capable of conversion into a visual image, so model weights and latent outputs are not a safe harbour. The definitions were rewritten (including the "child pornography" to "child sexual abuse material" relabelling) by HB 2273 (2026), signed 2026-05-05, with the current version effective 2026-08-28. Operator duties: CSAM classifiers on both prompt and output paths, blocking of nudification and minor-likeness prompts, NCMEC reporting, and retention of takedown evidence. Note this is long-standing criminal law that AI happens to fall inside, NOT an AI-governance instrument.

FTC Act § 5 applies to all Missouri businesses using AI. Missouri Merchandising Practices Act (MMPA, § 407.020) provides broader consumer protection than many states — Missouri AG has pursued AI-adjacent deceptive practices cases. Ensure AI chatbots disclose their nature, AI marketing claims are truthful, and algorithmic pricing does not exploit consumers.

EEOC May 2023 guidance applies to Missouri employers using AI hiring, scheduling, or performance evaluation tools. Missouri's healthcare, aerospace (Boeing), and agricultural processing sectors using AI worker monitoring must test for disparate impact on protected classes. Document AI vendor disparate impact analysis results.

Missouri is home to Edward Jones (one of the largest US brokerage firms) and multiple regional banks. AI used for investment recommendations, credit decisions, or consumer financial products must comply with FCRA adverse action notice requirements (CFPB Circular 2022-03) and SEC/FINRA guidance on AI in investment advice. Edward Jones and similar firms face additional SEC AI disclosure requirements.

Missouri's large healthcare systems (SSM Health, BJC HealthCare, Mercy, CoxHealth) are significant AI deployers. AI systems processing Protected Health Information must comply with HIPAA Security and Privacy Rules. Clinical decision support AI and diagnostic AI tools used by Missouri health systems require BAAs with AI vendors and HIPAA-compliant AI pipelines.

Missouri has NO enacted AI-specific statute as of 2026-08-25, and cannot get one before the session opening January 2027 (the 2026 regular session ended 2026-05-15). Every 2026 AI bill DIED: SB 1444 (Sen. Lewis — proposed RSMo § 407.3007 AI-therapy-chatbot advertising ban with $10,000 first / $20,000 subsequent MMPA civil penalties; last action "SCS Voted Do Pass S General Laws Committee", never reached the floor); SB 1012 (AI oversight and control measures + AI disclaimers on election advertising); SB 1117, the "Taylor Swift Act" (civil and criminal liability for nonconsensual intimate digital depictions — cleared Senate Judiciary 2026-02-04 and went no further); SB 1324 (Missouri Artificial Intelligence Transparency and Accountability Act, proposed operative date 2027-01-01); SB 859 and SB 1474 (AI Non-Sentience and Responsibility Act); and HB 3393 (under-16 social-media account ban with verified parental consent for 16-17-year-olds, AG penalties up to $50,000/violation). VERIFIED ABSENCES to state honestly to customers rather than hedge: (1) no comprehensive consumer privacy act — the legislature has repeatedly declined to advance one; (2) no biometric privacy act — SB 1359 and HB 407 / HB 500 / SB 554 proposed, none enacted, so no Illinois-style private right of action exists in Missouri; (3) no enacted deepfake or synthetic-election-media statute; (4) NO insurance-sector AI instrument — Missouri is shaded grey in BOTH categories of the NAIC Model AI Bulletin implementation map (status as of 1 April 2026), i.e. it has neither adopted the model bulletin nor issued insurance-specific AI regulation or guidance, and no AI bulletin appears from the Department of Commerce and Insurance; (5) no statewide Missouri Supreme Court AI-disclosure rule — instead, Office of Legal Ethics Counsel informal opinion 2024-11 (2024-04-25) supplies guidance, at least four judicial circuits have adopted local AI-disclosure rules (e.g. 7th Circuit / Clay County Local Rule 3.3.1, 2024-07-25), and courts sanction AI-fabricated citations under existing Rule 55.03 and Rule 84.19. Missouri Attorney General Catherine Hanaway has held office since 2025-09-08; her predecessor Andrew Bailey opened the state's AI posture with the July 2025 MMPA demand letters to Google, Meta, Microsoft and OpenAI. Monitor moga.mo.gov, senate.mo.gov and ago.mo.gov/other-resources/proposed-rules/ — note the AG's 15 CSR 60-19 "algorithmic choice" rulemaking (proposed: platforms above roughly 50 million monthly US users would have to let users pick a third-party content moderator, with the choice re-offered every six months) is still listed as PROPOSED and was not found in the current Code of State Regulations this session; treat it as not in force.