{
 "jurisdiction_id": "US-MO",
 "jurisdiction": "United States – Missouri",
 "url": "https://dataprotection.gi/jurisdictions/united-states-missouri/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-06",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 53,
  "sub_modules": 57,
  "source_register": 12
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "amber",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-missouri/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "A narrow but real state statute (breach notification) and clear regulator identity exist, but there is no comprehensive material/territorial scope framework, hence amber rather than green.",
   "claims": [
    {
     "statement": "Missouri has no comprehensive consumer-privacy statute; the Missouri Attorney General enforces general consumer-protection law and the state breach-notification statute in this space.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "The primary state-level data-protection instrument in Missouri is the data-breach notification statute at Mo. Rev. Stat. §407.1500, Chapter 407, Title XXVI.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Federal Trade Commission Act Section 5 unfair-or-deceptive-practices authority applies nationally, including to Missouri entities, as a general privacy-and-security enforcement baseline in the absence of a state omnibus law.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "US state breach-notification statutes, including Missouri's, generally define covered personal information narrowly around identity-theft and financial-fraud data elements, in contrast to the broader definitions used in comprehensive state privacy laws.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/gdpr-match-up-u-s-state-data-breach-laws",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Notification under Missouri's breach statute must be provided without undue delay to consumers and to the Missouri Attorney General where the breach involves the information of more than 1,000 Missouri residents.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri imposes no general controller registration or filing regime; the only filing-adjacent duty is threshold-triggered breach notice to the Attorney General.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "red",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-missouri/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "Only a single narrow biometric-consent carve-out exists; there is no general lawful-basis or special-category framework, consistent with the seed's disambiguation note.",
   "claims": [
    {
     "statement": "Missouri House Bill 1584, effective 28 August 2024, requires private entities to obtain consent and maintain public policies before collecting biometric identifiers, functioning as Missouri's only sensitive-category-specific consent rule.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Outside the HB 1584 biometric-consent requirement, Missouri imposes no general consent standard for the processing of personal data.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri has no statutory enumeration of lawful bases for processing personal data equivalent to GDPR Article 6.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "The federal FERPA de-identification safe harbor permits schools to release education records without consent once personally identifiable information has been removed and re-identification risk reasonably assessed, applicable to Missouri educational agencies receiving federal funds.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/resources/article/family-educational-rights-and-privacy-act-2/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "red",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-missouri/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "No DSAR-equivalent rights exist in Missouri law; this is a genuine regulatory gap, not an omission of research.",
   "claims": [
    {
     "statement": "Missouri law confers no general consumer right of access to personal data held by a business.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri law confers no general consumer right to rectify or erase personal data held by a business.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri law confers no general consumer right to restrict processing or object to processing, including profiling.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri law confers no general consumer data-portability right.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri's breach statute requires notification to consumers without undue delay, but no statutory deadline exists for responding to consumer data-rights requests because no such rights regime exists.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-missouri/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "Breach notification is a real, binding, in-force duty (amber-worthy baseline), but every other accountability duty is absent, preventing a green rating.",
   "claims": [
    {
     "statement": "Missouri law requires notification to affected consumers without undue delay, and to the Missouri Attorney General, when a breach affects the personal information of more than 1,000 Missouri residents.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Notification under Missouri's breach statute may be provided in writing, in electronic form, or by telephone.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "No general Missouri state-law mandate for technical/organisational security-of-processing measures was confirmed; potential sector-specific NAIC Insurance Data Security Model Law adoption in Missouri could not be verified in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/naic-releases-insurance-data-security-model-law/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri has no statutory Data Protection Impact Assessment or general accountability-principle requirement.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri has no statutory Data Protection Officer appointment threshold or requirement.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri has no statutory records-of-processing-activities requirement.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri has no statutory joint-controller allocation-of-responsibility framework.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri has no general statutory data-retention-limitation or disposal duty outside the narrow biometric-policy element of HB 1584.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "red",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-missouri/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "No state-level transfer, adequacy, or localisation regime exists; explicit absence per JID-adaptive rules for US state JIDs.",
   "claims": [
    {
     "statement": "Missouri has no independent state-level cross-border personal-data transfer regime; applicable mechanisms operate at the federal/EU level.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri imposes no state-level data-localisation mandate requiring personal data to be stored or processed within the state.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "amber",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-missouri/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "Federal sectoral coverage is solid and confirmed; state-level sectoral detail (insurance, communications, credit cards) is thin and partly unverified.",
   "claims": [
    {
     "statement": "The federal Gramm-Leach-Bliley Act applies nationally to financial institutions operating in Missouri, imposing privacy-notice and safeguarding obligations for non-public personal information.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri legislation includes additional rules touching health information alongside the federal HIPAA framework that applies to covered entities nationally.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri legislation reportedly includes additional rules on communications, though the specific statute and its scope relative to telecoms/eprivacy could not be independently verified in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "No comprehensive Missouri employment-data privacy statute displacing or supplementing general federal employment-privacy law was identified.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "The federal Fair Credit Reporting Act governs credit-scoring and credit-reporting personal data nationally; Missouri legislation additionally references unspecified credit-card-related rules.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "FERPA and COPPA jointly govern personal-data handling in Missouri's education and ed-tech sectors at the federal level; no distinct Missouri student-data-privacy statute was identified in this research.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/resources/article/family-educational-rights-and-privacy-act-2/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Whether Missouri has enacted a version of the NAIC Insurance Data Security Model Law (as South Carolina, Ohio, and Michigan have) could not be confirmed in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/naic-releases-insurance-data-security-model-law/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "red",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-missouri/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "This entire module is a structural gap in Missouri law, consistent with the seed's disambiguation note that Missouri lacks comprehensive consumer-privacy rights.",
   "claims": [
    {
     "statement": "Missouri has no state-law cookie or tracker consent regime.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri has no statute specifically prohibiting dark patterns in consumer-facing consent interfaces.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri imposes no legal duty on businesses to recognize universal opt-out signals such as Global Privacy Control.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri has no statutory rules governing data clean rooms or data-collaboration arrangements.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri has no CPRA-style statutory concept of 'sale' or 'share' of personal information triggering cross-context-advertising opt-out rights.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Direct marketing to Missouri consumers is governed by generally applicable federal telemarketing and anti-spam statutes rather than a Missouri-specific consent or suppression law.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "amber",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-missouri/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "A real, in-force biometric regime exists (amber baseline), but profiling, ADM transparency, AI risk-assessment, and genetic-data sub-modules are all gaps.",
   "claims": [
    {
     "statement": "Missouri House Bill 1584, effective 28 August 2024, is the state's principal biometric-data regime, requiring private entities to adopt public retention/destruction policies and obtain consent prior to collecting biometric identifiers.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri has no statutory restriction on automated profiling analogous to GDPR Article 22.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri has no statute mandating automated-decision-making transparency or an explanation right for consumers.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "No comprehensive Missouri statute mandates AI-specific risk assessments for personal-data processing; identified narrow AI-related bills (AI Non-Sentience and Responsibility Act; political-advertising AI-disclaimer bill) do not constitute a personal-data risk-assessment regime.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "No Missouri-specific genetic-data privacy statute was identified in this research beyond potential federal GINA coverage of employment/insurance discrimination.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "No Missouri-specific state-surveillance carve-out affecting private-sector personal-data processing was identified; national-security/law-enforcement exemptions in this space are governed by federal frameworks outside the state consumer-privacy patchwork.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "amber",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-missouri/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "Solid federal coverage (COPPA, FERPA) exists and applies to Missouri, but no state-specific layer was found for age verification, minor profiling, or dependent adults.",
   "claims": [
    {
     "statement": "The federal COPPA Rule requires operators of websites and online services to obtain parental consent before collecting, using, or disclosing personal information from children under 13, applicable to entities operating in Missouri.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/news-events/events/2017/12/student-privacy-ed-tech",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "FERPA gives parents (and eligible students) rights over education records and generally prohibits nonconsensual disclosure of personally identifiable information by educational agencies and institutions, applicable to Missouri schools receiving federal funding.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/resources/article/family-educational-rights-and-privacy-act-2/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "No Missouri-specific statute mandating age verification prior to personal-data processing was identified in this research.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "No Missouri-specific statute bans profiling of minors for advertising or other commercial purposes.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "No Missouri-specific dependent-adults data-protection statute was identified in this research beyond general elder-protection and federal HIPAA overlays.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "amber",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-missouri/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "A real enforcement mechanism and recent AG activity exist, but the private-right-of-action and collective-redress sub-modules are largely absent or unconfirmed.",
   "claims": [
    {
     "statement": "The Missouri Attorney General has exclusive authority to bring an action to obtain actual damages for a willful and knowing violation of §407.1500.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/missouri-data-breach",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Missouri's breach-notification statute does not appear to create a general private right of action for consumers; enforcement is reserved to the Attorney General.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/missouri-data-breach",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "The Missouri Attorney General has opened an investigation into AI chatbots operated by major technology companies (including Google, Microsoft, OpenAI, and Meta) for alleged bias and inaccuracy.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdiction/missouri",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "State attorneys general, including Missouri's, frequently participate in NAAG-coordinated multistate settlements arising from data breaches.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "NAAG",
     "source_url": "https://www.naag.org/issues/consumer-protection/consumer-protection-101/privacy/data-breaches/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  }
 ]
}