USA – MISSOURI Trends and Developments Contributed by: Mark Williams and Stefanie Brody, Sandberg, Phoenix & von Gontard, P.C.
Background Missouri does not have a comprehensive consumer privacy statute, and its consumers cannot demand that a business disclose, delete or stop selling their personal data as a matter of state statutory right. That does not mean, however, that Missouri is a privacy vacuum. Missouri currently relies on a patchwork of sector- specific laws for its data privacy and protection regu - lation. These laws include a broadly worded consumer protection law known as the Missouri Merchandising Practices Act (MMPA) and industry-specific regu - lations, such as the newly enacted Insurance Data Security Act. In recent years, the Missouri Attorney General’s Office has aggressively pursued data pri - vacy and data security enforcement actions through the MMPA against some of the nation’s largest tech - nology and financial services companies. The MMPA as Missouri’s Privacy Enforcement Tool The MMPA, codified at Section 407.020 et seq of the Missouri Revised Statutes, is often described as Mis - souri’s “mini FTC Act”. It declares unlawful “the act, use or employment by any person of any deception, fraud, false pretense, false promise, misrepresenta - tion, unfair practice or the concealment, suppression, or omission of any material fact in connection with the sale or advertisement of any merchandise in trade or commerce”. Missouri courts have interpreted an “unfair practice” under the MMPA to be “unrestricted, all-encompass - ing and exceedingly broad”. See Ports Petroleum Co, Inc of Ohio v Nixon , 37 S.W.3d 237, 240 (Mo. banc 2001). Critically, the MMPA does not require proof of intent to deceive. Defendants’ conduct, not their intent, determines whether a violation has occurred. This objective standard makes the MMPA a potent tool for addressing privacy violations when a company may not have intended to cause harm but nonetheless engaged in practices that were deceptive or unfair. The MMPA provides for both public and private enforcement: • the Attorney General may seek injunctive relief, res - titution, disgorgement of profits, civil penalties, and
recovery of investigative and prosecution costs under Section 407.100; and • private plaintiffs who purchase or lease merchan - dise primarily for personal, family or household purposes may bring civil actions to recover actual damages, and courts have discretion to award punitive damages and attorneys’ fees under Sec - tion 407.025. Recent Attorney MMPA General Enforcement Actions Tax preparation pixel litigation In July 2023, the Missouri Attorney General sued H&R Block, TaxSlayer and TaxAct (Case No 2322- CC01433), alleging that the companies installed track - ing pixels (specifically the Meta Pixel and related tools) on their online tax preparation platforms. The petition alleged that these pixels transmitted sensitive finan - cial information to Meta, Google and other technology companies, including consumers’ names, adjusted gross income, refund amounts, filing status, depend - ent information, and whether consumers visited pages related to particular types of income, deductions or tax credits. The Attorney General alleged that this data sharing occurred without consumers’ knowledge or consent and in direct contradiction of the companies’ privacy policies, which assured users that their per - sonal information would be safeguarded. The peti - tion asserted claims for misrepresentation, omission, deception and unfair practices under the MMPA. Both TaxAct and TaxSlayer subsequently settled with the state. TaxAct resolved the matter in Novem - ber 2023 for USD195,000 and agreed to modify its data-sharing capabilities. TaxSlayer settled on simi - lar terms. Litigation against H&R Block continued in Jackson County as of the last available reporting. Google location-tracking settlement Missouri participated in a 40-state coalition that inves - tigated Google for allegedly misleading users about location data collection. The investigation allegedly revealed that Google continued to track users’ loca - tions even when the “Location History” setting was turned off through a separate “Web & App Activity” setting. In November 2022, Google agreed to a his - toric USD391.5 million multistate settlement requiring
596 CHAMBERS.COM
Powered by FlippingBook