USA – MISSOURI Trends and Developments Contributed by: Mark Williams and Stefanie Brody, Sandberg, Phoenix & von Gontard, P.C.
greater transparency regarding location data collec - tion. Blackbaud data breach settlement In October 2023, the Attorney General participated in a settlement with software company Blackbaud related to a 2020 ransomware breach that exposed the personal, financial and health information of mil - lions of consumers. The Attorney General alleged that Blackbaud committed unfair and deceptive practices under the MMPA by failing to implement reasonable data security measures and delaying notifying affect - ed consumers. The multistate settlement totalled USD49.5 million. Meta youth safety litigation Missouri joined 33 states in October 2023 in suing Meta, alleging that Facebook and Instagram employed manipulative design features targeting young users. Among other things, the complaint alleged that Meta violated the Children’s Online Privacy Protection Act (COPPA) by collecting data from users under 13 years of age without parental consent. The Missouri Attor - ney General alleged misrepresentation, deception, concealment and unfair practices under the MMPA. Other Attorney General MMPA enforcement Beyond filing MMPA enforcement lawsuits, the Mis - souri Attorney General has a powerful investigative tool at its disposal: the civil investigative demand (CID). Under Section 407.040 of the Missouri Revised Statutes, when it appears to the Attorney General that a person has engaged in or is engaging in any meth - od, act, use, practice or solicitation declared unlaw - ful under the MMPA – or when the Attorney General believes an investigation is in the public interest – the Attorney General may issue a CID requiring a person to appear and testify or to produce relevant documen - tary material or physical evidence. A CID functions similarly to an administrative subpoena and is a pre- litigation investigative mechanism. The Attorney General’s CID power is not unlimited. Both the statute and constitutional principles con - strain the scope of any demand, and a business that receives a CID is not without recourse. A business may petition the court to set aside or limit a CID, and
such challenges can raise both statutory and consti - tutional arguments. The Missouri Attorney General has also promulgated privacy-related regulations under the MMPA. Most recently, the Attorney General instituted an age veri - fication regulation for websites containing sexually explicit material. The rule, 15 CSR 60-18.010 et seq, applies to any website, application or self-contained sexual content segment where a “substantial portion” – defined as 33% or more – of publicly available con - tent is “pornographic for minors”. It mandates that covered entities verify users’ ages through one of sev - eral methods: • digital identification, defined as information stored on a digital network that serves as proof of the identity of an individual; • government-issued photo identification; • a commercially reasonable method that relies on public or private transactional data to verify the age of the individual, such as records from mortgage, education and employment entities; or • an equally effective alternative method approved by the Attorney General. As implemented in other states, approved age verifi - cation methods may include facial analysis technol - ogy, where the user submits selfies from which an AI algorithm estimates whether the individual is over the age of 18. The rule expressly prohibits covered entities from retaining personally identifying information after the verification process is complete, reflecting an aware - ness of the data privacy risks inherent in identity verification at scale. Some platforms have elected to geo-block Missouri users rather than comply with the new rule. The Injury Hurdle: Why Private MMPA Claims Are So Difficult While the Attorney General has wide latitude in bring - ing MMPA enforcement actions, private plaintiffs face a far more constrained counterpart, particularly with respect to the statute’s damages requirements. Sec - tion 407.025 and associated case law require private plaintiffs to establish three elements:
597 CHAMBERS.COM
Powered by FlippingBook