USA – MISSOURI Trends and Developments Contributed by: Mark Williams and Stefanie Brody, Sandberg, Phoenix & von Gontard, P.C.
interception is not carried out “for the purpose of com - mitting any criminal or tortious act”. This “tortious pur - pose” exception is a distinctive feature of Missouri’s wiretapping statute and has emerged as a significant source of litigation risk in the online tracking context. A growing number of plaintiffs across the country have brought wiretapping claims against companies that deploy online tracking technologies such as the Meta Pixel on their websites. The theory is straightforward: when a company embeds a tracking pixel that inter - cepts and transmits the contents of a user’s com - munications to a third party such as Facebook, the company has “intercepted” a “wire communication” within the meaning of the wiretapping statute. This theory has gained traction in Missouri. In Jane Doe v SSM Health Care Corporation , No 2222-CC10014- 01 (Mo. Cir. Ct. City of St Louis, filed 25 September 2024), the plaintiff alleged that SSM Health embedded Meta Pixel and Facebook’s Conversions API on its hospital websites and patient portal, which caused patients’ sensitive medical information – including search queries about medical conditions, doctor appointments and patient portal interactions – to be secretly transmitted to Facebook along with person - ally identifying information such as Facebook user IDs and IP addresses. The plaintiff asserted, among other claims, that SSM Health violated Missouri’s wiretap - ping statute by intercepting patients’ wire communi - cations for the purpose of committing criminal and tortious acts, including invasion of privacy, breach of the fiduciary duty of confidentiality, and conversion of patients’ personal health information. While the parties settled in November 2025, the case notably survived a motion to dismiss, signalling that Missouri courts are willing to entertain wiretapping claims premised on deployment of online tracking technologies. The implications are significant. Unlike the MMPA’s pri - vate right of action, which requires proof of ascertain - able monetary loss, the Missouri wiretapping statute provides for statutory damages (liquidated damages computed at the rate of USD100 per day of violation or USD10,000, whichever is greater), punitive dam - ages (for wilful or intentional violations) and attorneys’ fees. The question remains open as to whether Mis - souri’s wiretapping statute extends to data practices
such as pixel tracking, session replay technology, or the covert sharing of browsing data with third parties. Other Privacy-Related Statutes Although Missouri lacks a comprehensive privacy law, it has enacted several narrower statutes that touch on data protection, including the following under the Missouri Revised Statutes: • Section 407.1355 prohibits the public posting or display of Social Security numbers, requires secure transmission of Social Security numbers over the internet, and bars employers from requiring employees to use their Social Security numbers as employee identification numbers; • Section 407.433 restricts the disclosure of credit and debit card account numbers on sales receipts, prohibiting the display of more than the last five digits; and • Section 362.422 mirrors federal Gramm-Leach- Bliley Act requirements to prohibit financial institu - tions from disclosing non-public personal informa - tion to non-affiliated third parties and requiring privacy notices to customers. These provisions, while limited in scope, reflect a leg - islative awareness of specific data protection risks and should be accounted for in any Missouri-focused compliance programme. Biometric Privacy Missouri has not enacted a general biometric pri - vacy statute. There is no Missouri law analogous to the Illinois Biometric Information Privacy Act, which has generated a wave of class action litigation in that state. Missouri businesses that collect fingerprints, facial geometry or other biometric identifiers are not subject to a standalone state law governing biometric data collection, consent, retention or destruction. That said, Missouri does regulate biometric data in at least one narrow context. Section 313.817 (5), enacted as part of the state’s Licensed Gaming Activi - ties framework, prohibits excursion gambling boats (known locally as riverboat casinos) from requiring patrons to provide fingerprints, retinal scans, biomet - ric forms of identification, or patron-tracking cards as a condition of entry.
599 CHAMBERS.COM
Powered by FlippingBook