MO HB3537

Private entities must obtain consent before collecting biometric identifiers (retina/iris scans, fingerprints, voiceprints, face geometry) for commercial purposes, and must provide notice of what is being collected, the purpose, and retention length

Entities possessing biometric identifiers must develop written retention policies and destroy the data when the initial purpose is satisfied or within one year of the individual's last interaction, whichever comes first

Sale, lease, or disclosure of biometric identifiers for commercial purposes is prohibited without consent, except for completing authorized financial transactions, complying with legal requirements, or responding to court orders

The Missouri Attorney General has exclusive enforcement authority; no private right of action is created for individuals

Exemptions apply to state/local government agencies, financial institutions under Gramm-Leach-Bliley Act, healthcare entities under HIPAA, employment-related biometric collection, and security purposes such as fraud prevention