Missouri’s age verification law, HB 1839, took effect on Aug 28, 2026.
The statute applies to what it defines as “covered businesses” – i.e., a commercial website, including a social media platform, that “knowingly and intentionally” publishes or distributes material harmful to minors when more than one-third of the site’s content is such material.
A covered business must use a third party to verify that a person attempting to access the material is at least 18 years old. The verification must be done by using digital ID, or a commercial age verification system based on government-issued ID, or “a commercially reasonable method that relies on public or private transactional data.”
Transactional data can include information about mortgages, education, and employment, the law states. It also says that the third party used for verification may not retain the identifying information.
However, this does not mean that providing such information to a third party in order to access a website does not pose an exposure risk, because the data can still be leaked or otherwise misused by that third party – it just means that the third party is not allowed to “retain” it.
The Attorney General will be in charge of enforcing the law, and the penalties that can be imposed are $10,000 per day for each day a covered business does not implement the age verification requirement, $10,000 for each instance of a third party service retaining identifying information, and $250,000 if one or more minors access material they should not have in violation of the law.
On the other hand, the law limits liability of internet service providers, search engines, and cloud services that provide access to content but do not control it. Bona fide news and public interest material is also exempt.
The law codifies an age-verification rule introduced by Missouri Attorney General Catherine Hanaway in 2025 and in force since December of that year.
In essence, the law means that adults will have to submit to an age verification process involving their identity or sensitive data in order to access legal material, and that the state will have enforcement powers over covered sites – even though the law stipulates that verification services must not retain identifying data submitted by users.
