Recording Law for Voiceprints & Biometric Data in Missouri

Missouri does not have an enacted biometric privacy statute that applies to private companies. Unlike Illinois’ Biometric Information Privacy Act (BIPA), there is no law in Missouri that requires businesses to obtain written consent before collecting or storing a customer’s voiceprint or other biometric data. Missouri’s one existing biometric statute, § 302.170, only restricts the Department of Revenue’s use of biometric data—including voice data—when producing driver’s licenses. It does not apply to private businesses like live.law. Three recent bills (SB554 in 2025, HB500 in 2025, and HB1970 in 2026) proposed a BIPA-style law for Missouri, but none passed. If a future bill becomes law, it would require written notice and a written release before collecting a voiceprint, along with strict retention and destruction policies. Until then, Missouri businesses face no legal requirement to obtain written consent for voiceprint collection under biometric privacy laws.

Missouri’s wiretap statute (§§ 542.400–542.422) regulates the interception of audio communications, but it does not specifically address biometric voiceprints. The law distinguishes between "wire communications" (phone calls or electronic messages) and "oral communications" (in-person conversations). For wire communications, Missouri provides a one-party consent exception for private citizens: § 542.402.2(3) allows a person not acting under law to intercept a wire communication if they are a party to the communication or have prior consent. The statute’s one-party exception applies irrespective of others’ expectations of privacy because wire communications have no privacy gate under § 542.400. For oral communications, the law is narrower: § 542.402.1(2) criminalizes using a device to intercept an oral communication only when such device transmits communications by radio or interferes with the transmission—not ordinary local-storage recorders. The statute defines "intercept" as "the aural acquisition of the contents of any wire communication," which does not cover biometric data like a voiceprint extracted from a recording. So while Missouri’s wiretap law applies to audio recording, it does not impose biometric-specific rules on voiceprint collection.

Because Missouri has no biometric privacy law for private companies, businesses like live.law are not legally required to provide written notice or obtain written consent before collecting or storing a customer’s voiceprint for authentication. The state’s existing laws do not impose any biometric-specific retention or destruction requirements for biometric data. However, this could change if a future bill like SB554, HB500, or HB1970 becomes law. Those proposals would require businesses to give written notice before collecting biometric data, obtain a written release from the individual, and follow strict policies for storing and deleting the data. Until such a law passes, Missouri businesses can collect and store voiceprints without meeting these biometric-specific obligations.

If Missouri enacts a biometric privacy law similar to Illinois’ BIPA, businesses would face significant new obligations. A future law would likely require written notice before collecting a voiceprint, a written release from the individual, and strict policies for retaining and destroying the data. Violations of such a law could trigger a private right of action, allowing individuals to sue for damages—potentially liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus attorney’s fees and costs. Class actions would also be permitted. Since Missouri lawmakers introduced SB554 in 2025, HB500 in 2025, and HB1970 in 2026—all of which died without passage—businesses should monitor legislative sessions and be prepared to update their practices if a law passes.

Imagine a Missouri business, VoiceSecure LLC, offers voice authentication for its app. A customer signs up, and the app records a short voice sample to create a voiceprint for future logins. Under current Missouri law, VoiceSecure does not need to provide written notice or obtain written consent for this process. The company can store the voiceprint without following any biometric-specific retention or destruction rules because no such rules exist. However, if Missouri passes a biometric privacy law in a future legislative session, VoiceSecure would need to update its practices. It would have to provide written notice about the voiceprint collection, obtain a written release from the customer, and implement policies for securely storing and eventually deleting the voiceprint. Until then, the company’s current process complies with Missouri law.

Missouri does not currently require written consent, notice, or retention policies for collecting or storing voiceprints. However, the state’s legislature introduced and debated three identical BIPA-style bills in recent sessions—SB554 in 2025, HB500 in 2025, and HB1970 in 2026—none of which passed. Businesses using voice authentication should track legislative developments and be ready to update their practices if a new law takes effect. In the meantime, Missouri’s wiretap law applies to audio recording but does not impose biometric-specific rules on voiceprint collection. So while businesses can proceed without meeting biometric privacy obligations today, they should stay alert for changes in the law.