Missouri Dispensaries Face $500-Per-Violation Fine for Keeping Customer Data Without Written Consent Under New Guidance
- Missouri’s Division of Cannabis Regulation issued new guidance requiring dispensaries to obtain written consent before collecting or keeping recreational consumers' identifying information, with a $500 fine for violations starting November 12.
- The law prohibits dispensaries from refusing service if consumers decline to share their identifying information and instructs businesses to review intake and rewards program procedures for compliance.
- House Bill 2641 protects medical marijuana patient data from unauthorized federal disclosure, classifying violations as a class E felony, and maintains existing medical recordkeeping and track-and-trace requirements.
- The guidance also restricts hemp-derived cannabinoid products with THC levels above set limits to licensed marijuana businesses, bans synthetic cannabinoids, and temporarily exempts naturally occurring cannabinoid beverages sold only to adults until December 11.
Missouri marijuana regulators issued new guidance Monday detailing upcoming requirements for dispensaries, including a $500 fine for each instance in which a business creates or keeps a consumer’s identifying information without written consent.
The guidance, issued September 28 by the Missouri Division of Cannabis Regulation (DCR), addresses changes enacted under House Bill 2641, a wide-ranging marijuana and hemp law approved earlier this year.
Beginning November 12, marijuana dispensaries will be prohibited from creating or retaining records containing identifying information about recreational consumers unless the consumer affirmatively agrees in writing.
The law also specifies that a dispensary cannot refuse to provide services or sell products because a consumer declines to allow their information to be recorded or retained. Violations carry a $500 fine for each occurrence.
DCR said businesses should review existing practices and historical records to determine whether changes are necessary, specifically pointing to delivery-order intake procedures and information collected through rewards programs.
The provision does not alter constitutionally required recordkeeping involving qualifying medical marijuana patients or primary caregivers, and dispensaries must continue complying with state track-and-trace requirements.
HB 2641 also prohibits Missouri state agencies and employees from providing medical marijuana patient information to the federal government or other unauthorized parties unless required by a subpoena or court order. Knowingly violating that provision is a class E felony.
The guidance additionally addresses major changes involving hemp-derived cannabinoids. Products containing hemp-derived cannabinoids above specified THC thresholds will generally be treated as marijuana and restricted to businesses licensed under Missouri’s marijuana system.
Licensed marijuana businesses may acquire and sell hemp-derived cannabinoids containing no more than 0.3% total THC and cannabinoid products containing no more than 0.4 milligrams of total THC from outside the licensed marijuana system. Higher-potency products will be considered marijuana.
DCR emphasized that synthetic cannabinoids and cannabinoids produced through chemical conversion or modification remain prohibited for licensed marijuana businesses.
An exception applies temporarily to beverages containing naturally occurring cannabinoids that were not synthesized or manufactured outside the plant. DCR says those beverages will remain outside the authority of Missouri’s marijuana regulatory system until December 11, provided they are not sold to anyone under 21.
HB 2641 was approved by Missouri lawmakers in April and signed into law on April 23. Most of its marijuana and hemp provisions take effect November 12.