Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
Missouri has launched Show Me Your Age, a state-developed application intended to help businesses prevent underage sales of alcohol, tobacco and cannabis. The tool supports driver’s-license scanning and manual birthdate entry, with caution alerts when a barcode scan identifies irregularities that could indicate an invalid or fraudulent license.
The October 14 announcement came from the Office of Administration’s Information Technology Services Division. It developed the application with the Division of Alcohol and Tobacco Control, Department of Health and Senior Services, and Department of Revenue.
For privacy professionals, a significant detail appears in the application’s disclaimer: Missouri says identification information is processed on the user’s device without storing, transmitting or retaining personal information. The design commitment separates checking a customer’s age from building a database of identification records.
What the application does, and what a scan cannot establish
The state describes the application as a supplement to existing identity checks. A caution alert prompts personnel to physically inspect the identification before proceeding. The announcement also describes reporting on scan volumes, successful verifications, expired IDs, caution alerts and failed scans.
A birthdate calculation and an identity check answer different questions. Entering a date can establish the age associated with that date; it cannot establish who supplied it or whether it belongs to the customer. Similarly, reading a barcode does not, by itself, prove that the person presenting the document is its rightful holder.
The application’s disclaimer makes those limitations explicit. It warns that results may be inaccurate or incomplete and that the tool may fail to detect fraudulent, altered or invalid identification. Retailers remain responsible for lawful age and identity verification, including physical inspection, and must not rely solely on the output.
Staff training should preserve that distinction. A caution flag calls for review; it is not proof that a customer committed fraud. Conversely, the absence of a flag should not override an obvious mismatch between the document and its presenter.
On-device processing reduces the need to retain identity data
Missouri’s stated approach is useful because an age check need not automatically become an identity-storage exercise. The disclaimer says no scanned or captured data is transmitted to the state. These are the state’s published representations, rather than findings from an independent technical audit.
A retailer evaluating any verification product should ask what happens between capture and the result. Does the software retain an image? Which fields does it extract? Does information enter a diagnostic log or reach another service? The answers determine whether an apparently simple check creates additional personal-data exposure.
The minimum evidence needed for a particular compliance purpose may be narrower than a complete identity document. Where applicable requirements permit it, a business should consider whether recording an outcome is sufficient instead of keeping a name, address, license number and birthdate. Any retention requirement needs its own review.
On-device processing also depends on the surrounding workflow. An employee who separately photographs a license or types its details into a customer profile creates another record. The application’s privacy commitments do not automatically govern those separate actions.
Device management belongs in the rollout. Use an approved device, restrict access to authorized staff and explain which camera permissions the process requires. Employees should know whether screenshots or separate photographs are prohibited under company policy. If a customer asks what happens to their identification, staff should be able to explain the documented process without promising that every surrounding retail system operates identically. A short, accurate explanation is more useful than a broad assurance that the business collects no data.
Usage reporting should not be confused with individual scan records
The announcement’s reporting features and the disclaimer’s privacy statement should be read together. Counts of successful checks or caution alerts can support operational oversight without requiring retained identification details. Reporting functionality alone does not establish that Missouri receives customer identities.
Businesses should nevertheless establish who can access reports, what fields they contain and how long they remain available. An operational dashboard does not need to become a customer-history system merely because the organization wants evidence that employees perform checks.
If a retailer uses another system to connect verification outcomes with purchases or loyalty accounts, that linkage deserves separate assessment. It changes what the business knows about identifiable customers. It should not be treated as an incidental extension of calculating age.
A retail tool does not settle online age-assurance requirements
The launch concerns a tool supporting checks for regulated-product sales. It should not be presented as a universal solution for social media, online content or remote purchases. Different settings require different evidence, and an in-person employee can inspect a document and its presenter in ways a birthdate field cannot.
The UK Information Commissioner’s age-assurance guidance offers a useful comparison: the method should be proportionate to the service’s risks, and personal information should be limited to what the check needs. That is UK guidance, currently under review, rather than a Missouri legal requirement.
The practical question for any deployment is whether the method provides sufficient assurance without collecting unnecessary information. A stronger identity process can create greater privacy exposure if it retains full documents, shares them widely or reuses them for unrelated purposes. Effectiveness and data handling need assessment together.
For retailers adopting the Missouri tool, procedures should cover failed scans, caution alerts and manual entry. Employees need a clear escalation path when information conflicts. Managers should also confirm the current instructions and availability before making the application essential to a checkout process.
Before rollout, test the workflow with authorized sample material and representative staff. Check whether personnel understand a warning, recognize an unsuccessful scan and follow the physical-inspection procedure. Document operational problems without unnecessarily copying customer documents into support tickets. A review of staff behavior can reveal weaknesses that a successful demonstration of the scanner would miss. Repeat that review when instructions or the checkout process change, and give employees a reliable route to report confusing results to a supervisor.
Where Captain Compliance supports the privacy review
Captain Compliance’s privacy assessment workflows help businesses document proposed verification methods, request evidence and assign mitigation. The review can distinguish what the technology establishes from what staff must verify, while recording unresolved questions about retention or third-party access.
Data mapping helps connect the verification process to relevant systems, recipients and retention rules. That context matters where a business combines an age-checking tool with checkout software, customer records or reporting services. Those connections need validation by the teams operating them.
The resulting record should explain the check’s purpose and the information actually handled. Missouri’s application offers a concrete example of a stated commitment to checking age without retaining personal identification data. Businesses adopting it still need procedures that preserve that boundary and address the tool’s limitations.
Book a Captain Compliance demo to discuss the assessments and data records supporting your age-assurance program.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
