PII Consent Tiers – Customer Guidance
Under new Section 195.819, RSMo, enacted by Missouri HB 2641 (effective November 12, 2026), dispensaries may not create or retain any record containing a consumer's identifying information unless the consumer affirmatively agrees, in writing.
The dispensary also may not refuse to provide services or sell goods to a consumer who does not agree.
The rule does not apply to the record-keeping that Article XIV, Section 1 of the Missouri Constitution requires for qualifying patients and primary caregivers.
Each violation carries a $500 fine per occurrence.
The rule applies to all consumers, not only recreational customers; medical patients are not entirely exempt from it across the board (see Tier 1).
Important: Compliance Is the Dispensary’s Responsibility.
While we do our best to assist our customers with compliance, keep in mind that Section 195.819 applies to marijuana dispensary facilities, not to AIQ.
Each dispensary customer is solely responsible for its own compliance with HB 2641, Article XIV, 19 CSR 100-1, the Telephone Consumer Protection Act (TCPA), and all other applicable laws.
That includes deciding which records it creates or retains, obtaining and documenting each consumer’s written consent, configuring AIQ’s consent text and settings, and the data it sends to AIQ from its point-of-sale (POS) system or other sources.
AIQ provides configurable tools and default text to support compliance, but those defaults do not guarantee compliance, and this document is general guidance, not legal advice.
Each dispensary should review its consent processes and AIQ configuration with its own legal counsel.
Because customer profiles in AIQ can come from multiple places (your POS, kiosk signups, web forms, text-to-join, mobile apps, or online menus), we evaluate every customer profile from strongest proof to weakest. Only Tiers 2 through 4, when supported by a written agreement on file, are designed to show written consent. Tier 5 is likely not compliant.
Call-Out: Data From Your POS Integration.
AIQ integrates with each dispensary’s POS system, and the dispensary controls what customer information its POS sends to AIQ.
A POS record arriving in AIQ is not, by itself, written consent.
Before a Missouri dispensary sends identifying information from its POS to AIQ, or keeps it there, the dispensary must confirm that it has the consumer’s written consent, or that the record falls within the Article XIV patient and caregiver record-keeping exclusion.
Records without consent should not be sent or should be removed.
AIQ can hold or filter Missouri POS records that lack a consent flag, but the dispensary is responsible for what its POS sends.
Tier 1: Medical Patient Records Required by Article XIV (Limited Exemption)
What it means:
The customer is marked as a Medical Patient or has a state Medical Card ID on file from the POS.
Why it may be permissible:
Section 195.819 does not apply to the record-keeping requirements for qualifying patients and primary caregivers under Article XIV, Section 1 of the Missouri Constitution.
This is a limited carve-out, not a blanket exemption for patients.
It covers records the dispensary must keep under Article XIV and 19 CSR 100-1, such as patient and caregiver card verification and track-and-trace records.
It likely does not cover optional data about patients, such as loyalty, marketing, or engagement history.
A patient or caregiver who is 21 or older also meets the regulatory definition of “consumer,” so the dispensary should get written consent (Tiers 2 through 4) before using a patient’s information for loyalty or marketing.
Tier 2: Signed Form or Digital Waiver (Strongest Written Proof)
What it means:
The customer filled out an Alpine IQ Signup Form (in-store kiosk/tablet, QR code, or web form) or signed a digital loyalty/waiver agreement where they checked the required Terms & Conditions box or drew their signature.
What proof we have on file:
Exact date and time of submission, the form they used, an anonymized IP address, the version of the consent text shown, and their saved signature image or waiver text.
Note:
The Terms and Conditions are configurable per merchant, per signup form. Default is
“By signing up, I consent to enroll in the member list, understanding that I will receive marketing communications, including, but not limited to, advertisements, through text messages, calls either through an automatic telephone dialing system or artificial or prerecorded voice call, emails, or other outreach channels. By doing so, I understand that I am allowing {userName}, and it's technology provider AIQ, Inc. to retain my personal contact details and engagement history for use in personalized marketing communications. I understand that I may opt-out of text messages at any time by replying "STOP". Standard messaging and calling rates may apply. I affirm that I am of legal age to receive communications related to the services and products being advertised. Consent is not a condition of purchase.”
Missouri Default Disclosure, Available as of Nov 10th 2026.
For Missouri dispensary locations, AIQ will use the following default text, shown to the consumer at the store or online before signup. Your dispensary can configure this disclosure but your dispensary is ultimately responsible for the disclosure and for any changes it makes:
“Missouri Customers: Your Rights. Under Missouri law (Section 195.819, RSMo), {dispensaryName} may not create or keep a record containing your identifying information unless you agree in writing. You do not have to agree. If you do not agree, {dispensaryName} will still sell to you and serve you, and your purchase will not be affected.
"[ ] I agree in writing that {dispensaryName} and its technology provider, AIQ, Inc., may create and keep a record of my name, phone number, email address, and purchase and engagement history to manage my member account and rewards. I can withdraw this agreement at any time by contacting {dispensaryName}.”
“[ ] Separately, I agree to receive recurring marketing text messages and calls from {dispensaryName} at the number provided, including messages sent using automated technology. Consent is not a condition of purchase. Msg & data rates may apply. Reply STOP to opt out.” [Signature] [Date]"
If the consumer does not agree, they can still buy.
Declining ends only the signup process. It must never end or block the purchase.
The dispensary must complete the sale and provide the same service, and AIQ must not create or keep a profile for that consumer.
Configurations that require signup to check out, or that deny service to consumers who decline, violate Section 195.819.
Tier 3: Direct Text or Email Opt-In (Verified Electronic Agreement)
What it means:
The customer actively opted in via text message or email - for example, by texting JOIN or YES to the dispensary’s number, replying YES to an automated opt-in text at checkout.
What proof we have on file:
The phone number or email, the exact date and time the opt-in message was sent and the consumer's YES reply was received, and the text of the message they replied to.
Note:
Join message is configurable per merchant. Default is
“Reply Y or YES to confirm your account and turn on notifications. Msg & data rates may apply. Reply STOP to optout”
Triggered in a few ways
A shopper texts “JOIN” to the dispensary’s JOIN number (hosted by AIQ), shopper receives “Reply Y….” message
A POS sends a customer record to AIQ, then AIQ texts the “Reply Y …” message
Merchant (dispensary owner) uploads a list of customer records to AIQ directly, AIQ texts “Reply Y…” to each customer
A POS record sent to AIQ triggers an opt-in message, and the consumer replies YES
TCPA vs. Missouri: Does a Text Opt-In Count?
The current default join message (“Reply Y or YES to confirm your account and turn on notifications”) is written for TCPA marketing consent.
On its own, it does not clearly tell the consumer that the dispensary will create and keep a record of their identifying information, so it may not show affirmative written agreement under Section 195.819.
A reply of YES is a written electronic response and can serve as written proof, but only if the message the consumer replies to clearly describes what they are agreeing to.
One consent or two?
A single message can request both consents if it clearly discloses each one.
Recommended Missouri default:
“{dispensaryName}: Reply Y or YES to agree in writing that {dispensaryName} and AIQ may keep a record of your name, phone, email and purchase history for your member account and to confirm your account and turn on notifications. Msg & data rates may apply. You don’t have to agree, and it won’t affect your purchase. Reply STOP to optout”.
Oral consent will not work.
Both Missouri law and the TCPA require written proof.
Missouri requires the consumer to agree “in writing,” and the TCPA requires prior express written consent for marketing texts and calls sent using automated technology.
A budtender’s note that a customer agreed out loud, or a checkbox the budtender ticks for the customer, is not written consent.
The consumer must sign, check the box themselves, or send a written reply such as YES.
Merchant-uploaded lists.
For Missouri, uploading a list of customer records and then texting them creates and keeps records before any consent exists.
The dispensary must confirm it already holds written consent for each uploaded consumer. Otherwise it should not upload the list.
Tier 4: Other First-Party Enrollment (App, Web Wallet, Push, or Third-Party Waiver)
What it means:
The customer enrolled directly through a digital touchpoint outside of a standard POS checkout - such as signing up in the dispensary’s mobile app/wallet pass, enabling browser/push notifications, or completing a connected digital intake form (like SmartWaiver or IntakeQ).
What proof we have on file:
The signup URL, app/notification enrollment timestamp, or waiver creation date.
Note:
Mobile App terms are configurable per merchant. Default is
“You also consent to sign up for the member list where I will receive marketing communication via text message, calls, email or other outreach channels. By doing so, I understand that I am allowing you and your technology provider to retain my personal contact details / engagement history for use in personalized marketing. Opt out of text at any time by replying "STOP" to messages. Standard message and calling rates may apply. Dispensary license number:”
Does Tier 4 qualify?
AIQ apps are AIQ-built apps white-labeled for each dispensary.
App or web wallet signup can qualify as written consent if the consumer actively checks a box or taps “I agree” next to a clear Missouri disclosure (use the Missouri default text in Tier 2), and AIQ records the timestamp, account, and text version.
Enabling browser or push notifications alone does not qualify, because it does not show agreement to keep identifying records.
Third-party waivers (SmartWaiver, IntakeQ) qualify only if the waiver itself contains the Missouri disclosure and the dispensary can produce the signed copy.
The current default app text should be updated so that it describes the dispensary’s record-keeping, states that declining will not affect purchases, and separates marketing consent.
Tier 5: Auto-Enrolled at POS Only (No Written Agreement on File)
What it means:
The customer is marked as a loyalty member or "implied" opt-in solely because the POS or account settings automatically enrolled everyone who made a purchase, without the customer ever filling out a form, signing, or replying YES to a text.
Tier 5 is likely not compliant.
Automatic enrollment, implied opt-in, or a budtender asking a customer at the counter to join marketing, with no form, signature, or written reply, is not affirmative written agreement.
For Missouri, the dispensary should not create or keep Tier 5 profiles.
It should either obtain written consent through Tiers 2 through 4, or delete or de-identify those records.
Dispensaries with Tier 5 profiles must review them with their own legal counsel.
AIQ recommends suppressing Tier 5 Missouri profiles from campaigns, audiences, and exports until that review is done.
Deletion Requests
If clients would like to delete records, AIQ can facilitate this request via our support team. Please log into your AIQ account, submit a ticket for “MO HB2641 Deletion Request”.