California Law Bans Requesting Customer Zip Codes For Credit Card Transactions

Schiff Hardin LLP
Data Privacy Client Service Team Alert

Asking customers paying by credit card to disclose their zip codes is against the law, the California Supreme Court ruled on February 10. The state's highest court unanimously found that a zip code is "personally identifiable information" within the meaning of the Song-Beverly Credit Card Act, California Civil Code §1747.08 (Pineda v. Williams-Sonoma Stores, Inc., 2011 Cal. LEXIS 1355), and cannot be requested and recorded without invading the privacy rights of consumers. Because the wording of the underlying statute appears in other states as well, it remains to be seen whether the Pineda reasoning will apply in other jurisdictions.

The plaintiff claimed, in this putative class action, that Williams-Sonoma violated the Credit Card Act by asking for and recording her zip code when it processed her credit card purchase at its retail store. The plaintiff alleged that Williams-Sonoma then fed her name and zip code into reverse-search computer software in order to learn her street address, for marketing purposes. The plaintiff claimed that her address was then subject to use for distribution of catalogs or advertisements, or might be sold or rented to others.

The Credit Card Act specifically prohibits retailers from requesting or requiring "personally identifying information" in a credit card transaction, "including but not limited to the cardholder's address and telephone number." The Court discussed ways in which a zip code is part of an address, and rejected arguments that a zip code is not particular to a specific individual. More importantly, the Court observed that a zip code is "information unnecessary to the sales transaction that, alone or together with other data such as a cardholder's name or credit card number, can be used for the retailer's business purposes." The Court also found the statute gave clear enough warning of what it prohibited, rejecting Williams-Sonoma's argument that the plaintiff's interpretation would render the statute void for vagueness or violate due process.

The Pineda case will return to the lower courts for further consideration, but businesses should not await that outcome to evaluate their check-out practices, in California and other jurisdictions. In some situations, asking for the zip code may be permissible, because there will be times when the data is needed for a purpose incidental to the transaction - such as shipping. But Pineda underscores the continuing attention of courts and legislatures to the ongoing issue of consumer privacy

ABOUT SCHIFF HARDIN LLP

Schiff Hardin is a general practice law firm representing clients across the United States and around the world. We have offices located in Atlanta, Boston, Chicago, Lake Forest, New York, San Francisco and Washington. Our attorneys are strong advocates and trusted advisers - roles that contribute to many lasting client relationships.

For more information, contact us.