The Zip Code Conundrum - Marketing vs. Fraud Protection

A recent decision by the California Supreme Court — ruling that zip codes are "personal identification information" for purposes of the California statute which bars merchants from requesting PII during a credit card transaction — has added confusion to the question of when merchants can request personal information from their customers at the point-of-sale.

In February, 2011, a decision from the Supreme Court of California in a case brought against Williams-Sonoma overturned a lower state court ruling by holding that California law prohibits a merchant from requesting a customer's zip code as a condition of the customer using a credit card to pay for goods from the merchant. California law, like the laws of about fourteen other states (and the District of Columbia), prohibits merchants at the point-of-sale from requesting, requiring and/or recording a consumer's personal identification information ("PII") as a condition of using a credit card to pay for goods or services. This California statute, which is part of California's Song-Beverly Credit Card Act, has been the basis of class action litigation against merchants for several years. While the recent decision in the Williams-Sonoma case focuses solely on whether a zip code is personal to an individual consumer and thus PII under this California law, retail merchants should focus on the broader issue of when they are permitted to request information from their customers at the point-of-sale, not only in California, but in several other states, including New York, Massachusetts, Nevada and Pennsylvania, in which such laws are on the books.

What the Laws Prohibit

These laws, which are relatively uniform from state to state, prohibit merchants from requesting or requiring a consumer to supply personal information as a condition of using a credit card to purchase goods or services. (Only the New York law also applies to debit cards.) Some of the states permit the merchant to request PII during a credit card transaction as long as the merchant does not record the data on the credit card slip or in the merchant's records. The motivation behind these statutes was that the states (as well as Visa and MasterCard) did not want consumers to believe that they must divulge personal information because it is required to use the credit card, when in fact, the merchant wants the personal information for marketing purposes.

Some of the states provide limited exceptions under which a merchant may ask for...