California's Privacy Law: You Can't Collect Zip Codes

[Siamese-Dream.Com]

Did anyone else hear about this privacy law in California:

http://www.cnn.com/2011/US/02/10/cal...de/index.html?

Apparently, we merchants are not allowed to collect zip codes as part of the transaction process...

While the article mentions only a brick and mortar store (Williams Sonoma), it doesn't say anything about collecting zip codes for internet purchases.

What it sounds like to my opinion is that it is ok to collect the zip code for shipping, but not for collecting a billing address, and you can't use it for AVS during credit card processing.

At least, that is what it sounds like...

[d_host]

Re: California's Privacy Law: You Can't Collect Zip Codes

You need to collect the ZIP code online to know where to ship the order to.

The law you mentioned only has to do with retail stores where you walk in and pick up your items, but they ask you for your ZIP code for marketing purposes to know where to target their marketing efforts. Williams Sonoma was doing it, Container Store, and a few others, that I recall.

[Siamese-Dream.Com]

Re: California's Privacy Law: You Can't Collect Zip Codes

You need to collect the ZIP code online to know where to ship the order to.

True, but in theory, you DON'T need it for the billing address (if it is separate from the ship to address). The billing address info is there to help facilitate AVS and give us merchants a cheaper rate (and reduce the potential for us for chargebacks). In short, it protects us merchants, not the consumer.

I don't THINK that credit cards will come back declined if there is no billing address (or if it is incorrect).

I am worried that collecting the billing info might be considered "unnecessary to the sales transaction."

[Brandon MUS]

Re: California's Privacy Law: You Can't Collect Zip Codes

AVS codes match based on the billing zip code. Therefore, they are necessary for the sales transaction.

[Siamese-Dream.Com]

Re: California's Privacy Law: You Can't Collect Zip Codes

AVS codes match based on the billing zip code. Therefore, they are necessary for the sales transaction.

The California Supreme Court might consider that they are NOT necessary for the sales transaction.

The AVS match is to protect US MERCHANTS - not to help the consumer. I am pretty sure that the transaction can still happen without the billing info. It's just that we then leave ourselves open to chargebacks and will probably be charged higher rates.

[Keitho]

Re: California's Privacy Law: You Can't Collect Zip Codes

The gas pumps in WA state (and elsewhere, I believe) sometimes require that the billing zip be entered. My guess is that it is intended to reduce the use of stolen cards but could have a marketing slant.

[Hostasaurus]

Re: California's Privacy Law: You Can't Collect Zip Codes

The article says in two places that the issue is the zip code is used for marketing, as Remik said.

"It does not specify how or if all businesses that take credit cards, such as gas stations, would be affected -- though it does state that its objection is not over a retailer seeing a person's ZIP code, but rather recording and using it for marketing purposes."

"It is not illegal in California for a retailer to see a person's ZIP code or address, the ruling notes: For instance, one can request a customer's driver's license to verify his or her identity. What makes it wrong is when a business records that information, according to the ruling, especially when the practice is "unnecessary to the sales transaction.""


When using a retail terminal and it asks for the zip, such as the gas pump, the info is sent with the card number for the AVS match. That is still allowed. If the gas station started tracking the zip code and the customer name on the card, finding out the rest of your information as Williams-Sonoma did, and marketing to you, that is no longer allowed in CA.

Jen

[sbronstad]

Re: California's Privacy Law: You Can't Collect Zip Codes

So, in Cali your privacy extends to what part a city you live in-- wow! Whatever happened to "I don't want to tell you that"

Sounds like balancing the budget was too hard, so they tackled other important matters (no doubt while smoking their medically-prescribed marijuana)

[Siamese-Dream.Com]

Re: California's Privacy Law: You Can't Collect Zip Codes

I would politely disagree (although I am no lawyer).

What makes it wrong is when a business records that information...

Which we are doing when we ask for a billing address.

...when the practice is "unnecessary to the sales transaction."

Which, it could be argued, IS unnecessary to the sales transaction, since I believe that credit cards can still be authorized and settled WITHOUT a billing address.

And although it has been mentioned that the zip code was used for marketing purposes, I didn't see anything that said it was ONLY prohibited when used for marketing purposes. My understanding from the article is that it is prohibited when it COULD be used for marketing purposes.

I believe we will see more lawsuits filed over this.

[Siamese-Dream.Com]

Re: California's Privacy Law: You Can't Collect Zip Codes

So, in Cali your privacy extends to what part a city you live in-- wow!

I guess the interpretation is that if you can record the customers name and zip code, you could easily look up their physical street address via different methods.

Sounds like balancing the budget was too hard, so they tackled other important matters (no doubt while smoking their medically-prescribed marijuana)

Actually, all the reports I have read said that taxing marijuana sales (both prescribed and non-prescribed) would help out in balancing the budget. I think in Oakland, the city takes in the neighborhood of 30% SALES TAX on pot club sales. In our last election, approximately 44 percent of voters chose to have "illegal" marijuana sales to be taxed instead of criminally punished (depending on each town's discretion).

Of course, you just can't collect the zip codes of all the dope smokers, because that would be wrong ;)

[d_host]

Re: California's Privacy Law: You Can't Collect Zip Codes

The law's *intent* is to limit the usage of collected ZIP codes for marketing purposes. You can still collect them all day long - you are just not allowed to use them for marketing. There are legitimate reasons for collecting the ZIP code - like AVS verification. It's like any other law that deals with intent - you can still sell and buy knives in the US, even though they can be classified as murder weapons. It's what you do with the knife (or the ZIP code) that counts, and where the laws will stick should you misuse the tool for the intent that is not allowed under the law.

[rbuelna]

Re: California's Privacy Law: You Can't Collect Zip Codes

The gas pumps in WA state (and elsewhere, I believe) sometimes require that the billing zip be entered. My guess is that it is intended to reduce the use of stolen cards but could have a marketing slant.

When pumping Gas and you pay with a card, it will ask you for your zip code if you choose credit. If you choose Debit then it asks for your Pin# it has nothing to do with marketing.

[Siamese-Dream.Com]

Re: California's Privacy Law: You Can't Collect Zip Codes

After reading through the CA Supreme Courts decision:

http://www.scribd.com/doc/48602246/P...rt-Feb-10-2011

I don't see anything that the court's decision was based on HOW Wililiam's Sonoma USED the information. In fact, the court declined to hear arguments by the plaintiff about a violation of privacy by Williams Sonoma, so the court was NOT basing its decision on HOW the information was used.

The decision was based on the fact that COLLECTING that information was in violation of The Song-Beverly Credit Card Act of 1971.

In short, the court's decision came down to this: Your zip code IS private personal information covered by the The Song-Beverly Credit Card Act.

The Supreme Court then kicked the case back down to the appeals court that had earlier disallowed the plaintiffs appeal, and instructed the appeals court to make a ruling that is consistent with the Supreme Court's decision that a zip code IS personal information.

Because that case is ongoing, numerous other lawsuits are being filed against other retailers in California since the California Supreme Court ruling.

[Paul299]

Re: California's Privacy Law: You Can't Collect Zip Codes

Note: Section 1747.08 contains some exceptions, including when a credit card isbeing used as a deposit or for cash advances, when the entity accepting the card is contractually required to provide the information to complete the transaction or is obligated to record the information under federal law or regulation, or when the information is required for a purpose incidental to but related to the transaction,such as for shipping, delivery, servicing, or installation. (
Id.
, subd. (c).)

I would think that getting a valid online authoritarian would be incidental to completing a valid transaction.

Paul

[pldoolittle]

Re: California's Privacy Law: You Can't Collect Zip Codes

I'm still amazed at an jello spined electorate that would go to the time and expense of passing a law (backed by the used of force) just so they don't have to say "No" to a cashier. This country is doomed...

And of course, that ignores the irony that you have just happily given that same cashier an account number (and CVV) that allows them to take money directly from your account at will.