On February 10, 2011, the California Supreme Court ruled that merchants who request and record a credit cardholder’s zip code violate a California consumer protection law entitled the Song-Beverly Credit Card Act, which prohibits merchants from requesting and recording a customer’s “personal identification information” during a credit card transaction. The Act provides for damages of up to $1,000 per violation.

In the Pineda case, the plaintiff brought a class action lawsuit alleging that she was asked for her zip code while making a credit card purchase at a national retailer. Purportedly believing that the information was required to complete the transaction, the plaintiff provided her zip code to the cashier who then recorded it. The California Supreme Court found that under the Song-Beverly Act, a customer’s zip code is “personal identification information” that is unnecessary to the transaction and that can be used to locate a customer’s full address. Therefore, the retailer violated the Song-Beverly Act each time it requested and recorded a customer’s zip code during a credit card transaction. Of particular concern for retailers, the Court also held that Pineda will apply retroactively, despite earlier rulings that a zip code is not “personal identification information.”

In the 12 days since Pineda was decided, plaintiffs have rushed to file class action lawsuits against major retailers. Class action lawsuits alleging violations of the Song-Beverly Act have reportedly been filed against more than a dozen retailers, including Old Navy, Macy’s, The Container Store, Shell and Victoria’s Secret. With $1,000 available per violation, companies operating in California need to immediately reassess their policies and procedures to conform to this new ruling.