It is illegal in California for a retailer to ask a customer for his or her ZIP code during an in-store credit card purchase. In Pineda v. Williams-Sonoma Stores, Inc., issued on February 10, 2011, the California Supreme Court ruled that such requests violate the California Song-Beverly Credit Card Act of 1971 (Credit Card Act). The Court refused to make its ruling apply prospectively only, placing retailers at risk for claims based on ZIP code requests made before the ruling.

According to the Court, retailer requests for ZIP codes are barred by the Credit Card Act’s provision that prohibits businesses from requesting or requiring a customer who uses a credit card to purchase goods or services “to provide personal identification information, which [the business] accepting the credit card writes … or otherwise records upon the credit card transaction form or otherwise.” The Court held that by including in the Credit Card Act “the cardholder’s address and telephone number” as an example of “personal identification information,” the California Legislature intended to include all components of an address. As support for its reading, the Court noted that a customer’s ZIP code was similar to an address and telephone number “in that a ZIP code is both unnecessary to the transaction and can be used, together with the cardholder’s name, to locate his or her full address.”

Credit Card Act violations are subject to a maximum penalty of $250 for the first violation and $1,000 for each subsequent violation. Nevertheless, the Court rejected the retailer’s argument that the Court’s construction of the Credit Card Act would violate the Due Process Clause of the U.S. Constitution. According to the Court, because the Credit Card Act sets only maximum penalties and leaves the actual penalties awarded to the trial court’s discretion, its construction would not result in penalties approaching confiscation of the retailer’s entire business, as the retailer contended.

Despite the Court’s treatment of the retailer’s due process argument, we believe cases decided by the U.S. Supreme Court addressing punitive damages provide strong support for the argument that Credit Card Act penalties are unconstitutional. As the case was remanded for further proceedings, it is possible the retailer will renew that argument in connection with class certification or at the damages stage.

Although one federal district court has held that the Credit Card Act does not bar ZIP code requests in online transactions, largely because of the unique fraud risks posed in such circumstances, the Pineda decision is likely to fuel more litigation over online requests. Also, similar litigation may arise in other states, such as Kansas, Rhode Island, and Oregon, that have laws restricting a retailer’s ability to require personal information and thus may also preclude a retailer from seeking ZIP codes from customers.