Slashdot Mirror
Court Says California Stores Can't Ask Customers For ZIP Codes
Hugh Pickens writes writes "CNN reports that the California Supreme Court has ruled that retailers in California don't have the right to ask customers for their ZIP code while completing credit card transactions, saying that doing so violates a cardholders' right to protect his or her personal information, pointing to a 1971 state law that prohibits businesses from asking credit cardholders for 'personal identification information' that could be used to track them down. 'The legislature intended to provide robust consumer protections by prohibiting retailers from soliciting and recording information about the cardholder that is unnecessary to the credit card transaction,' the decision states. 'We hold that personal identification information ... includes the cardholder's ZIP code.' In her lawsuit, Jessica Pineda claimed that a cashier at Williams-Sonoma had asked for her ZIP code during a purchase — information that was recorded and later used, along with her name, to figure out her home address by tapping a database that the company uses to market products to customers and sell its compiled consumer information to other businesses."
Worse is O'Reilly auto parts. They want your name, address and phone number.
They told me it was for "warranty information". I was buying a quart of oil.
I walked out and went and bought it at Walmart instead.
The law provides for the collection of personally identifying information that's necessary for the transaction. Online, this includes the billing zip code. This ruling apples to card-present retail transactions. FYI. Here's the entire decision: http://www.courtinfo.ca.gov/opinions/documents/S178241.PDF
geek. lawyer.
While that makes sense in theory, merchants do have the right to verify the identity of a customer attempting to use a credit card. Won't they just request to see a driver's license instead? Then they would have access to much more personal information than just a zip code. I don't really see how this law ends up protecting anyone.
I have noticed many gas stations around here now require you to enter your zip code when you pay at the pump. I assume it's an extra validation against the zip code on your credit card.
The law provides for the collection of personally identifying information that's necessary for the transaction. Online, this includes the billing zip code. This ruling apples to card-present retail transactions. FYI. Here's the entire decision: http://www.courtinfo.ca.gov/opinions/documents/S178241.PDF
Except the billing zip code happens to be a very important (though not the only) piece of AVS (Address Verification System), which is used to combat fraud. In a nutshell, the merchant submits the customer's address along with their card info, and (depending on the merchant's arrangement) the credit card processor checks to make sure certain parts of that address match what's associated with that card number. Zip code happens to be one of the most reliable.
read an actual merchant agreement some time
(the one between the business and visa)
merchants are FORBIDDEN to ask for ID as a condition of using a credit card...
if the signature is good, and the card is present, you may NOT ask for ID just because its a credit card.
if you require ID of all purchasers say, for a hotel, you can ask for ID.. but not just because it is a credit card.....
doing so violates CC agreements.
(merchants aren't even supposed to accept cards that say CID or SEE ID)
if it is UNSIGNED, we are to request ID, then get the card holder to sign the card before accepting.
(I have a merchant agreement, I've read it, and I've read the merchant operations PDF's at the major sites)
every day http://en.wikipedia.org/wiki/Special:Random
Interesting, if upheld, this could push the PCI DSS Council to add Zip to the list of non public information that must be encrypted.
And that would effectively mandates QSA's find every gas station in California in violation of the next wave of PCI DSS criteria.
The expense of coding testing, QA'ing, promoting encryption on Zip (at rest and in transmission) could be high as compared the moderate to minor risk that companies are stalking their customers using Gas Station data.
Every time someone asks me for this kind of information at the register it just makes me mad... with so many other ways to validate my identity there is zero excuse for exposing this kind of data to retailers.
A ZIP Code is hardly personal information. Who cares what city you live in? You're already giving them your name and fucking credit card info of all things... what makes a ZIP code so threatening?
I don't get mad about it. I think that they should be free to ask just as I should be free to say, "no thank you," which I do every time. In most cases when you say this to them they punch in some default (Kohl's seems to do all 0s but other businesses just put in the city's zip code).
When pressured I provide 90210. The only time I've had a problem was at a RadioShack store in OH during college when I was trying to buy batteries. The dude asked for my zip code and I went through the spiel and then he laid into me, got his manger to yell at me, and finally told me never to come back into the store or they'd call the police for falsifying records.
I paid cash. No records about ME should have been kept. Ridiculous.
If someone steals your wallet, they have your credit card, and they have your zip code. Not very secure.
In her suit, Pineda claimed that a cashier had asked for her ZIP code during a purchase -- information that was recorded and later used, along with her name, to figure out her home address. Williams-Sonoma did this tapping a database that it uses to market products to customers and sell its compiled consumer information to other businesses.
Note that it is still legal for a business to ask your ZIP code and possibly other information. What is made illegal:
1. conditioning the sale on obtaining data which are not necessary for completing the sale transaction
2. recoding a data which is not absolutely required for completing a sale transaction.
At least this is how I interpret:
It is not illegal in California for a retailer to see a person's ZIP code or address, the ruling notes: For instance, one can request a customer's driver's license to verify his or her identity. What makes it wrong is when a business records that information, according to the ruling, especially when the practice is "unnecessary to the sales transaction."
Questions raise, answers kill. Raise questions to stay alive.
You don't need information about the person, you need information known only to the person and the card company. Using easily obtained information such as address or phone number is much less secure than a shared secret.
My credit card has my name on it. I'm the only person with that name in the phone book. Anyone who steals my card can give you my address and phone number. How's that validate the card?
It's sad that my Slashdot login is more secure than my credit card. And it preserves more of my privacy.
Sounds to me like the law is only treating symptoms. How about a law that makes it illegal to sell customer info without their express written consent?
What?
The credit card company is assuming the risk, not you. Since when did Master Card have the power to deputize you and turn you into a mini police detective? They set up a system, it's their responsibility to ensure that their business model works. For that they earn billions of dollars, and you don't.
While it would be nice if that was the case, it isn't. If someone walks out of my store with a $500 laptop computer paid for with a stolen credit card, I'm out the merchandise and the revenue when the actual card owner issues a chargeback. Think all I have to do is provide a signed charge slip to get my money back? Then you probably have never experienced the joys of attempting to do battle with a credit card company. Part of the reason that they earn billions of dollars and I don't is because they have entire departments dedicated to putting the burden of risk on the merchant and not the card issuer.
When I'm paying in person with a credit card and a retailer asks me to provide my zip code, all I do is say "I'd rather not." Been doing it since the early 80's, when the practice first started. It's almost never a big deal. Very rarely (maybe once in several years) the cashier complains and I say that my zip code is 12345. They just want something they can punch in so they don't get in trouble with their manager.
Cashiers at some bricks-and-mortar retailers ask for a zip code even when I'm paying cash. I just give them a quizzical look and say, "Oh, I'm paying cash."
Find free books.
Below is right about the bleach, but there are other concerns as well.
Ever been poked accidentally by a barber? Now, what happens if they draw blood (even a drop is enough) and you're HIV positive? It's a reasonable question to ask.
Or, simple things like hair lice or other vermin that could be infesting you.
Some of it is obviously marketing driven (hair cut count, family members, etc..), but the other stuff is not as sinister as it might first appear.
That doesn't fit the syntax. ANA NAN. A being an alpha and N being a numeral.
You can use H0H 0H0 on forms. "Santa"s post code.
Sent from my PDP-11
It's even more fun when you don't actually live in the US and are just visiting. They typically get very confused when you start saying letters.
No thank you.
"You want to know how to help your kids? Leave them the fuck alone." -George Carlin
For instance, one can request a customer's driver's license to verify his or her identity.
They can ask, but not require it for most credit cards. Some Credit Card agreements actually prohibit the merchant from asking to see ID.
http://www.privacyrights.org/ar/Alert-FS15.htm
'Most people are sheep though. You can ask for their name, DOB, SSN, CC number and PIN, email address, and even their email password, and they'll hand it over for the "discount".'
I will submit that most people aren't sheep in this regard. It is simply that decent people have to generally prepare themselves to lie ahead of time. When asked a straightforward question that might even surprise them they do the thing they are conditioned to do. Tell the truth. I find myself time after time spitting out my zip code even as my brain is saying "bullshit!"
http://www.rootstrikers.org/
gas pumps currently use the zip to verify it's your card...
No they don't. The zipcode is never sent to the credit card company. It's collect for demographics. Try putting in a bogus zip if you don't believe me.
I have - right after a move, I forgot whether or not I had updated that particular card and guessed wrong. The machine bounced the card and locked into a "See attendant to complete transaction" mode. I drove up to the next machine and swapped cards just to be sure.
As in Fishead's comment above yours, they use this for returns. If you lose the receipt, they can pull up your purchase history, at every RadioShack in the country, by your name and zip code, or name and phone number, or any other unique identifying information.
It is not illegal in California for a retailer to see a person's ZIP code or address, the ruling notes: For instance, one can request a customer's driver's license to verify his or her identity. What makes it wrong is when a business records that information, according to the ruling, especially when the practice is "unnecessary to the sales transaction."
So, ASKING for the zip code itself was not wrong, using it for marketing was the wrong bit. Had they kept the zip purely for the transaction (as proof for later challenges making it necessary for the sales transaction) and NOT used it for marketing, then everything would have been okay.
Once again, slashdot fails to read the full article and jumps all over the place with its conclusions.
The company would have been just as wrong if they had used their credit card information they get back from the CC company for marketing purposes. This is about using information from one set of data in another set of data without permission being given.
And it is ALSO okay for shops to ask you for your zip code for marketing purposes as long as it is clear that is what it is for. You can just say no. In Holland at least companies put up a sign telling you what the request is for.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Is your ID a Driver's License? Technically, where I live you are required to notify the registry of motor vehicles whenever you change your address, and they actually send you a sticker to put on the back of the license with your corrected address. So you'll always be carrying around your ZIP Code if you're in compliance. Not that I imagine everyone is so diligent.
RETURN without GOSUB in line 1050
It's a verification step. There are also some CC processors, I've noticed, that give lower CC rates for using zip codes as a verification. For a gas station, 1/4-1/2% is a big deal because the margins are so low.
Is it just my observation, or are there way too many stupid people in the world?
Whenever I was asked for info, I would just say "cash" and they knew what to do and stop asking questions. If it is a credit card terminal then I know to plug in my real zip code. If I am pressed for my zip code when the transaction starts with the cashier, as a teen in the late 80's I always just give them 90210 and they don't bat an eye.
If they are asking for my data without my permission, I don't really see a problem with throwing a few data spikes in their data harvest.
Microcenter is another one of these that demands addresses. You can sometimes see the screen they are working on, just tell them your last name is "Jones" and when several pop up say you recently moved and tell them "yeah, the third one on the list there is me".
There is no legal requirement to be truthful with these quizzes, have fun with them!
http://online.wsj.com/article/SB10001424052748704803604576078131322160002.html
The merchant is the one that eats the cost of fraudulent transactions, not the card company. One could argue that you always could use cash if you wanted to be anonymous.