A ruling last month by the State Supreme Court of California threatened to shut the tap on a source of marketing leads for brick-and-mortar businesses in that state, while opening the floodgates for a series of lawsuits against retailers and throwing in-store list-building into uncertainty.
In a unanimous ruling, the court declared that requesting and storing the ZIP code of a customer paying in-store with a credit card was a violation of
California’s Song-Beverly Credit Card Act of 1971, which prohibits retailers from asking for personally identifiable information (PII) in completing a credit card transaction.
The original complaint was brought by Jessica Pineda against retailer Williams-Sonoma in 2008. Pineda’s suit alleged that as she paid for an item with a credit card, she was asked by the cashier for her ZIP code and complied, thinking the information was necessary to complete the purchase.
It wasn’t. While ZIP codes are used as an authentication tool when the card is not present, as in an online or phone purchase, brick-and-mortar retailers are meant to verify by matching the card signature. Instead, Williams-Sonoma took Pineda’s name and ZIP code and ran them through a third-party database, discovered her street address and town, and entered that information in its house list for marketing purposes and for at least potential resale to other marketers or list compilers.
A trial court ruled that a ZIP code is not PII and an appellate court agreed, but in February the State Supreme Court reversed the judgment, and Pineda’s case—now a class-action lawsuit– is back in lower court for retrial.
On March 4 attorney Gene Stonebarger, lead counsel in the Pineda suit, filed suit against 21 national retailers for committing the same privacy violations alleged in that case. Defendants named in the suit include Bed Bath & Beyond, JC Penney, Kohl’s, Kmart, Office Depot, Walmart, Pep Boys, Best Buy, Brookstone, Home Depot, Lowe’s, Macy’s, Nordstrom and Crate & Barrel.
Other firms have brought suit against such retailers as Tiffany & Co., Target and Victoria’s Secret.
Under the California law, a merchant who requests personal information in an in-store credit transaction could be subject to a $250 fine for the first violation and up to $1,000 for each subsequent one. But the Supreme Court ruling specified that these are maximum penalties, which courts have the discretion to moderate.
The ruling exempted some retailers from the no-ZIP-code rule, such as gas stations, which are obliged by card issuing banks to ask for a ZIP code as authentication at automated pumps. Retailers can also ask for ZIP codes in performing returns or honoring warranty claims, if they are simply asking for the information to ensure that the claimant really is the purchaser. Online sellers or retailers shipping goods can also ask for the cardholder’s ZIP code as part of the transaction.
But the court’s ruling is clear that asking for a ZIP code, storing it in a retailer’s permanent database, matching it to any kind of reverse lookup record and then using the information to market to that customer—those things violate the intent of the Song-Beverly Act.
“The legislative history of the Credit Card Act in general… demonstrates the legislature intended to provide robust consumer protections by prohibiting retailers from soliciting and recording information about the cardholder that is unnecessary to the credit card transaction,” Associate Justice Carlos Moreno wrote in his opinion. “In light of the statutory language, as well as the legislative history and evident purpose of the statute, we hold that personal identification information includes a cardholder’s ZIP code.”
At present the presumption is that California retailers will still be able to ask for customers’ ZIP codes in the case of cash purchases, since there will be no name to match with the ZIP data and then mine for an address or phone number. The ruling seems not to apply to purchases made with debit or gift cards.
The Supreme Court went further and declared that its ruling was retroactive, dating back to passage of stronger consumer-protection language in the bill in 1996. So retailers who have compiled customer databases in California for the last few years might be forced to decide: either strip out the names of credit-card shoppers that they may have acquired through ZIP code matching, or run the risk of penalties and civil lawsuits.
“What will happen is that 10% of the country—the portion living in California—will get thrown away, simply from marketers’ fear of being tagged for marketing [using wrongly-acquired data],” says Lee Kroll, president of Kroll Direct Marketing, a list broker and digital marketing services agency. “California residents will lose out for postal, email and mobile marketing, and as a result state tax revenues will be impacted.
“This has tremendous ramifications. Whoever envisioned something that’s been available for the last 40 years would be classified personally identifiable information?”
Retailers in California and elsewhere have long asked customers for their ZIP codes for a number of reasons, such as measuring the reach and effectiveness of their local media buys, or determining the optimum markets for new store construction.
“I cannot understand the thinking behind this decision,” says Geoff Batrouney, executive VP and chief operating officer at list management agency Estee Marketing Group [http://www.esteemarketing.com/]. “The ZIP code is very important to merchants and retailers, and not just for data mining. Merchants are paying very high inter-bank transfer fees, and they are able to get a discount from Visa, MasterCard and other issuing companies when they present the transaction with an accompanying proof of verification such as a ZIP code.”
Batrouney holds that without those discounts to retailers, California consumers may see higher prices than their counterparts in other states for the same goods. “It’s an anti-consumer ruling in both the short-term and the long-term,” he says. “If companies are able to use ZIP codes to refine their marketing message so that the household receives appropriate direct mail, then it’s not junk, and there’s less mail.
The Direct Marketing Association filed a friend of the court brief in the Pineda case. DMA senior vice president of government affairs Jerry Cerasale believes that the California decision to place ZIP codes off-limits for retailers will not be mirrored in other parts of the country—even though some 15 states have credit card laws that approximate some of the other protections in the Song-Beverly Act.
“Especially since [the ZIP code ban] is so far out of the mainstream and since two lower courts agreed with Williams-Sonoma and the DMA, we think that this situation will be limited to California,” Cerasale said. “Still, one eighth of the American population lives there. So this is not an insignificant decision.”
Related Articles:
The Goldilocks Rule of Data-Driven Marketing: Getting It Just Right
Network
