Court Says California Stores Can't Ask Customers For ZIP Codes 461
Hugh Pickens writes writes "CNN reports that the California Supreme Court has ruled that retailers in California don't have the right to ask customers for their ZIP code while completing credit card transactions, saying that doing so violates a cardholders' right to protect his or her personal information, pointing to a 1971 state law that prohibits businesses from asking credit cardholders for 'personal identification information' that could be used to track them down. 'The legislature intended to provide robust consumer protections by prohibiting retailers from soliciting and recording information about the cardholder that is unnecessary to the credit card transaction,' the decision states. 'We hold that personal identification information ... includes the cardholder's ZIP code.' In her lawsuit, Jessica Pineda claimed that a cashier at Williams-Sonoma had asked for her ZIP code during a purchase — information that was recorded and later used, along with her name, to figure out her home address by tapping a database that the company uses to market products to customers and sell its compiled consumer information to other businesses."
Re:Does that really solve the problem? (Score:5, Insightful)
Re:Worse is (Score:5, Insightful)
I'm from 90210.
My phone number is: 123-456-7890 OR the local police department's phone number.
My name if paying cash is John Doe.
Yes I've gotten some raised eye brows, but all I do then is tell them to prove me wrong.
Re:Worse is (Score:5, Insightful)
I went to go get a Hair Cut. Yes, a hair cut and they handed me a form on a clip board that wanted:
my name (including last).
Phone Number
Address
Email address
Which is ridiculous to start with; but to top it off they also wanted:
Emergency contact (seriously?)
Any medical conditions I might suffer from that would impair or need to warn the hair dresser about? (um?)
Any family members or friends that might be interested in getting a hair cut. (wtf)
and a "short" 2 page survey with questions like "How often do you get your hair cut?"
This wasn't some high end fancy pants place. It was Great Clips or ClipNSave or Cost Cutters, one of the big ones. Hair cuts are normally $20 and I had a 75% off coupon.
I told them "um, I'm not going to fill this out" and the snotty girl behind the counter said "well, I guess your not getting a hair cut here then"
I agreed. Fuck everything about that.
Re:Does that really solve the problem? (Score:3, Insightful)
merchants do have the right to verify the identity of a customer attempting to use a credit card.
Do they? Why should they? The transaction is between the merchant and the credit card company. The identity of the person holding the card is irrelevant to the merchant. It is the responsibility of the credit card company and the person to whom the card was issued that only a valid person has access to use the card. Granted, the merchant may act on behalf of the credit card company to validate the user, however it really is none of the merchant's business.
It is in the merchant's best interest to ensure that the person who is presenting the card is authorized to do so (if the transaction is not authorized, guess who gets stuck with the bill... the merchant not only loses the money from the sale and transaction fees and the loss of the goods, but is usually also charged an additional fee for the chargeback). One way of doing that is by requiring "something you know" (i.e. The zip code for credit transactions, the PIN for debit transactions). This goes along with "something you have" (the card itself)
As everyone that is security minded knows, this is commonly known as two-factor authentication.
Treating symptoms (Score:5, Insightful)
Sounds to me like the law is only treating symptoms. How about a law that makes it illegal to sell customer info without their express written consent?
Re:Does that really solve the problem? (Score:4, Insightful)
Your zip code is a very poor choice for authentication.
Stores ask for your zip code because they're interested in customer demographics, not authentication.
Re:FINALLY... (Score:4, Insightful)
No thank you.
Re:Pier1 does that (Score:5, Insightful)
'Most people are sheep though. You can ask for their name, DOB, SSN, CC number and PIN, email address, and even their email password, and they'll hand it over for the "discount".'
I will submit that most people aren't sheep in this regard. It is simply that decent people have to generally prepare themselves to lie ahead of time. When asked a straightforward question that might even surprise them they do the thing they are conditioned to do. Tell the truth. I find myself time after time spitting out my zip code even as my brain is saying "bullshit!"