Sounding Board: Five scary digits

A California Supreme Court ruling restricting retailers from collecting ZIP codes could lead to costly penalties and impact how consumer data is gathered going forward.

By Len Lewis

The California Supreme Court has given a new definition to the term “private parts” and made it illegal for retailers to peek.

Sound titillating? Not among retailers for whom collecting and recording ZIP codes is now strictly taboo and certainly not if you consider the broader implications.

In a decision that has been called archaic, misguided and just plain dumb, the High Court said the ubiquitous five-digit code constitutes personal identification information and requesting and recording it is a violation of California’s 1971 Song Beverly Credit Card Act.

The impetus for this tempest in a teapot is Pineda v. Williams-Sonoma, a suit brought by plaintiff Jessica Pineda who thought her ZIP code was needed to complete a credit card transaction, She also alleged that the information was used to track down her home address for the purpose of marketing to her and selling the information to others.

Two lower courts dismissed the case deciding that ZIP codes identify groups of people not individuals. Seems logical. But the state Supreme Court decided otherwise —never mind that you have to give your ZIP code to get the credit card in the first place or that in the Internet age, ZIP codes are probably the most innocuous information out there.

Of course, the Court cited exceptions. In this case there are exemptions for gas stations, which collect ZIP codes to protect credit card users, for merchandise that needs to be shipped and when personal information is required by regulation or federal law.

The results of this decision were predictable. Those champions of truth, justice and the American way—lawyers—have filed an estimated 200 class action suits since the court’s decision against most major retailers, including Target, Trader Joe’s, Walmart and Whole Foods. Despite exceptions noted by the Court, Amazon and PayPal were targeted as well.

I smell settlement. Even two attorneys I spoke with said clearly this has more to do with a payday for lawyers than protecting consumers.

Each first violation is subject to $250 fine with subsequent violations costing $1,000.  This is for each instance, so multiply that by the number of consumer transactions. Not to mention the fact that the Court made it retroactive for 12 months. Even if class settlement consists of a $10 gift card, multiply that by 50,000 consumers and we are talking about a lot of lettuce.

One brief attempt to bring some clarity to the issue and limit frivolous lawsuits was aborted by the California Retailers Association when it became clear that legislators really did not understand the issue.

However the danger is that a wider net will be cast. About 15 states, including New York, New Jersey and Pennsylvania, have laws similar to Song Beverly and there could be a backlash by consumers who are tired of giving out information to anyone who asks for it and making themselves more vulnerable in the process.

The short answer? Do not collect ZIP codes if you can help it.

But the situation is rife with speculation about unintended consequences. In fact, it goes to the heart of what every right thinking retailer is trying to do these days—stay in touch with customers. Retailers are beginning to wonder if there could be problems down the road with collecting IP addresses, planting cookies or using loyalty card data—all of which are far more detailed and intrusive than collecting ZIP codes.

According to some legal experts the Pineda decision also brings up the question of who has jurisdiction over online retail sales—whether it is based on the store, where the consumer is located, where the company’s server is located or the location of its fulfillment center. These too could affect what kind of information you can request from customers. With appellate courts poised to revisit previous decisions on the matter, some retailers may find themselves in a legal stew over something they did in 2010 when it was perfectly legal.

In the final analysis, there are valid business reasons for retailers to collect ZIP codes—the simplest of which is knowing where your customers are coming from. But in the Internet Age with the risk of identity theft, the law is always chasing technology. So, whatever you do keep an eye on what is behind you.

Len Lewis, a regular Grocery Headquarters columnist, is a veteran industry journalist, commentator and editorial director of Lewis Communications, Inc. He is the author of The Trader Joe’s Ad­venture—Turning a Unique Approach to Business into a Retail and Cultural Phenomenon. He can be reached at or at

This entry was posted in 2011 08 Article Archives, Columns. Bookmark the permalink.