Is It Illegal to Ask for a ZIP Code With a Credit Card Sale in California?

Last updated: November 2026. Reviewed by Pavel Kolmogorov, California business litigation attorney (State Bar No. 321018).

It can be, if the cashier records it during the sale. Civil Code section 1747.08, part of the Song-Beverly Credit Card Act, bars a business that accepts credit cards from requesting personal identification information from the cardholder and recording it. The California Supreme Court held in 2011 that a ZIP code counts. The civil penalty is up to $250 for the first violation and up to $1,000 for each later one. Exceptions cover shipping, fuel pumps, and a few other situations. Kolmogorov Law, P.C. defends California retailers against these claims.

Call (909) 235-6116 or contact us online to discuss a demand or complaint about information collected at checkout.

What section 1747.08 prohibits

The section applies to any person or company that accepts credit cards for the transaction of business. It forbids three things. (Civ. Code, § 1747.08, subd. (a).)

Requesting, or requiring as a condition of accepting the card, that the cardholder write personal identification information on the transaction form or otherwise.
Requesting or requiring the cardholder to provide that information, which the business then writes down or otherwise records.
Using a credit card form with preprinted spaces designated for that information.

Personal identification information means information concerning the cardholder, other than information set forth on the card. It includes, but is not limited to, the cardholder's address and telephone number. (Civ. Code, § 1747.08, subd. (b).)

Note the verbs: "request, or require." A cashier who asks politely and records the answer may still violate the section.

A cardholder is a natural person to whom a card is issued for consumer credit purposes. (Civ. Code, § 1747.02, subd. (d).) A purchase on a company card raises a different question.

The ZIP code decision

A retailer asks each card customer for a ZIP code and keys it into the register. Is five digits "personal identification information"? The California Supreme Court said yes. Requesting and recording a cardholder's ZIP code during a credit card transaction, without more, violates the statute. The court applied its reading to past transactions as well as future ones. (Pineda v. Williams-Sonoma Stores, Inc. (2011) 51 Cal.4th 524.)

The definition says "including, but not limited to," so the list is not closed. The court also read "concerning the cardholder" broadly, as information that pertains to or regards the cardholder.

Later Court of Appeal decisions add a limit. A request violates the section only when a reasonable customer could understand the information to be required to complete the card transaction. A request made after the sale is finished does not.

The exceptions

The prohibition does not apply in several situations. (Civ. Code, § 1747.08, subd. (c).)

The card is used as a deposit to secure payment in the event of default, loss, or damage, or the transaction is a cash advance.
The business is contractually obligated to provide the information to complete the transaction, or is obligated by federal or state law or regulation to collect and record it.
A retail motor fuel dispenser or payment island automated cashier uses the ZIP code solely to prevent fraud, theft, or identity theft.
The information is required for a special purpose incidental but related to the transaction, such as shipping, delivery, servicing, installation, or a special order.

Identification is treated separately. A business may require reasonable positive identification, such as a driver's license, as a condition of accepting the card, so long as nothing on it is written down or recorded. If the buyer pays with a card number and does not make the card available on request to verify it, the license or identification card number may be recorded. (Civ. Code, § 1747.08, subd. (d).)

Online sales

The statute was written for the sales counter. In 2013 the California Supreme Court held that it does not apply to online purchases of electronically downloadable products. An online seller cannot inspect the card or a photo identification, so the statute's own safeguard against fraud is unavailable. The court expressly did not decide whether the section applies to online sales of other products, or to mail and telephone orders. (Apple Inc. v. Superior Court (2013) 56 Cal.4th 128, 133, 140-141, 143.)

For goods shipped to the buyer, the shipping and delivery exception is the first argument. Whether the statute applies to those sales at all is a question that decision left open.

Penalties, plaintiffs, and the bona fide error defense

A violation carries a civil penalty not to exceed $250 for the first violation and $1,000 for each subsequent violation. The action may be brought by the person who paid with the card, the Attorney General, or the district attorney or city attorney where the violation occurred. (Civ. Code, § 1747.08, subd. (e).) The amounts are ceilings. Pineda repeated that the statute sets maximum penalties and leaves the amount to the trial court's discretion.

The same subdivision contains a defense. No penalty may be assessed if the defendant shows, by a preponderance of the evidence, that the violation was not intentional and resulted from a bona fide error made despite procedures reasonably adopted to avoid it.

The statute speaks of a first violation and of each subsequent one, and Pineda itself was filed as a putative class action. See our page on a business named in a class action.

What to do when the letter arrives

Document the register prompt, the cashier script, and the training materials as they exist, before changing them. Our litigation hold page explains why.
Find out what was stored, where, and what it was used for.
Pull the claimant's transaction record.
Send the letter to your insurance broker. See whether business insurance covers a lawsuit.

Do not reply with an account of how the store uses customer data. The general steps are on our page about receiving a demand letter. If the letter also invokes the Consumers Legal Remedies Act, a separate 30-day procedure for damages claims applies, described on our CLRA demand letter page.

What to bring to the first meeting

The demand letter or complaint.
Screenshots of the point-of-sale prompts and any written cashier instructions.
The date the practice began and the stores involved.
A description of where the collected information is stored and how it is used.
Your business insurance policies.

Frequently asked questions

Our cashiers ask for a ZIP code with credit card sales. Someone says that is illegal in California. Is it?

It can be, if the request comes during the sale and the ZIP code is recorded. California Civil Code section 1747.08 prohibits requesting personal identification information from a credit card customer and recording it. The California Supreme Court held in 2011 that a ZIP code qualifies. Courts ask whether a reasonable customer would take the request as required to complete the card transaction. The statute has exceptions, including information needed for shipping or delivery and ZIP codes used at fuel pumps solely to prevent fraud.

What is the penalty under the Song-Beverly Credit Card Act?

For a violation of California Civil Code section 1747.08, the civil penalty may not exceed $250 for the first violation and $1,000 for each subsequent violation. Those are maximums, and the trial court decides the amount. No penalty is assessed if the business proves the violation was unintentional and resulted from a bona fide error despite procedures reasonably adopted to avoid it.

Can a California store ask for ID with a credit card?

Yes. Civil Code section 1747.08, subdivision (d), allows a California business to require reasonable positive identification, such as a driver's license or state identification card, as a condition of accepting a credit card. The business may not write down or record what the identification shows. The license or identification card number may be recorded only when the buyer pays with a card number and does not make the card available on request to verify it.

Does the Song-Beverly Credit Card Act apply to online purchases?

Not to all of them. The California Supreme Court held in 2013 that Civil Code section 1747.08 does not apply to online purchases of electronically downloadable products. The court did not decide whether it applies to online sales of other products or to mail and telephone orders. For goods shipped to a buyer, the exception for shipping and delivery information is also relevant.

We collect a ZIP code only at the gas pump to prevent card fraud. Does the California statute allow that?

Yes, within limits. Civil Code section 1747.08, subdivision (c), exempts a credit card sale at a retail motor fuel dispenser or payment island automated cashier when the ZIP code is used solely for prevention of fraud, theft, or identity theft. A California station that also used the ZIP code for marketing would be outside those words.

Talk to a California business litigation attorney

If your business has received a demand or complaint under the Song-Beverly Credit Card Act, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is located in Irvine, California, and represents companies and their owners in the state and federal courts in California.

This page provides general information about California law and is not legal advice. Outcomes depend on the transaction, the facts, and the court.