California’s Song-Beverly Credit Card Act: Privacy Rules at the Checkout Counter

Statute: Song-Beverly Credit Card Act of 1971, Cal. Civ. Code §§ 1747–1748.95
Enacted: 1971
Last statutory amendment: 2011
Key privacy provisions: Cal. Civ. Code §§ 1747.08 and 1747.09

California was regulating privacy at the checkout counter long before “consumer privacy” became "a thing" in the US.

The Song-Beverly Credit Card Act of 1971, codified at California Civil Code §§ 1747–1748.95, establishes a broad set of protections governing credit-card transactions. Some concern traditional consumer-credit issues: unauthorized use, billing errors, card issuance, and cancellation. Others look remarkably familiar to modern privacy lawyers.

Most notably, the Act restricts retailers from requesting and recording certain personal identification information from consumers during credit-card transactions. It also limits what card information may appear on electronically printed receipts.

Those provisions have generated significant litigation over seemingly simple questions: Can a cashier ask for your ZIP code? Your email address? What if the cashier asks after handing you the receipt? What if you are buying something online?

The answers are more complicated than the statutory language initially suggests.

A Consumer Credit Law With an Early Privacy Rule

The Song-Beverly Credit Card Act predates the California Consumer Privacy Act by nearly five decades.

The Legislature enacted the original Act in 1971. It expressly provides that provisions analogous to the federal Truth in Lending Act should generally conform to the federal statute and implementing federal rules and interpretations. Cal. Civ. Code § 1747.01.

But one of Song-Beverly's most interesting features today is not really about credit disclosure at all.

It is about data collection at the point of sale.

Section 1747.08 generally prevents a business accepting a credit card from requesting or requiring a cardholder to provide personal identification information and then recording that information in connection with the credit-card transaction. See, Cal. Civ. Code § 1747.08.

That makes Song-Beverly an important early example of a principle that later became central to privacy law: businesses should not automatically collect personal information simply because technology makes collection easy.

Who Is Regulated?

The Act regulates different actors for different purposes, principally credit-card issuers, retailers, and cardholders.

(1) Credit Cards

A “credit card” is broadly defined as a card or other single credit device used from time to time to obtain money, property, labor, or services on credit.

The definition contains specific exclusions, including certain electronic-fund-transfer arrangements and certain business-purpose petroleum cards. See, Cal. Civ. Code § 1747.02(a).

• In Archer v. United Rentals, Inc., the California Court of Appeal concluded that the protections of § 1747.08 did not extend to a transaction involving a business-purpose credit card. Archer v. United Rentals, Inc., 195 Cal. App. 4th 807 (2011).

The Act also generally excludes transactions constituting electronic fund transfers as defined under federal Regulation E. See, Cal. Civ. Code § 1747.03.

Practice Point: Do not assume every transaction involving a plastic payment card is governed by Song-Beverly. The statute's credit-card provisions generally do not extend to ordinary debit-card transactions. Section 1747.09, however, expressly addresses both credit and debit card numbers when regulating electronically printed receipts.

(2) Card Issuers

A “card issuer” is a person who issues a credit card—or that person's agent for purposes of issuing the card. See, Cal. Civ. Code § 1747.02(c).

(3) Retailers

A “retailer” generally means a person other than a card issuer who furnishes money, goods, services, or anything else of value upon presentation of a credit card. California state and local governmental entities and other public agencies are excluded from this definition. See, Cal. Civ. Code § 1747.02(e).

(4) Cardholders

A “cardholder” generally means a natural person to whom a credit card is issued for consumer-credit purposes, or a natural person who has agreed to pay consumer-credit obligations arising from a card issued to another natural person. See, Cal. Civ. Code § 1747.02(d).

For some provisions, the statutory definition expressly reaches cards issued for business, commercial, or agricultural purposes. But that expanded definition does not apply universally throughout the Act.

Song-Beverly Goes Beyond Privacy

Although this article focuses on §§ 1747.08 and 1747.09, the Act is much broader.

Among other things, it regulates:

The Act also makes attempts to waive its protections contrary to public policy and therefore void and unenforceable. See, Cal. Civ. Code § 1747.04.

The Privacy Rule: Do Not Turn a Credit-Card Transaction Into a Data-Collection Exercise

Section 1747.08 is the Act's central privacy provision.

Subject to several exceptions, a business accepting a credit card may not:

1. request or require the cardholder to write personal identification information on the credit-card transaction form or otherwise;
2. request or require the cardholder to provide personal identification information that the business then records; or
3. use a credit-card form containing pre-printed spaces specifically designated for the cardholder's personal identification information.

See, Cal. Civ. Code § 1747.08(a).

The modern version of this prohibition dates to amendments that became operative January 1, 1996.

The Act recognizes circumstances in which information may legitimately be needed. The prohibition does not apply, among other circumstances, when:

• the credit card is being used as a deposit to secure payment against default, loss, damage, or a similar occurrence;
• the transaction is a cash advance;
• the merchant is contractually obligated to provide the information to complete the transaction;
• a qualifying motor-fuel dispenser collects ZIP-code information solely for fraud, theft, or identity-theft prevention;
• federal or state law or regulation requires the information; or
• the information is required for a special purpose incidental but related to the transaction, such as shipping, delivery, servicing, installation, or a special order.

See, Cal. Civ. Code § 1747.08(c).

A merchant may also require reasonable positive identification, including a driver's license or California identification card, provided the merchant does not record the information. There is a specific exception permitting recording of a driver's-license or identification-card number when the customer pays using a credit-card number but does not make the physical card available for verification. See, Cal. Civ. Code § 1747.08(d).

What is "Personal Identification Information" Under the Act?

The statute defines personal identification information broadly as information concerning the cardholder, other than information appearing on the credit card itself. The statutory examples are address and telephone number, but the phrase “including, but not limited to” makes clear that the list is not exhaustive. See, Cal. Civ. Code § 1747.08(b).

Two types of information have produced particularly important litigation.

(1) ZIP Codes: A ZIP code counts as personal identification information under Pineda v. Williams-Sonoma Stores, Inc. The decision was particularly consequential because some retailers had relied on an earlier Court of Appeal decision reaching the opposite conclusion.

• In Pineda v. Williams-Sonoma Stores, Inc., the California Supreme Court held that a cardholder's ZIP code constitutes personal identification information under § 1747.08. The Court rejected the argument that a ZIP code was merely geographic information rather than information concerning the individual cardholder. Pineda v. Williams-Sonoma Stores, Inc., 51 Cal. 4th 524 (2011).

(2) Email Addresses: The statute does not expressly list email addresses.

• But in Capp v. Nordstrom, Inc., a federal district court predicted that the California Supreme Court would treat an email address as personal identification information. The case involved a cashier allegedly requesting an email address to provide an electronic receipt and then using the address for marketing. The court denied Nordstrom's motion to dismiss. Capp v. Nordstrom, Inc., No. 2:13-cv-00660 (E.D. Cal. Oct. 22, 2013).

Practice Point: Treating an email address or a similar piece of information as outside Song-Beverly simply because § 1747.08 does not expressly name it would be risky.

... But Not Every Request for Information Violates the Act

Earlier cases sometimes generated broad statements suggesting that simply asking a credit-card customer for personal identification information was enough to violate Song-Beverly.

Later California appellate decisions have refined that interpretation.

• In Harrold v. Levi Strauss & Co. is a 2015 California Court of Appeal, held that the statute does not prohibit every request for personal information made somewhere around the time of a credit-card transaction. The relevant issue is whether the circumstances would cause a reasonable person to believe that providing the information was required to complete the credit-card transaction.
• That approach was reaffirmed in the consolidated Williams-Sonoma Song-Beverly Act Cases in 2019. The Court of Appeal upheld decertification of a class involving requests for ZIP codes and email addresses because whether a request violated the Act depended on the circumstances surrounding individual transactions. Williams-Sonoma Song-Beverly Act Cases, 40 Cal. App. 5th 647 (2019).

Practice Point: Timing matters—but timing alone is not necessarily dispositive. Businesses seeking information for loyalty programs, marketing, or other purposes should clearly separate that request from the credit-card payment process and make clear that providing the information is optional and unnecessary to complete the purchase.

And... Online Transactions Are Different

Song-Beverly was written for a world of physical credit cards and checkout counters.

• The California Supreme Court confronted that problem in Apple Inc. v. Superior Court (Cal. 2013). The plaintiff alleged that Apple required him to provide an address and telephone number when purchasing downloadable media through the Internet. The Supreme Court held that § 1747.08 does not apply to an online purchase in which the product is downloaded electronically. The Court emphasized that the statutory scheme was designed around transactions in which a credit card is physically presented and included safeguards that do not translate naturally to online transactions.

See also, Apple Inc. v. Superior Court, 56 Cal. 4th 128 (2013).

Practice Point: Apple interpreted § 1747.08 in the context of an online transaction involving an electronically downloadable product. Businesses should analyze the nature of the transaction rather than assuming that every transaction occurring online necessarily falls outside the provision.

Receipt Truncation: A Different Song-Beverly Rule

Song-Beverly separately regulates what businesses print on receipts. A business accepting a credit or debit card generally may not print:

• more than the last five digits of the account number; or
• the expiration date

on specified electronically printed receipts.

See, Cal. Civ. Code § 1747.09.

The rule does not apply when the sole means of recording the account number is handwriting, an imprint, or a copy of the card. It also excludes certain documents used for internal administrative purposes.

PRACTICE TIP: Song-Beverly and PCI DSS Are Not the Same Thing. Song-Beverly permits electronically printed receipts to display no more than the last five digits of a credit or debit card account number. PCI DSS v4.0.1 generally requires the PAN to be masked so that the BIN and last four digits are the maximum displayed, absent a legitimate business need. Because PCI DSS also recognizes that stricter legal requirements may apply to point-of-sale receipts, businesses should generally configure consumer receipts to display only the last four digits to satisfy both standards.

Identity-Theft Victims Can Obtain Fraudulent Application Records

Song-Beverly also contains an important identity-theft provision.

A person who has obtained the police report specified by California Penal Code § 530.6 may request from a credit-card issuer copies of application forms or application information containing the person's identifying information when an unauthorized person used that information to apply for a card.

The issuer generally must provide the required information without charge and within 10 business days after receiving the required request, police report, and identifying information.

See, Cal. Civ. Code § 1748.95.

Enforcement: Small Requests, Potentially Large Exposure

Violating § 1747.08 can carry meaningful consequences. A violator is subject to a civil penalty of up to:

$250 for the first violation, and
$1,000 for each subsequent violation.

A civil action may be brought by the person paying with the credit card, the California Attorney General, or the appropriate district or city attorney.

See, Cal. Civ. Code § 1747.08(e).

The statute provides an important bona fide error defense. No civil penalty is assessed if the defendant proves by a preponderance of the evidence that the violation was unintentional and resulted from a bona fide error despite maintaining procedures reasonably designed to prevent the error.

PRACTICE TIP: Document Your Compliance Program. Written checkout procedures, employee training, appropriate POS configuration, regular testing, and documented controls are particularly important because they can help demonstrate that an isolated violation was an unintentional bona fide error despite procedures reasonably designed to prevent it.

The Attorney General and local prosecutors may also seek injunctive relief. § 1747.08(f).

Song-Beverly Compliance Checklist

Conclusion: Why This 1971 Law Still Matters

Song-Beverly is an interesting reminder that some of California's modern privacy instincts are not particularly modern.

Decades before the CCPA introduced concepts such as data minimization and purpose limitation into California's comprehensive privacy framework, Song-Beverly was already asking a simpler question at the cash register:

Why does the merchant need this information to process my payment?

The statute does not prohibit retailers from building customer relationships, operating loyalty programs, preventing fraud, delivering products, or collecting information for legitimate purposes.

But it places boundaries around using the credit-card transaction itself as the mechanism for collecting additional information from the consumer.

And because a seemingly innocuous request for a ZIP code or email address can potentially trigger class action litigation and statutory penalties across many transactions, this is one old California privacy law that businesses should not forget.

Additional Resources

Legal Authorities

• Song-Beverly Credit Card Act of 1971 | Cal. Civ. Code §§ 1747–1748.95 — Current codified provisions governing credit-card transactions in California, including restrictions on collecting personal identification information, receipt requirements, unauthorized use, billing errors, and other consumer protections.
• Cal. Civ. Code § 1747.08 — Key privacy provision restricting the requesting and recording of personal identification information in connection with credit-card transactions.
• Cal. Civ. Code § 1747.09 — Establishes California's requirements for truncating credit and debit card information on electronically printed receipts.

Key Cases

• Pineda v. Williams-Sonoma Stores, Inc., 51 Cal. 4th 524 (2011) — California Supreme Court decision holding that a customer's ZIP code constitutes “personal identification information” under § 1747.08.
• Apple Inc. v. Superior Court, 56 Cal. 4th 128 (2013) — California Supreme Court decision holding that § 1747.08 did not apply to the online purchase of electronically downloadable products at issue in the case.
• Archer v. United Rentals, Inc., 195 Cal. App. 4th 807 (2011) — Addresses the application of § 1747.08 to credit cards used for business purposes.
• Absher v. AutoZone, Inc., 164 Cal. App. 4th 332 (2008) — Holds that § 1747.08 does not apply in the same manner to information requested in connection with merchandise returns and refunds.
• Williams-Sonoma Song-Beverly Act Cases, 40 Cal. App. 5th 647 (2019) — Addresses when a request for personal information is sufficiently connected to a credit-card transaction, including whether a reasonable consumer would understand providing the information to be required to complete the transaction.

Regulatory & Technical Guidance

• PCI Security Standards Council — PCI DSS — Current Payment Card Industry Data Security Standard and related resources relevant to protecting and displaying payment-card information.

From The de la Torre Review

• California’s Financial Information Privacy Act (CalFIPA): A Practical Guide — Explains California’s financial privacy framework, including the sharing of nonpublic personal information, consumer opt-in and opt-out rights, statutory exceptions, FCRA preemption, vendor obligations, and enforcement.