The Dark Cloud Over Nordstrom’s Black Friday: California Law May Prohibit Retailers from Collecting Email Addresses at Checkout
Written by Jake Romero, CIPP/US
This past weekend if you survived the towel aisle and other Black Friday dangers and made it to the register to purchase your items, it is possible you were asked to provide an email address so that your receipt could be emailed to you. This type of request is the focus of a class action lawsuit brought against Nordstrom, Inc., where plaintiff Robert Capp alleges that Nordstrom violated California’s Song-Beverly Credit Card Act by requesting his email address at the time of purchase and subsequently using it to send Capp unsolicited marketing materials. The U.S. District Court for the Eastern District of California denied Nordstrom’s motion to dismiss Capp’s complaint, concluding that the California Supreme Court would likely hold that email addresses constitute “personal identification information” under the Song-Beverly Act, which prohibits retailers from requiring personal identification information as a condition to accepting credit card payments. Therefore under the Court’s analysis, retailers like Nordstrom are prohibited from collecting email addresses in connection with the completion of credit card transactions.
Nordstrom made two primary arguments in favor of its motion to dismiss. First, Nordstrom argued that email addresses do not fit within the definition of “personal identification information” under the Song-Beverly Act. Second, Nordstrom argued that to the extent that email addresses are personal identification information, the Song-Beverly Act is preempted by the federal Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (“CAN-SPAM Act”). The Court disagreed on both counts.
The Song-Beverly Act defines “personal identification information” as “information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number.” The issue of what type of information is included in this definition was also at issue in 2011, when the California Supreme Court, in Pineda v. Williams-Sonoma, held that it should include cardholder zip codes, thereby making it illegal for retailers to request zip codes from customers paying by credit card. Nordstrom argued that email addresses are distinguishable from the zip codes in Pineda because email addresses are chosen arbitrarily by the owner, can be anonymous and can be changed easily. Nordstrom also argued that email addresses “cannot be used to call consumers during dinnertime or to show up on their doorstep in the middle of the night . . . in the way that a home address or phone number can be abused.” The
Court reasoned, however, that emails permit direct contact with individuals and therefore implicate the privacy interests of cardholders. In addition, the Court referenced exhibits provided by the plaintiff showing that email addresses can be used to gather additional personal information about the consumer which retailers would otherwise be prohibited from collecting directly. The Court also held that the overriding purpose of the Act to protect the personal privacy of consumers supports the Court’s broad interpretation.
Nordstrom argued that since the passage of the Song-Beverly Act predates the application of email and e-receipts to consumer transactions, the legislature could not have intended to include email addresses as “personal identification information.” In support of this argument, Nordstrom cited the California Supreme Court’s decision in Apple, Inc. v. Superior Court, in which the Supreme Court held that the Song-Beverly Act does not apply to online purchases of downloadable music. However, the Court rejected this argument as Nordstrom misreading the Supreme Court’s holding in Apple, and clarified that the basis for the Supreme Court’s ruling was the unavailability of safeguards against fraud in online transactions, not unforeseeable nature of online transaction technology.
Finally, the Court also held that the CAN-SPAM Act does not preempt the application of the Song-Beverly Act to email addresses because, although the CAN-SPAM Act preempts state laws that expressly regulate the use of email to send electronic messages, the Song Beverly Act only regulates the request for email addresses, rather than the use of email addresses or the content of emails. The court also reasoned that it was possible for retailers to comply with the requirements of both the CAN-SPAM Act and the Song-Beverly Act, and that application of the Song-Beverly Act to email addresses furthers the goals of the CAN-SPAM Act to reduce the volume of unsolicited, unwanted email addresses.
We are continuing to monitor this case for further developments. In the meantime, retailers should review their processes for completing customer credit card transactions, especially as they pertain to requesting or obtaining information from customers, as this ruling will likely trigger a number of similar suits. The collection of email addresses in connection with retail purchases should cease unless the collection falls within one of the Song-Beverly Act’s exceptions.
Author
