One of the more active areas of privacy-related litigation concerns Zone Improvement Plan codes, or “ZIP codes,” in use since 1963. Plaintiffs’ lawyers have filed a spate of actions alleging that merchants which ask customers to provide their ZIP codes when paying with a credit card violate state statutes designed to protect personal identification information. So far these lawsuits have been concentrated in California and Massachusetts where favorable precedent exists, but in June of this year the first such putative class action was filed in the District of Columbia against retailers Urban Outfitters, Inc. and Anthropologie, Inc. This test case could expand substantially privacy class action exposure for merchants in the District of Columbia. More broadly, the case has important implications for whether ZIP code litigation will spread to other jurisdictions with similar laws or is already near its high water mark
In their complaint, plaintiffs Whitney Hancock and Jamie White (“Plaintiffs”) allege that they each bought various items from Urban Outfitters and Anthropologie (collectively “Defendants”) using a credit card. During each purchase, Plaintiffs claim, the cashier swiped the card using a “credit-card-swipe machine” and then asked for a ZIP code. They provided their ZIP codes, which the cashier entered into the “point-of-sale register, not into the credit-card swipe machine.” Plaintiffs further allege that Defendants ask for and collect ZIP codes so they can obtain a customer’s address for their own commercial benefit. Plaintiffs cite an article from Forbes.com that explains that a retailer can use programs to match a customer’s ZIP code and name to a consumer database that provides a corresponding address. Plaintiffs, however, do not specifically allege that they received direct mailings or other marketing materials after they gave Defendants their ZIP codes.
But there are differences between the District of Columbia statute and the laws at issue in Pineda and Tyler, which Defendants emphasize distinguish these cases beyond jurisdictional difference. For example, whereas the California and Massachusetts statutes state that the definition of personal identification information includes but is “not limited to” the cardholder’s address and telephone number, § 47-3153 contains no such open-ended language. A retailer is only prohibited from requesting or recording “the address or telephone number” of a cardholder. Not surprisingly, Plaintiffs respond that a narrow, literal reading of § 47-3153 would eviscerate the statute just as much as the restrictive interpretations rejected in Pineda and Tyler, decisions that did not necessarily rely on the “not limited to” language to find that ZIP codes fell within the purview of the statutes.
If Plaintiffs are able to persuade the court that ZIP codes constitute consumer identification information under § 47-3153, which retailers cannot request or record in conjunction with a credit card transaction, there is still the question of injury. As Defendants point out Plaintiffs must still establish Article III standing to prosecute their action in federal court. They must allege an injury in fact that is concrete and actual or imminent, not conjectural or hypothetical, and fairly traceable to Defendants’ conduct. Moreover, only persons “aggrieved” by violations of § 47-3153 can maintain a cause of action under the District of Columbia’s law.