Consumer Federation of California

How much does an online retailer need to know about you when you purchase something downloaded to your computer or smartphone?

The answer, says state Sen. Hannah-Beth Jackson, D-Santa Barbara, is only the basic information that credit card processors use to verify the authenticity of a credit card — the customer’s ZIP code and the numerical portion of his or her street address.

And even then, she believes, the retailer ought to be prohibited from using that information for any purpose other than fraud protection and be required to destroy it later.

A bill by Jackson to implement those conditions on Apple and other sellers of downloadable music, movies, books, ring tones and assorted products was approved this week by the Senate Judiciary Committee. It had strong backing from consumer protection and privacy groups, but was opposed by the California Retailers Association and organizations representing technology companies.

"Move with due care," lobbyist Robert Callahan of the Technology Association of America cautioned the committee. "The consequences of getting this wrong are enormous. We’re talking about a very different world of commerce. For better or worse, online commerce is subject to fraud activity."

Jackson said she is seeking "a balancing act" to protect both consumers and online retailers against fraud while also holding merchants to the same standards that have for 40 years applied to brick-and-mortar retailers.

The state’s 1971 Song Beverly Credit Act allowed merchants to ask for a photo ID from customers using credit cards, but prohibited them from recording any of the personal information on that ID card.

In a 4-3 ruling earlier this year, the state Supreme Court sided with Apple in a case involving a purchase from its iTunes store. It held that the law "does not apply to online purchases in which the product is downloaded electronically."

Richard Holober, executive director of the Consumer Federation of California, testified that the Legislature needs to respond to the court’s invitation to review whether the law ought to amended to respond to a marketplace that did not exist when it was written.

"Right now, there are no restrictions on certain online merchants," he said. "There is no restriction on collecting data for any purpose."

The Consumer Federation is the sponsor of Jackson’s Senate Bill 383.

In a letter to the committee, Jackson wrote that online merchants are now "free to use information about cardholders to build customer profiles, and use this information for marketing or for sale to third parties who may use this information for any purpose."

That, she wrote, raises significant privacy concerns because "a consumer’s choice in downloadable products may reveal intimate details about a consumer’s interests, among those a consumer’s medical interests, sexual orientation, investments, financial status, dating interests, political views and other forms of confidential information."

Although Jackson said her bill is intended to target only those online retailers that sell downloadable targets, Callahan said it could be interpreted to apply to all online retailers — including those that are required under federal law to obtain an email address to notify customers when their orders have been shipped.

Jackson pledged to work with opponents to make certain the intent of the bill is clear.

The panel approved the bill on 5-1 vote.

The dissenter, Sen. Joel Anderson, R-Alpine, said it is important to allow retailers to collect as much information as they need to guard against fraud.

"I want to be able to give enough information to confirm that my credit card actually belongs to me," he said.

Current law allows brick-and-mortar retailers to collect personal information from credit-card purchasers that relates to shipping, delivery, servicing or installation of merchandise they bought. There also is a special exception for gasoline stations, at which electronically controlled pumps can require credit-card purchasers to enter their ZIP codes before authorizing the purchase.

The bill advances to the Senate floor.