Consumer Federation of California

It has become standard practice in the retail business for cashiers to request the ZIP code of customers paying with a credit card. But while most consumers readily supply this information, it isn’t required to check out. In fact, giving the impression it is required may be illegal.

At least that’s what one law firm is arguing in a class-action complaint filed against Urban Outfitters and its sister company, Anthropologie, in federal court late last month. The law firm, Perry Charnoff PLLC, claims that Urban Outfitters is in violation of two consumer protection laws by leading shoppers to believe that giving their ZIP code is required in order to complete a credit card purchase. Misleading shopping in such a way is illegal in Washington, D.C., where the lawsuit was filed.

According to the June 21 complaint, ZIP code information is allegedly being used to “secretly obtain customers’ home/business address” through commercially available databases, then sold or directly utilized for marketing.

“It’s a question of transparency,” said Scott Perry, an attorney at Perry Charnoff in Arlington, Va., who said the practice is illegally invading the privacy of young consumers and increasing the risk of identity fraud.

Urban Outfitters did not respond to multiple requests for comment.

While there are exceptions, such as gas station pumps, consumers are typically not required to give ZIP codes in stores to complete transactions. In recent years, retailers from Williams-Sonoma to Ikea have come under fire for collecting ZIP codes when customers pay with credit cards, especially as data companies grow more and more skilled at using those pieces of information to gather addresses, phone numbers, purchasing histories, and more, as Forbes reported last month. Outside of unwanted marketing, the practice could increase the risk of identity fraud, and it coincides with new concern around the government’s collection of personal data.

In some states, such as California, which has unusually stringent laws around customer privacy, ZIP code collection has spawned more than 50 class-action suits against retailers with settlements as high as $50 million, said Gene Stonebarger, a lawyer in the state who has prosecuted a number of such cases in the past 10 years. He’s involved in a separate action against Urban Outfitters and Anthropologie in the state.

“These laws are in place as a preventative measure to keep information out of the wrong hands,” Stonebarger said. “It’s on the forefront more now with what the NSA is doing as far as tracking people. This is not to the same level as monitoring phone calls and emails, but this is what businesses have been honing in on for years, and there is this huge industry in selling consumer information.”

Not everyone thinks the practice is done with devious intentions, however.

Mallory Duncan, general counsel at the National Retail Federation, a Washington-based trade group, argues that many merchants want ZIP code information simply to know where their customers are located. By knowing that customers are coming from a specific Georgetown neighborhood, for instance, retailers could decide to spend more ad dollars there or open a new location in the area. Retailers could also potentially combine ZIP codes with other information to locate a customer and send a catalog to them, Duncan said, noting that’s just one of the four most common actions.

But, according to Chris Hoofnagle, a lecturer on privacy law at the University of California at Berkeley’s School of Law, while consumer information can be gathered for one reason — such as determining where to open the next store — that doesn’t necessarily mean it can’t or won’t be used for another purpose, such as selling it to another party. Hoofnagle likened the situation to how technology companies like Facebook have faced criticism for collecting data without users’ consent.

“Once the data are collected, it’s impossible to restrain subsequent use,” Hoofnagle said.