1747.08.
(a) Except as provided in subdivision (c), no a person, firm, partnership, association, or corporation that accepts credit cards for the transaction of business shall not do any of the following:(1) Request, or require as a condition to accepting the credit card as payment in full or in part for goods or services, the cardholder to write any personal identification information upon the credit card transaction form or otherwise.
(2) Request, or require as a condition to accepting the credit card as payment in full or in part for goods or services, the cardholder to provide personal identification information, which the person, firm, partnership, association, or corporation accepting the credit card writes, causes to be written, or otherwise records upon the credit card transaction form or otherwise.
(3) Utilize, in any credit card transaction, a credit card form which that contains preprinted spaces specifically designated for filling in any personal identification information of the cardholder.
(b) For purposes of this section section, “personal identification information,” information” means information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number.
(c) Subdivision (a) does not apply in the following instances:
(1) If the credit card is being used as a deposit to secure payment in the event of default, loss, damage, or other similar occurrence.
(2) Cash advance transactions.
(3) If any of the following applies:
(A) The person, firm, partnership, association, or corporation accepting the credit card is contractually obligated to provide personal identification information in order to complete the credit card transaction.
(B) The person, firm, partnership, association, or corporation accepting the credit card in a sales transaction at a retail motor fuel dispenser or retail motor fuel payment island automated cashier uses the Zip ZIP Code information solely for prevention of fraud, theft, or identity theft.
(C) The person, firm, partnership, association, or corporation accepting the credit card is obligated to collect and record the personal identification information by federal or state law or regulation.
(4) If personal identification information is required for a special purpose incidental but related to the individual credit card transaction, including, but not limited to, information relating to shipping, delivery, servicing, or installation of the purchased merchandise, or for special orders.
(d) (1) This section does not prohibit any person, firm, partnership, association, or corporation from requiring the cardholder, as a condition to accepting the credit card as payment in full or in part part, for goods or services, to provide reasonable forms of positive identification, which may include a driver’s license or a California state identification card, or where one of these is not available, another form of photo identification, provided that none of the information contained thereon is written or recorded on the credit card transaction form or otherwise. If the cardholder pays for the transaction with a credit card number and does not make the credit card available upon request to verify the number, the cardholder’s driver’s license number or identification card number may be recorded on the credit card transaction form or otherwise.
(2) Notwithstanding subdivision (a), a person, firm, partnership, association, or corporation accepting the credit card may require a cardholder, as a condition to accepting a credit card as payment in full or in part, in an online transaction involving an electronic downloadable product, to provide personal identification information, if it requires that information for the detection, investigation, or prevention of fraud, theft, identity theft, or criminal activity, or for enforcement of terms of sale, and the personal identification information is used solely for those purposes. The person, firm, partnership, association, or corporation accepting the credit card shall destroy or dispose of the personal identification information it requires pursuant to this subdivision in a secure manner after it is no longer needed for the purposes authorized under this paragraph. The person, firm, partnership, association, or corporation accepting the credit card shall not aggregate the personal identification information it requires pursuant to this subdivision with any other personal identification information and shall not share the personal identification information it requires pursuant to this subdivision with any other person, firm, partnership, association, or corporation unless it is required to do so by state or federal law, or is contractually obligated to share the information with another entity to verify the information, complete the transaction, or for the detection, investigation, or prevention of fraud, theft, identity theft, or criminal activity, or for enforcement of terms of sale.
(3) (A) Notwithstanding subdivision (a), a person, firm, partnership, association, or corporation that provides an electronic downloadable product may require a consumer to establish an account as a condition for the purchase of an electronic downloadable product and may require a consumer to provide personally identifiable information to establish, maintain, or update that account. Except as provided in subparagraph (B), the personal identification information collected pursuant to this subdivision may only be used for the establishment, maintenance, or updating of the account, or to process a credit card transaction.
(B) (i) Concurrent with completing a transaction for an electronically downloadable product, or when establishing an account pursuant to subparagraph (A), a cardholder may elect to provide personally identifiable information by opting in to the collection and use of that information if he or she is contemporaneously notified of the following:
(I) That providing the information is not required to complete the transaction.
(II) The purpose of the request.
(III) The intended use of the information.
(ii) A cardholder shall be provided with an opportunity to opt out of the collection of the information before the online transaction involving an electronic downloadable product is completed.
(e) Any person who violates this section shall be subject to a civil penalty not to exceed two hundred fifty dollars ($250) for the first violation and one thousand dollars ($1,000) for each subsequent violation, to be assessed and collected in a civil action brought by the person paying with a credit card, by the Attorney General, or by the district attorney or city attorney of the county or city in which the violation occurred. However, no civil penalty shall be assessed for a violation of this section if the defendant shows by a preponderance of the evidence that the violation was not intentional and resulted from a bona fide error made notwithstanding the defendant’s maintenance of procedures reasonably adopted to avoid that error. When collected, the civil penalty shall be payable, as appropriate, to the person paying with a credit card who brought the action, or to the general fund of whichever governmental entity brought the action to assess the civil penalty.
(f) The Attorney General, or any district attorney or city attorney within his or her respective jurisdiction, may bring an action in the superior court in the name of the people of the State of California to enjoin violation of subdivision (a) and, upon notice to the defendant of not less than five days, to temporarily restrain and enjoin the violation. If it appears to the satisfaction of the court that the defendant has, in fact, violated subdivision (a), the court may issue an injunction restraining further violations, without requiring proof that any person has been damaged by the violation. In these proceedings, if the court finds that the defendant has violated subdivision (a), the court may direct the defendant to pay any or all costs incurred by the Attorney General, district attorney, or city attorney in seeking or obtaining injunctive relief pursuant to this subdivision.
(g) Actions for collection of civil penalties under subdivision (e) and for injunctive relief under subdivision (f) may be consolidated.
(h) The changes made to this section by Chapter 458 of the Statutes of 1995 apply only to credit card transactions entered into on and after January 1, 1996. Nothing in those changes shall be construed to affect any civil action which that was filed before January 1, 1996.