The California Song-Beverly Credit Card Act of 1971 (the “Act”) has become the center of litigation in several recent privacy cases. The Act was created to protect consumers’ privacy in credit card transactions by limiting the information retailers can collect during purchases at a time when the concept of online purchases was not even a figment of the imagination.[1] The latest development in California privacy litigation began in May of this year when several complaints were filed, each alleging that online retailers unlawfully require consumers’ personal identification information in violation of the Act.
The Act restricts sellers from requesting and recording personally identifying information prior to or during a transaction. “[P]ersonal identification information” is defined as any information concerning the cardholder not set forth on the credit card itself, including, but not limited to, the address and telephone number.[2] In physical storefronts, it can be determined whether a seller violated the act simply by looking at the receipt. These recent complaints all attempt to apply the Act to online transactions for physical products, but it remains to be seen whether the plaintiffs will be successful based on established precedent that strongly suggests that Song-Beverly is inapplicable to online purchases.
In 2009, the federal trial court in the Central District of California examined the issue of applying the Act to internet transactions.[3] The court recognized the inherent differences between online and in-person transactions, particularly the need for additional personal information to verify the purchaser’s identity and prevent fraud. In brick-and-mortar stores, the physical presence of the credit card and the cardholder provides a layer of security that is absent online. Therefore, the court concluded that requiring online retailers to comply with the same restrictions as physical stores would undermine the security of online transactions. As a result, the court ruled that the Act does not apply to online transactions.
This reasoning was further reinforced in 2013 by the precedential Supreme Court of California decision, Apple Inc. v. Superior Court, which held that the Act’s prohibitions on requesting or requiring personal identification information do not apply to online purchases of electronically downloadable products.[4] The court examined the language of the Act which provides exceptions in order for sellers to complete a transaction, such as requiring shipping information or personal identification.[5] Further, the court acknowledged that for digital transactions, the risk of fraud is significantly higher, and therefore, additional information is necessary to confirm the purchaser’s identity. The California Supreme Court decision emphasized that the legislature could not foresee the complexities of online commerce when the Act was passed in 1971. The ruling underscored that extending the Act’s provisions to online transactions would disrupt the balance between consumer privacy and fraud prevention.
Following Apple, a California appellate court decision provided further clarification in the 2015 case, Ambers v. Beverages & More, Inc. (“BevMo”).[6] The court of appeal considered whether the Act applied to an online transaction involving the sale of alcoholic beverages. The court acknowledged that the Apple decision was not controlling, as it was limited to electronically downloadable products, but held that the California Supreme Court’s analysis applied to the BevMo transaction with equal force.[7] The opinion focused on the regulatory and safety considerations involved in online transactions that are not present in physical retail environments, noting that enforcing the Act in such contexts would impede legitimate business practices designed to comply with other legal obligations.
Shortly after the BevMo case, the Ninth Circuit Court of Appeals reinforced the notion that the Act does not extend to online transactions in Ambers v. Buy.com, Inc.[8] The federal court referenced the previous decisions, particularly Apple Inc. v. Superior Court, affirming that online retailers need to gather more information than their brick-and-mortar counterparts in order to effectively mitigate risks of fraud. Ultimately, by applying the reasoning used in Apple to determine downloadable products were outside the scope of the Act, the court held that physical products for delivery are beyond the Act’s ambit as well. The court reiterated the importance of interpreting the Act within the context of its original legislative intent, which did not anticipate the world of e-commerce. As a result, the court held applying the Act’s restrictions to online transactions would be inconsistent with its purpose and the practical realities of digital commerce.
Even if a California court were to ignore federal court decisions, the Apple decision, although limited to downloadable products, seems to swallow up any room for the Act to apply to any online transaction. If the Supreme Court of California takes the position that Song-Beverly doesn’t apply in a downloadable online purchase, where the retailer clearly does not need to collect shipping information, what possible set of facts could lead a reasonable Court to believe that a “shippable” product that is purchased online would be covered by Song-Beverly. That conclusion appears to be nonsensical and against basic logical analysis of The Supreme Court of California’s reasoning. In other words, although Apple’s holding is limited in scope to downloadable products, a retailer that exclusively sells products online that must be shipped to the customer would necessarily seem to be beyond the reach of the Act.
Collectively, these decisions portend a judicial consensus that the Song-Beverly Credit Card Act does not apply to online transactions in general. The courts have consistently recognized the unique challenges posed by online commerce, particularly concerning fraud prevention and the verification of consumer identities. Further, particularly for online retailers who ship their products, it would seem almost impossible to gather the necessary information to ship the product that was purchased without violating the Act. Consequently, the likelihood of the plaintiffs finding success in applying the Act to online transactions appears to be minimal. The previous rulings illustrate an understanding that extending the Act’s provisions to online transactions would not only be impractical but also counterproductive, as it would compromise the security measures necessary to protect both consumers and retailers in the digital marketplace.
That being said, frivolous or not, online retailers should be aware of the litigation risk landscape that is ever-changing with inventive Plaintiff’s attorneys attempts to reshape decade’s old laws into lucrative class action vehicles. Certain steps can be implemented to reduce the exposure to the suits. Until courts in California definitively extinguish the liability, Song-Beverly may still wreak havoc for online retailers in the meantime.
For assistance with complying with the Song-Beverly Act or other privacy related law, please contact James K. Paulick.
Jim is Counsel with Leech Tishman and a member of the Corporate Group, where he leads the Data Privacy & Cybersecurity Group
Molly K. Bleech, JD Candidate 2025, University of Pittsburgh School of Law, contributed to the research and drafting of this article.
[1] Cal. Civ. Code § 1747.08
[2] Cal. Civ. Code § 1747.08(b)
[3] Saulic v. Symantec Corp., 596 F. Supp. 2d 1323 (C.D. Cal. 2009).
[4] Apple Inc. v. Superior Court, 56 Cal. 4th 128, 151(2013).
[5] Cal. Civ. Code § 1747.08(c)-(d)
[6] Ambers v. Beverages & More, Inc., 236 Cal.App.4th 508 (2015).
[7] Id at 515.
[8] Ambers v. Buy.com, Inc., 617 F. App’x 728 (9th Cir. 2015).