1

I would like to know how much personally identifying information (PII), or de-anonymizable information, merchants can collect, and how to avoid providing as much as possible.

Specifically, what kind of PII can an offline US merchant collect from the physical faces of a credit card, or from the magstripe or chip of a credit card, to use for marketing purposes or any other purpose beyond the immediate transaction? Is it common practice for merchants to scrape and store my name or other personal information by swiping the card, and use it later for other purposes?

And, what can I do as a consumer who is concerned about my privacy to limit the data that can be collected by the merchant?

NOTE re: PUT ON HOLD as Off-Topic... This question seems to fall squarely within the community guidelines on Spending Wisely, specifically the bullet point "Consumer issues or consumer protections". Reference to merchant agreement has been removed. Consumer privacy is a huge and growing issue, and consumers absolutely have a right to be informed about how various financial vehicles affect their privacy. Putting personal finance privacy questions outside of the community guidelines does a great disservice to consumers using this site.

closed as off-topic by quid, Nathan L, Victor, JoeTaxpayer Sep 28 '16 at 23:50

  • This question does not appear to be about Personal Finance within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • This will vary a lot by jurisdiction, and I don't know how it ties to personal finance, this feels like a question of legality to me... – quid Sep 28 '16 at 18:15
  • Questions about how credit cards work seem on-topic here. Legality will vary by jurisdiction but as it's asked now it seems mostly generic. – Joe Sep 28 '16 at 18:19
  • 3
    I'm voting to close this question as off-topic because the merchant side of credit card questions is not personal finance. – Nathan L Sep 28 '16 at 18:36
  • 2
    But the privacy of the billions of in-person credit card transactions is absolutely on-topic. I'll be happy to edit the question (or someone else can) to meet the PF criteria. – pseudon Sep 28 '16 at 18:37
  • 1
    @NathanL What merchants are able/allowed to do would still fall in personal finance, at least in my view. OP is not asking as a merchant, they are asking as a consumer (so, a person). – Joe Sep 28 '16 at 19:21
1

Zip code, as well as billing address, is used in conjunction with the Address Verification Service (AVS). AVS is a web (or phone) service that actually verifies the address with the billing address on file with the issuing bank. It does not use the credit card stripe. You can see more information from various sources such as bank merchant help pages like Bank of America's.

As far as what is stored on the stripe, it varies some by bank (as there are some "optional" areas). The standards are discussed here.

Fields include your account number, name, the expiration date, some card-specific stuff, and then the discretionary section. I would not expect much in terms of address type information there.

So - the answer to your question is that they can't really take much more than your name and CC #, unless you give it to them. If you give a false zip code, you may have your purchase rejected. They certainly do keep track of the credit card number, and I would suppose that is the most valuable piece to them; they can see you make purchases across time and know for a fact that it's the same exact person (since it's the same card).

Additionally, zip codes for AVS from pay-at-the-pump are supposedly not generally used for marketing (see this article for example). That is probably not true at at-the-register (in-person) collections, most of those aren't for AVS anyway. Even California permits the pay-at-the-pump zip verification as long as it's only used for that (same article). I would assume any information given, though, is collected for marketing purposes.

  • As far as I know, in the US, Zip Code is only used for credit card transaction verification at gas pu\mps. When a store asks, it's purely for marketing / data broker purposes. – pseudon Sep 28 '16 at 18:32
  • @pseudon That is largely true, but not exclusively. There are merchants who use AVS for in person transactions; just few. I would certainly assume it was for marketing purposes. – Joe Sep 28 '16 at 18:33
  • I would give a false zip code and wait to see if the transaction was denied. Then I'd call my card issuer rather than give out my real Zip. – pseudon Sep 28 '16 at 18:34
  • I simply decline to provide, of course, I've never had a merchant push back on that. – Joe Sep 28 '16 at 18:36
  • I prefer to give a false Zip as a defensive measurer, to add chaff to the wheat of the data that data brokers have. – pseudon Sep 28 '16 at 18:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.