I was recently on vacation with my family. Every time I stopped for gas, or when I bought groceries at an out-of-state grocery store, the card processing unit prompted me to enter my ZIP code to complete the transaction. Was this practice illegal? Broadly speaking, no. The card I was using was my American Express card. American Express uses a card’s billing ZIP code as part of its comprehensive anti-fraud efforts. Moreover, American Express does not use the collected ZIP code information for marketing purposes, and such information is not retained by the retailer.

Generally, what makes the collection of ZIP code information at the time of a credit card transaction legal versus illegal relates to the purpose for collection. Anti-fraud efforts, without retention of the ZIP code or use of it for marketing purposes, are generally considered to be legal everywhere. However, in a growing number of states, collection of the ZIP code, when such information is used, retained or sold for marketing purposes, is illegal.

California, as it does on so many issues for good or for ill, led the way. Now, as noted in a piece by my good friend Andrew Kennedy in Litigation News, Massachusetts has joined the fray. In a recent decision on a certified decision from the District Court, the Supreme Judicial Court of Massachusetts held that ZIP codes are private, and that the collection of ZIP codes by retailer at the time of transaction violates Massachusetts’ consumer protection laws.

The Supreme Judicial Court concluded that ZIP codes are private information protected by the Massachusetts statute. It agreed with the District Court that the mere collection of a ZIP code was not a violation of the statute. However, even if the collection of the code did not lead to monetary damages or identity theft, a consumer could show an injury in one of two ways. First, if the consumer received unwanted promotional or advertising materials. Second, if the retailer sold the information to others. In either case, the consumer would be entitled to statutory minimum damages of $25. After return to the District Court, the case was consolidated with another and proceeded as a class action.

As the Litigation News article notes, there is a wide divergence of opinion as to how much litigation will ensue from this Massachusetts decision, in part because state consumer protection laws vary. Nonetheless, it is highly likely that class action lawyers will attempt to expand the beachheads they have established in California and Massachusetts. Given that such suits are costly to defend, a careful review of your system’s ZIP code collection practices and policies, in conjunction with applicable state consumer protection laws, is in order.