Redbox Automated Retail, LLC (“Redbox”), provider of the popular self-service kiosks that rent movies and video games in airports and other locations, received confirmation last month from the Ninth Circuit Court of Appeals that it can continue requiring customers to provide their ZIP codes to rent discs without violating California’s Song-Beverly Credit Card Act. Sinibaldi v. Redbox Automated Retail, LLC, 2014 U.S. App. LEXIS 10556 (9th Cir. June 6, 2014).
California’s Song-Beverly Credit Card Act (Cal. Civ. Code §§ 1747 et seq.) prohibits retailers from collecting personal identification information, such as telephone numbers, addresses, and ZIP codes, in connection with credit card transactions. See Cal. Civ. Code § 1747.08; Pineda v. Williams-Sonoma Stores, Inc., 51 Cal. 4th 524, 531 (2011). The California legislature enacted the Act primarily to protect the privacy of consumers. Exceptions to this prohibition include when the credit card is being used as a deposit to secure payment in the event of “default, loss, damage, or other similar occurrence.” Cal. Civ. Code § 1747.08(c)(1).
To rent a movie or video game at a Redbox kiosk, the customer uses a touch screen to select the disc of choice. At check-out, the customer is prompted to swipe a credit or debit card and enter a ZIP code. Most rentals cost $1 per day, and a $1 fee is charged at the time of the rental. If the customer keeps the disc for longer than one day, the customer’s credit card is charged for additional days beyond the initial one-day period. These additional charges are processed automatically from the credit card information on file.
Plaintiffs filed a putative class action suit alleging that Redbox violates the Song-Beverly Credit Card Act because the customer’s transaction will clear even if a random string of 5 digits is entered. Plaintiffs argued that Redbox must therefore be collecting ZIP codes solely for marketing purposes, not security. The district court granted Redbox’s 12(b)(6) motion and dismissed the case, holding that the Act did not apply to Redbox’s unmanned kiosks in light of the potential for fraud in such transactions.
The Ninth Circuit affirmed on a different ground, holding that the statute’s rental deposit exception applied. Rejecting Plaintiffs’ narrow definition of “deposit” and the dissent’s characterization of how Redbox charges its customers’ credit cards, the majority held that Redbox keeps its customers’ credit card information as part of a deposit to secure payment in the event of loss or late return. Thus, Redbox’s requirement that customers provide a ZIP code fell within the exception permitting the collection of such information when a credit card is used as a deposit to secure payment.