A recent California Supreme Court ruling in Jessica Pineda v. Williams-Sonoma, may spell disaster for companies that ask, "What's your ZIP code?" and then use that information to market to you.

Further, it could potential lead to suits against those that simply ask the question, regardless of whether they use that information for marketing purposes. The Song-Beverly Credit Card Act of 1971, prohibits companies from recording any “personal identification information” without the customer’s prior knowledge.

The Court held that after obtaining the Plaintiff's ZIP code, Williams Sonoma “used customized computer software to perform reverse searches from databases that contain millions of names, e-mail addresses, telephone numbers, and street addresses, and that are indexed in a manner resembling a reverse telephone book. The software matched plaintiff’s name and Zip code with plaintiff’s previously undisclosed address, giving defendant the information, which it now maintains in its own database. Defendant uses its database to market products to customers and may also sell the information it has compiled to other businesses.”

Although the penalty for such a breach could cost Williams Sonoma up to $1,000 per violation, the Court stated that the statute "does not mandate fixed penalties; rather, it sets maximum penalties of $250 for the first violation and $1,000 for each subsequent violation."

While this means the lower courts are not required to reach the maximum penalty, it does leave the ultimate penalty in the hands of judges and juries that may despise such marketing activities. It appears that based on this case, several class action lawsuits have been filed against major retailers including Target, Macy’s, Nordstrom, and others.

For small retailers that collect such information for innocent purpose, this case could lead to shakedown style lawsuits that California struggled with in the past.