Mark Hoofnagle has a MD and PhD in physiology from the University of Virginia, and is now a general surgery resident. His interest in denialism concerns the use of denialist tactics to confuse public understanding of scientific knowledge.
Consumers who have asked me whether they should give their zip code at the register have been getting bad advice! I was under the misimpression that zip-level data was only being collected for demographic research purposes (to determine where stores should be located, and advertising directed, on a mass scale) and thus said that no harm came from revealing the zip. No longer. Here's a summary of data practices at William Sonoma, according to a recent California case (Pineda v. Williams-Sonoma Stores Inc., Cal. Ct. App., 4th Dist., No. D054355). Giving the zip code allows the store to "enhance" the information they already have about your (your name from the credit card) and determine your home address:
Jessica Pineda visited a store in California owned by Williams-Sonoma Stores, Inc. (the Store) and selected an item to purchase. She then went to the cashier to pay for the item with her credit card. The cashier asked for her zip code, but did not tell her the consequences if she declined to provide the information. Believing that she was required to provide her zip code to complete the transaction, Pineda provided the information. The cashier recorded it into the electronic cash register and then completed the transaction. At the end of the transaction, the Store had Pineda's credit card number, name and zip code recorded in its databases.After acquiring this information, the Store used customized computer software to perform reverse searches from databases that contain millions of names, e-mail addresses, residential telephone numbers and residential addresses, and are indexed in a manner that resembles a reverse telephone book. The Store's software then matched Pineda's now-known name, zip code or other personal information with her previously unknown address, thereby giving the Store access to her name and address.
So, when they ask for your zip code, say no, or to have fun, give them the zip code of the White House: 20500.
Technology
Information Science
Comments
What's the harm in my grocery store knowing my address. Some extra coupons in the mail? I get the privacy issue. I'm no fan of all the ways companies are trying to find out stuff about us(google creeps me out the most). But if Ralph's knows where I live? I'm not gonna lose any sleep.
Posted by: T.Walt | October 31, 2009 12:37 PM
@T.Walt, the grocery store can resell that information to other database companies. Thus, the data about your purchases in one context can be used in other contexts.
Posted by: Chris H
| October 31, 2009 1:03 PM
I've been using 90210 for several years.
Posted by: Regis | October 31, 2009 1:25 PM
Wow. I always assumed it had to do with credit card verification, like automated payments at the gas station.
Posted by: Nathan | October 31, 2009 2:02 PM
@Nathan, I think you're hitting on an important point: info companies are always saying that they need personal data for security reasons; if they are using security justifications for collecting information later used for marketing, it could be problematic...
Posted by: Chris H
| October 31, 2009 2:30 PM
I can remember when it used to be standard practice to ask for your telephone number when you did a credit card transaction. Of course some merchants passed that number on to telemarketers (this was in the days before widespread Caller ID, let alone the Do Not Call list). People eventually got wise to that. I've also had people ask me for my zip code "for verification purposes", and it sounds like this is a similar scam, at least some of the time.
The catch is that sometimes the merchant really does need to know your address and zip code. If they are going to deliver or ship something to you, they need to know where you will receive the goods. Online merchants typically ask for your billing address, again for verification purposes (they also ask for a three-digit security code, just to make sure that you have the card in your physical possession), whether or not they are shipping something to you. But now that I think of it, there isn't much point in knowing the zip code without knowing the address. The name plus the zip code will uniquely specify most people, and many of the exceptions will be parent and child living at the same address.
Posted by: Eric Lund | October 31, 2009 3:07 PM
Ok.. Let me get this straight, you want to "protect" yourself by not giving out your zip code.. Well, I am sure if you live in NY, LA, or some other area with **huge** numbers of people, and **huge** numbers of codes, you might get some place doing that. I have 3 here in this town, I am the only person "in" the town with my name, and thus, all they would need to know is a) what the three local zip codes are, and b) my name. This bit of silly advice is pretty useless for me.
You want a *real* privacy issue. Some right wing loony site, recently babbling about the evils of Halloween, flat out states in their registration that a) they will delete stuff they don't like, like sane arguments, one has to assume, but that they track who, when, and what every single person posts (presumably even the deleted ones) and that while they promise not to use the information (Oh, sure.. I believe that..), they won't give a shit if someone hacks their site and steals all the data. Sounds to me like a set up for, "Oh, my! We got hacked! But I am sure the right wing Christian group Army of 12 Morons didn't do it, even though they just firebombed your house!", or some similar "accidental" coincidence between their data collection and some group of domestic religious terrorists...
Posted by: Kagehi | October 31, 2009 4:19 PM
My dad told me that when he got asked for a postal code he knew they didn't need, he'd give them the postal code of the place he worked. He worked at the mental hospital. ;)
Posted by: Sari Everna | October 31, 2009 8:24 PM
On behalf of all the cashiers out there, one favor please-don't lecture or get upset with us when we ask you for your zip code or phone number or for donations. Our bosses tell us what we have to ask, we don't like it any more than you do, so take it easy on us okay?
Posted by: Deb | November 1, 2009 2:00 AM
@Nathan, I think you're hitting on an important point: info companies are always saying that they need personal data for security reasons; if they are using security justifications for collecting information later used for marketing, it could be problematic...
Are there laws in the US that prevent data collected for one purpose being used for another ? Or preventing companies from passing on data to other companies within the same group, or to third parties ?
Posted by: Matt Penfold | November 1, 2009 5:51 AM
@Matt, in some contexts, yes. But the key here is that it would weaken their argument before regulatory bodies if security were being used as a pretext for marketing uses, and in some contexts, if for instance they said it was for security but really it was only for marketing, it could be a deceptive practice.
Posted by: Chris H. | November 1, 2009 10:00 AM
Whenever I am asked for my zip code I tell them 12345 (Schenectady, NY) and phone number is (911)555-1212.
Posted by: Sam | November 1, 2009 9:51 PM
Try zipcode 20505. It is the zip code all CIA FOIA requests go to.
Posted by: History Punk | November 2, 2009 2:43 PM
Wanna really blow them away? Use cash the next time.
Posted by: Mike McKee | November 2, 2009 3:48 PM
I give out fictious zip codes. Kagehi, if you want to screw with their automated lookup system, give out a zip code that is not near your house. I generally pick one that sounds plausible but isn't my own. Sometimes I've used the zip code of the city where I attended college.
I used to give out a fictitious street address as well, but few merchants ask for that anymore. I picked a real street, but increased the street number to where it would be in the middle of a river and/or wildlife sanctuary. :-P Phone number is always made up unless I think there's a legitimate reason for them to call me.
Posted by: Calli Arcale | November 2, 2009 11:20 PM
Sometimes to humor myself, I like to give a unique fake name. That way if the name turns up in my mail, etc, I know the source.
Also, I "live" at 123 East Main Street.
Posted by: rpsms | November 3, 2009 1:21 PM
Sometimes it's fun to be Canadian. My fake postal code is H0H 0H0, the North Pole.
Posted by: red rabbit | November 4, 2009 9:20 PM
I usually respond with a cheery "No, thank you!" Sometimes it takes a few seconds to sink in but it gets the point across, is non-confrontational, and occasionally amuses the clerk.
Posted by: Bob | November 4, 2009 9:33 PM
I always just assumed they wanted to know where customers came from in order to decide where to put future locations.
Posted by: Jon H | November 5, 2009 2:08 PM
This is interesting. Not that I don't believe you, but I have had incidents (when my zipcode changed without my address changing, without my knowledge!) in which I gave the incorrect zipcode and it caused problems. The credit card machine "bleepblorped" and the clerk was unable to run my card until I figured out the correct zipcode. Your thoughts on this?
Posted by: MD | November 9, 2009 1:36 AM
If I think there might be a legitimate reason for them to want my zip code, I ask why they're asking. (If they can't tell me, they don't need it for anything that benefits me.) If not, I give them either the code for the summer program I was in thirty years ago, or 02134, either of which I can recite off the top of my head.
Posted by: Vicki | November 10, 2009 4:46 PM
20510 and 20515 are the zips of the Senate and House.
I wonder what the zipcode is of the J. Edgar Hoover Building (FBI), or Langley (CIA)?
I wonder what is the zipcode of the Federal Trade Commission?
Posted by: Ed Darrell | November 10, 2009 5:44 PM
I always tell them "that won't be necessary" and when she persists, I say politely "that won't be necessary for this transaction."
Posted by: Arvin | November 11, 2009 12:18 AM
I'm evil, so I've given out 10048 as my zip code since late 2001.
Posted by: chancelikely | November 11, 2009 8:09 PM
"The credit card machine "bleepblorped" and the clerk was unable to run my card until I figured out the correct zipcode."
Some gas pumps require that you give your zip code in order to pay with a credit card. If you don't give a zip that matches your card's billing address, it's rejected.
Posted by: Jon H | November 18, 2009 10:37 PM