Opinion
LIU, J. The Song-Beverly Credit Card Act of 1971 (Credit Card Act) governs the issuance and use of credit cards. (Civ. Code, § 1747 et seq.; all further statutory references are to the Civil Code unless otherwise indicated.) One of its provisions, section 1747.08, prohibits retailers from “[r]equest[ing], or requiring] as a condition to accepting the credit card as payment . . . , the cardholder to write any personal identification information upon the credit card transaction form or otherwise.” (§ 1747.08, subd. (a) (hereafter section [133174]7.08(a)).) It also prohibits retailers from requesting or requiring the cardholder “to provide personal identification information, which the [retailer] . . . writes, causes to be written, or otherwise records upon the credit card transaction form or otherwise,” and from “[u]tiliz[ing] ... a credit card form which contains preprinted spaces specifically designed for filling in any personal identification information of the cardholder.” (Ibid.) In Pineda v. Williams-Sonoma Stores, Inc. (2011) 51 Cal.4th 524 [120 Cal.Rptr.3d 531, 246 P.3d 612] (Pineda), we considered whether section 1747.08 is violated when a retailer requests and records a customer’s ZIP code during a credit card transaction. Relying on the statute’s language, legislative history, and purpose, we concluded that a ZIP code constitutes “ ‘personal identification information’ ” within the meaning of the statute and that the Credit Card Act forbids a retailer from requesting or recording such information. (Pineda, at pp. 527-528.)
Like Pineda, this case involves an asserted violation of section 1747.08. David Krescent, the plaintiff in this case, alleged in his complaint that defendant Apple Inc. requested or required him to provide his address and telephone number as a condition of accepting his credit card as payment. However, unlike Pineda, which concerned the purchase of a physical product at a traditional “brick-and-mortar” business, this case concerns the purchase of an electronic download via the Internet. We must resolve whether section 1747.08 prohibits an online retailer from requesting or requiring personal identification information from a customer as a condition to accepting a credit card as payment for an electronically downloadable product. Upon careful consideration of the statute’s text, structure, and purpose, we hold that section 1747.08 does not apply to online purchases in which the product is downloaded electronically.
Our dissenting colleagues warn that today’s decision “relegate[s] to the dust heap” the “ ‘robust’ consumer protection ... at the heart of section 1747.08” (dis. opn. of Kennard, J., post, at p. 154, citation omitted) and represents a “major loss for consumers” (id. at p. 151) that “leaves online retailers free to collect and use the personal identification information of credit card users as they wish” (dis. opn. of Baxter, J., post, at p. 156). These ominous assertions, though eye-catching, do not withstand scrutiny. As we explain, existing state and federal laws provide consumers with a degree of protection against unwanted use or disclosure of personal identification information. The Legislature may believe these measures are inadequate and, if so, may enact additional protections. Or the Legislature may believe that existing laws, together with market forces reflecting consumer preferences, are sufficient. It is not our role to opine on this important policy issue. We merely hold that section 1747.08 does not govern online purchases of electronically downloadable products because this type of transaction does not fit within the statutory scheme.
[134]I.
Because this case comes to us following summary denial of a writ of mandate after the denial of a demurrer, we assume as true all facts alleged in the operative complaint. (Sheehan v. San Francisco 49ers, Ltd. (2009) 45 Cal.4th 992, 996 [89 Cal.Rptr.3d 594, 201 P.3d 472].) Petitioner Apple Inc. (Apple), defendant below, operates an Internet Web site and an online iTunes store through which it sells digital media such as downloadable audio and video files. In June 2011, plaintiff below, David Krescent, sued Apple on behalf of himself and a putative class of similarly situated individuals for alleged violations of section 1747.08. Specifically, Krescent alleged that he purchased media downloads from Apple on various occasions and that, as a condition of receiving these downloads, he was required to provide his telephone number and address in order to complete his credit card purchase. He further alleged that Apple records each customer’s personal information, is not contractually or legally obligated to collect a customer’s telephone number or address in order to complete the credit card transaction, and does not require a customer’s telephone number or address for any special purpose incidental but related to the individual credit card transaction, such as shipping or delivery. Although he alleged that “the credit card transaction would be permitted to proceed” without any personal identification information, Krescent also contended that “even if the credit card processing company or companies required a valid billing address and [credit card identification number], under no circumstance would [plaintiff’s] telephone number be required to complete his transaction, that is, under no circumstance does [Apple] need [plaintiff’s] phone number in order to complete a [media] download transaction.”
In September 2011, Apple filed a demurrer, arguing that the Credit Card Act does not apply to online transactions and that deciding otherwise would undermine the prevention of identity theft and fraud. After a hearing, the trial court overruled the demurrer. The court noted that “the Act itself is silent on exempting online credit card transactions from its purview (and otherwise does not address online credit card transactions specifically).” While acknowledging that Apple’s “assertions with respect to preventing fraud have definite appeal (a problem which the Court acknowledges is widespread in credit transactions generally, and in online credit card transactions specifically),” the trial court said it “is not prepared, at the pleading stage, to read the [Credit Card] Act as completely exempting online credit transactions from its reach.” The court also found, pursuant to Code of Civil Procedure section 166.1, that appellate resolution of the issue might materially assist the resolution of the litigation.
Apple filed a petition for writ of mandate seeking review of the trial court’s order, which the Court of Appeal summarily denied. We granted [135]Apple’s petition for review and ordered the trial court to show cause why the relief sought in the petition for writ of mandate should not be granted.
n.
We review de novo questions of statutory construction. In doing so, “ ‘our fundamental task is “to ascertain the intent of the lawmakers so as to effectuate the purpose of the statute.” ’ ” (Mays v. City of Los Angeles (2008) 43 Cal.4th 313, 321 [74 Cal.Rptr.3d 891, 180 P.3d 935].) As always, we start with the language of the statute, “giv[ing] the words their usual and ordinary meaning [citation], while construing them in light of the statute as a whole and the statute’s purpose [citation].” (Pineda, supra, 51 Cal.4th at pp. 529-530.)
A.
We begin with the text of the statute. Section 1747.08(a) provides: “Except as provided in subdivision (c), no person, firm, partnership, association, or corporation that accepts credit cards for the transaction of business shall do any of the following: [][] (1) Request, or require as a condition to accepting the credit card as payment in full or in part for goods or services, the cardholder to write any personal identification information upon the credit card transaction form or otherwise. [][] (2) Request, or require as a condition to accepting the credit card as payment in full or in part for goods or services, the cardholder to provide personal identification information, which the person, firm, partnership, association, or corporation accepting the credit card writes, causes to be written, or otherwise records upon the credit card transaction form or otherwise, [f] (3) Utilize, in any credit card transaction, a credit card form which contains preprinted spaces specifically designated for filling in any personal identification information of the cardholder.” Section 1747.08, subdivision (b) (hereafter section 1747.08(b)) defines “ ‘personal identification information’ ” as “information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number.”
The prohibitions codified in section 1747.08(a) are subject to various exceptions set forth in section 1747.08, subdivision (c) (hereafter section 1747.08(c)). Subdivision (c) provides that the requirements of subdivision (a) do not apply to “[c]ash advance transactions” or “[i]f the credit card is being used as a deposit to secure payment in the event of default ... or other similar occurrence.” (§ 1747.08(c)(1), (2).) Nor do the requirements of subdivision (a) apply if the person, firm, partnership, association, or corporation accepting the credit card “is contractually obligated to provide personal identification information in order to complete the credit card transaction”; [136]“uses the Zip Code information solely for prevention of fraud, theft, or identity theft” in a “sales transaction at a retail motor fuel dispenser or retail motor fuel payment island automated cashier”; or “is obligated to collect and record the personal identification information by federal or state law or regulation.” (§ 1747.08(c)(3)(A)-(C).) Personal identification information may also be collected if it “is required for a special purpose incidental but related to the individual credit card transaction, including, but not limited to, information relating to shipping, delivery, servicing, or installation of the purchased merchandise, or for special orders.” (§ 1747.08(c)(4).)
Finally, section 1747.08, subdivision (d) (hereafter section 1747.08(d)) provides the following general qualification to the statute’s requirements: “This section does not prohibit any person, firm, partnership, association, or corporation from requiring the cardholder, as a condition to accepting the credit card as payment in full or in part for goods or services, to provide reasonable forms of positive identification, which may include a driver’s license or a California state identification card, or where one of these is not available, another form of photo identification, provided that none of the information contained thereon is written or recorded on the credit card transaction form or otherwise. If the cardholder pays for the transaction with a credit card number and does not make the credit card available upon request to verify the number, the cardholder’s driver’s license number or identification card number may be recorded on the credit card transaction form or otherwise.”
At the outset, we observe that the text of section 1747.08 makes no reference to online transactions or the Internet. This is not surprising because former section 1747.8, section 1747.08’s predecessor, was enacted in 1990 (Stats. 1990, ch. 999, § 1, p. 4191), before the privatization of the Internet (see Frischmann, Privatization and Commercialization of the Internet Infrastructure: Rethinking Market Intervention into Government and Government Intervention into the Market (2001) 2 Colum. Sci. & Tech. L.Rev. 1, 20) and almost a decade before online commercial transactions became widespread (see, e.g., McDonough v. Toys “R” Us, Inc. (E.D.Pa. 2009) 638 F.Supp.2d 461, 468).
Although section 1747.08 does not explicitly reference online transactions, both parties maintain that the Legislature’s intent is apparent from the plain meaning of the statute’s terms. Krescent contends that the language of section 1747.08(a) “must be read as an all-inclusive prohibition on every businesses [sic] regardless of the form of the transaction.” According to Krescent, in directing the statutory prohibition at any “person, firm, partnership, association, or corporation that accepts credit cards for the transaction of business” [137](§ 1747.08(a)), the Legislature intended to include all retailers without exception. If the Legislature intended to exempt online retailers, he contends, it could have done so.
Apple, on the other hand, argues that the first sentence of section 1747.08(a) must be construed in light of other language in the statute indicating that the Legislature had in mind only in-person business transactions. For example, section 1747.08(a)(1) prohibits a retailer from requesting or requiring a “cardholder to write any personal identification information upon the credit card transaction form or otherwise.” (Italics added.) Section 1747.08(a)(2) prohibits a retailer from requesting or requiring the cardholder to provide such information, which the retailer “writes, causes to be written, or otherwise records upon the credit card transaction form or otherwise.” (Italics added.) And section 1747.08(a)(3) prohibits the retailer from utilizing “a credit card form which contains preprinted spaces.” (Italics added.) Apple says the terms “write” and “forms” imply, by their physicality, that section 1747.08 applies only to in-person transactions. Apple further argues that the definition of “credit card” in section 1747.02—“any card, plate, coupon book, or other single credit device existing for the purpose of being used from time to time upon presentation to obtain money, property, labor, or services on credit”—indicates that the Legislature contemplated only those transactions in which the card is physically presented or displayed to the retailer. (§ 1747.02, subd. (a), italics added.)
We think the text of section 1747.08(a) alone is not decisive on the question before us. The statutory language suggests that the Legislature, at the time it enacted former section 1747.8, did not contemplate commercial transactions conducted on the Internet. But it does not seem awkward or improper to describe the act of typing characters into a digital display as “writing” on a computerized “form.” In construing statutes that predate their possible applicability to new technology, courts have not relied on wooden construction of their terms. Fidelity to legislative intent does not “make it impossible to apply a legal text to technologies that did not exist when the text was created. . . . Drafters of every era know that technological advances will proceed apace and that the rules they create will one day apply to all sorts of circumstances they could not possibly envision.” (Scalia & Garner, Reading Law: The Interpretation of Legal Texts (2012) pp. 85-86.)
For example, in O’Grady v. Superior Court (2006) 139 Cal.App.4th 1423 [44 Cal.Rptr.3d 72], the Court of Appeal considered whether an online news magazine constitutes a “ ‘periodical publication’ ” for purposes of California’s journalism shield law, which was enacted well before the advent of “digital magazines.” (Id. at p. 1461.) The court considered the argument that “the shield law only applies to ‘periodical publications’ in print, because that [138]was a common feature of newspapers and magazines at the time the law was enacted.” (Id. at p. 1462.) But the court did not regard that meaning as dispositive, instead finding the statutory term ambiguous enough to encompass the Web site at issue. (Id. at pp. 1463-1466.) The court ultimately found the shield law applicable to the Web site through a careful examination of the Legislature’s purpose in enacting the statute, not on the basis of the plain meaning of “ ‘periodical publication.’ ” (Id. at pp. 1462-1463; see id. at p. 1465 [“Given the numerous ambiguities presented by ‘periodical publication’ in this context, its applicability must ultimately depend on the purpose of the statute.”].)
In Ni v. Slocum (2011) 196 Cal.App.4th 1636, 1649 [127 Cal.Rptr.3d 620] (Slocum), the Court of Appeal considered “whether the use of electronic signature qualifies as ‘personally affixing]’ the signature” on an initiative petition as that phrase is used in the Elections Code. (See Elec. Code, § 100 [“Each signer shall at the time of signing the petition or paper personally affix his or her signature, printed name, and place of residence . . . .”].) The county argued that a signer must “physically ‘attach[]’ the signature to the petition by inscribing it with a writing utensil,” whereas the petitioner claimed that the statutory requirement can be satisfied by “tracing one’s signature and address on the face of a smartphone in response to online instructions accompanying a copy of the petition.” (Slocum, supra, 196 Cal.App.4th at pp. 1649-1650.) Although the statute was enacted in 1933, long before electronic signatures existed, the Court of Appeal found “no reason to reject either of these definitions solely on the basis of the plain language of the statute.” (Id. at p. 1650; see id. at p. 1652 [“Statutory interpretation must be prepared to accommodate technological innovation, if the technology is otherwise consistent with the statutory scheme.”].)
Rather, the court in Slocum ultimately concluded that an electronic signature system was “not entirely consistent with the present statutory scheme for the endorsement of initiative petitions because . . . electronic signature software deletes the circulator from the signature collection process” by allowing “voters to gain access to petitions from the Internet and execute them without the assistance or intervention of a circulator.” (Slocum, supra, 196 Cal.App.4th at pp. 1652-1653.) The court explained that the “. . . Elections Code requires each petition submitted to county election officials to be accompanied by the declaration of the circulator, attesting to the genuineness of the signatures on the petition,” and that “the Legislature viewed the participation of the circulator as a protection against fraud in the collection of signatures.” (Id. at p. 1652.) Thus, the court concluded that “the electronic signature system is partially incompatible with the current statutory scheme . . .” because it “eliminates from the signature collection system one of its primary protections against fraud.” (Id. at p. 1653.)
[139]In this case, as in O’Grady and Slocum, the plain meaning of the statute’s text is not decisive. An examination of the statutory scheme as a whole is necessary to determine whether it is applicable to a transaction made possible by technology that the Legislature did not envision.
B.
We recently considered the history and purpose of the Credit Card Act in Pineda, supra, 51 Cal.4th 524. There we said “[t]he statute’s overriding purpose was to ‘protect the personal privacy of consumers who pay for transactions with credit cards.’ ” (Id. at p. 534, quoting Assem. Com. on Finance and Insurance, Analysis of Assem. Bill No. 2920 (1989-1990 Reg. Sess.) as amended Mar. 19, 1990, p. 2.) Specifically, the Legislature “sought to address the misuse of personal identification information for, inter alia, marketing purposes, and found that there would be no legitimate need to obtain such information from credit card customers if it was not necessary to the completion of the credit card transaction.” (Absher v. AutoZone, Inc. (2008) 164 Cal.App.4th 332, 345 [78 Cal.Rptr.3d 817], quoted in Pineda, at p. 535.) “To protect consumers, the Legislature sought to prohibit businesses from ‘requiring information that merchants, banks or credit card companies do not require or need.’ ” (Pineda, at p. 535, quoting Assem. Com. on Finance and Insurance, Analysis of Assem. Bill No. 2920 (1989-1990 Reg. Sess.) as amended Mar. 19, 1990, p. 2.)
While it is clear that the Legislature enacted the Credit Card Act to protect consumer privacy, it is also clear that the Legislature did not intend to achieve privacy protection without regard to exposing consumers and retailers to undue risk of fraud. The legislative history shows that the Legislature enacted the statute’s prohibitions only after carefully considering and rejecting the possibility that the collection of personal identification information by brick-and-mortar retailers could serve a legitimate purpose such as fraud prevention. In particular, the Senate Judiciary Committee considered the standard procedure followed by brick-and-mortar retailers in the 1990s to verify the identity of credit card users—which included “verify[ing] the identification of the cardholder by comparing the signature on the credit card transaction form with the signature on the back of the card” and “contacting] the credit card issuer’s authorization center [to] obtain approval” for sales above a specified “floor limit”—and concluded that the collection of personal identification information was not a necessary step in that procedure. (Sen. Com. on Judiciary, Analysis of Assem. Bill No. 2920 (1989-1990 Reg. Sess.) as amended June 27, 1990, p. 3.) This finding supported the Legislature’s judgment that brick-and-mortar retailers in the 1990s had no genuine need to collect personal identification information and would instead use such information primarily for unsolicited marketing. (See id. at pp. 3-4 [noting that [140]the “problem” the bill was designed to address was retailers’ practice of leading consumers “to mistakenly believe that [personal identification information] is a necessary condition to complete the credit card transaction, when, in fact, it is not” and “acquiring] this additional personal information for their own business purposes—for example, to build mailing or telephone lists which they can subsequently use for their own in-house marketing efforts, or sell to direct-mail or tele-marketing specialists, or to others”]; id. at pp. 5-7 [explaining that retailers had no genuine need for personal identification information to address problems such as billing errors, lost credit cards, and product problems].) We cannot assume that the Legislature, had it confronted a type of transaction in which the standard mechanisms for verifying a cardholder’s identity were not available, would have made the same policy choice as it did with respect to transactions in which it found no tension between privacy protection and fraud prevention.
Further, the Legislature in 1991 “added a provision (former § 1747.8, subd. (d)) . . . substantially similar to the subdivision (d) now in section 1747.08, permitting businesses to require cardholders to provide identification so long as none of the information contained thereon was recorded.” (Pineda, supra, 51 Cal.4th at p. 535, citing Stats. 1991, ch. 1089, § 2, p. 5042.) The adoption of this provision was described as “a clarifying, nonsubstantive change.” (State and Consumer Services Agency, Enrolled Bill Rep. on Assem. Bill No. 1477 (1991-1992 Reg. Sess.) Sept. 9, 1991, p. 3.) As previously noted, section 1747.08(d) makes clear that nothing in the statute prevents retailers from requiring customers to provide positive identification—“which may include a driver’s license or a California state identification card, or where one of these is not available, another form of photo identification”—as a condition of accepting a credit card as payment. In addition, although section 1747.08(d) generally prohibits a retailer from recording information contained on a customer’s photo identification card, a retailer may record the customer’s driver’s license number or similar information when the customer does not make the credit card available for verification, presumably so that the customer may be identified and located in the event of a problem with the use of the credit card. Section 1747.08(d) shows that while the Legislature indeed sought to protect consumer privacy, it did not intend to do so at the cost of creating an undue risk of credit card fraud. Rather, section 1747.08(d) demonstrates the Legislature’s intent to permit retailers to use and even record personal identification information when necessary to combat fraud and identity theft—objectives that not only protect retailers but also promote consumer privacy.
The safeguards against fraud that are provided in section 1747.08(d) are not available to the online retailer selling an electronically downloadable product. Unlike a brick-and-mortar retailer, an online retailer cannot visually inspect the credit card, the signature on the back of the card, or the [141]customer’s photo identification. Thus, section 1747.08(d)—the key antifraud mechanism in the statutory scheme—has no practical application to online transactions involving electronically downloadable products. We cannot conclude that if the Legislature in 1990 had been prescient enough to anticipate online transactions involving electronically downloadable products, it would have intended section 1747.08(a)’s prohibitions to apply to such transactions despite the unavailability of section 1747.08(d)’s safeguards.
Krescent’s complaint reinforces our conclusion insofar as it failed to allege that Apple does not require any personal identification information to verify the identity of the credit card user. His complaint merely alleged that “the credit card transaction would be permitted to proceed without any further information” and that Apple “is not contractually obligated to provide a consumer’s telephone number and/or address in order to complete the credit card transaction,” thereby rendering inapplicable the exception set forth in section 1747.08(c)(3)(A). Even if credit card transactions may proceed without any personal identification information under the contractual terms that bind retailers and credit card companies, the fact remains that the Legislature saw fit to include section 1747.08(d)’s safeguards against fraud in the statutory scheme. The inclusion of section 1747.08(d), separate and apart from the exception in section 1747.08(c)(3)(A), reflects the Legislature’s judgment that consumers and retailers have an interest in combating fraud that is independent of whatever security measures are (or are not) required by contracts between retailers and credit card issuers. Consistent with this legislative judgment, both parties acknowledged at oral argument that retailers often bear the risk of loss from fraudulent credit card charges.
In addition, Krescent suggested in his complaint and expressly conceded at oral argument that Apple may need at least a valid billing address, if not a telephone number, to verify the credit card. However, according to Krescent’s own allegations, there would be no way for Apple to collect this information under the statute. As noted, Krescent alleged that Apple is neither contractually nor legally obligated to collect such information; hence, the exceptions in section 1747.08(c)(3)(A) and (C) do not apply. Krescent also alleged that Apple does not require a customer’s address for a special purpose incidental but related to the credit card transaction, such as shipping, because the product is electronically downloadable; hence, the exception in section 1747.08(c)(4) does not apply. Likewise, the exceptions concerning motor fuel retailers, cash advance transactions, and transactions in which a credit card is used as a form of security have no applicability to this case. (§ 1747.08(c)(1), (2), (3)(B).)
At oral argument, Krescent suggested that Apple might be able to collect a customer’s billing address as a “reasonable form[] of positive identification” [142]under section 1747.08(d). But section 1747.08(b) includes “the cardholder’s address” as a type of personal identification information retailers are forbidden to collect. Moreover, Krescent’s view cannot be squared with the full text of section 1747.08(d), which says retailers may require the cardholder “to provide reasonable forms of positive identification, which may include a driver’s license or a California state identification card, or where one of these is not available, another form of photo identification, provided that none of the information contained thereon is written or recorded on the credit card transaction form or otherwise.” A billing address is not a “form of photo identification.” (See Costco Wholesale Corp. v. Superior Court (2009) 47 Cal.4th 725, 743 [101 Cal.Rptr.3d 758, 219 P.3d 736] [“Under the principle of statutory construction known as ‘ejusdem generis,’ the general term ordinarily is understood as being 1 “restricted to those things that are similar to those which are enumerated specifically.” ’ ”].) And Krescent’s own complaint alleged that Apple “records each consumer’s personal information, including, but not limited to a telephone number and address, in line with each credit card transaction, and keeps records of such personal information.” In short, section 1747.08(d) does not permit Apple to collect a billing address in the course of an online transaction.
In his brief (but not in his complaint), Krescent argued that requiring a customer to provide his or her name, credit card number, card expiration date, and credit card identification number suffices to prevent fraud. But it is clear that the Legislature has disagreed. A customer’s name, credit card number, expiration date, and security code are all apparent to a “brick-and-mortar” retailer on the credit card itself when the card is presented during an in-person transaction. Yet the Legislature expressly authorized retailers to request additional information—namely, a driver’s license, state identification card, or another form of photo identification—in order to combat fraud. (§ 1747.08(d).) The Legislature has thus decided that the information on the credit card is not necessarily sufficient by itself to protect consumers and retailers against fraud.
Our dissenting colleagues offer various arguments against the conclusion that the statute, if applied to the online transaction in this case, would prohibit Apple from collecting information necessary to combat fraud. Justice Kennard cites section 1747.08(c)(3)(A), which allows retailers to collect personal identification information that they are “contractually obligated to provide ... in order to complete the credit card transaction,” as one “layer of protection against fraud.” (Dis. opn. of Kennard, J., post, at p. 155.) But Krescent’s complaint stated that Apple is not contractually obligated to collect any such information, and we must accept this allegation as true on demurrer. (See ante, at p. 141.) Justice Kennard also notes that the second sentence of section 1747.08(d) allows retailers “to record the number appearing on the buyer’s driver’s license or similar identification.” (Dis. opn. of [143]Kennard, J., post, at p. 155.) But the second sentence of section 1747.08(d) allows a retailer to record such information when a buyer “pays for the transaction with a credit card number and does not make the credit card available upon request,” presumably so that the buyer may be tracked down if the use of the credit card number turns out to be improper. This provision contemplates that the retailer can verify that the driver’s license or identification card belongs to the buyer; indeed, section 1747.08(d) makes clear that a driver’s license or identification card has significance in this context as a “form of photo identification.” In an online transaction, even if the retailer were to collect a driver’s license number, the retailer has no way to verify that the number corresponds to the person using the credit card number.
In his dissent, Justice Baxter asserts that we indulge an unwarranted “factual assumption—that the personal identification information defendant allegedly demanded and recorded here, i.e., cardholder addresses and telephone numbers, are ‘necessary to combat fraud and identity theft’ in online credit card transactions.” (Dis. opn. of Baxter, J., post, at p. 161.) But we do nothing of the sort. We express no view as to what type of information— whether an address, telephone number, or something else—is essential to verify a cardholder’s identity. We hold only that the statutory scheme and legislative history make clear the Legislature’s concern that there be some mechanism by which retailers can verify that a person using a credit card is authorized to do so. No such mechanism would exist in the context of online purchases of electronically downloadable products if the statute were read to apply to such transactions. Because the statutory scheme provides no means for online retailers selling electronically downloadable products to protect against credit card fraud, we conclude that the Legislature could not have intended section 1747.08 to apply to this type of transaction.
We have no occasion here to decide whether section 1747.08 applies to online transactions that do not involve electronically downloadable products or to any other transactions that do not involve in-person, face-to-face interaction between the customer and retailer. Our dissenting colleagues contend that section 1747.08 must apply to online transactions because the Legislature intended it to apply to “other card-not-present transactions” such as mail-order and telephone order (MOTO) transactions. (Dis. opn. of Baxter, J., post, at p. 162; see dis. opn. of Kennard, J., post, at pp. 153-154.) We express no view on whether the statute governs MOTO transactions, as that issue is not presented and has not been briefed in this case. In any event, even if the statute does apply to MOTO transactions, we do not think such transactions, which often involve “shipping [or] delivery ... of the purchased merchandise” (§ 1747.08(c)(4)), are readily likened to online purchases of electronically downloadable products with respect to possible means of preventing or detecting fraud.
[144]HI.
Krescent contends that the text and legislative history of a 2011 amendment to the Credit Card Act show that section 1747.08 applies to online transactions. As explained below, we disagree.
In 2011, the Legislature amended the Credit Card Act to add section 1747.08(c)(3)(B), which provides that the prohibitions of section 1747.08(a) do not apply if “[t]he person, firm, partnership, association, or corporation accepting the credit card in a sales transaction at a retail motor fuel dispenser or retail motor fuel payment island automated cashier uses the Zip Code information solely for prevention of fraud, theft, or identity theft.” This amendment applies to “pay-at-the-pump” transactions in which no employee or other seller of the agent is present. (See § 1747.02, subd. (n) [defining “ ‘[r]etail motor fuel dispenser’ ” as “a device that dispenses fuel . . . , that processes the sale of fuel through a remote electronic payment system, and that is in a location where an employee or other agent of the seller is not present”]; § 1747.02, subd. (o) [defining “ ‘[r]etail motor fuel payment island automated cashier’ ” in similar terms].) Krescent argues that because the 2011 amendment creates a narrow exception for a certain type of remote transaction, it would have been unnecessary surplusage if the statute was never intended to apply to remote transactions in the first place. In his view, the 2011 amendment confirms that all retailers, including retailers conducting business remotely, are governed by the statute.
The logic of Krescent’s argument holds only if one assumes that a remote transaction conducted at a gas station stands on equal footing with an online transaction, and that by addressing the former in 2011, the Legislature necessarily signaled the statute’s applicability to the latter. But there are good reasons to doubt this assumption. As Apple points out in its brief, “the customer engaging in a pay-at-the-pump transaction has physical possession of the card, which must be swiped,” and “is capable of being seen, either because an employee is at the gas station, or because there is video surveillance of the pump.” Thus, pay-at-the-pump transactions arguably present less risk of fraud than online transactions because a customer engaged in an online transaction need not possess a physical card and can complete the transaction in the privacy of his or her own home. It seems counterintuitive to posit that the Legislature created a fraud prevention exemption only for pay-at-the-pump retailers while leaving online retailers unprotected, when online retailers—a multibillion-dollar industry by the year 2011—have at least as much if not more need for an exemption to protect themselves and consumers from fraud.
[145]The more logical inference is that the Legislature did not address pay-at-the-pump transactions in 2011 against the backdrop of the statute’s applicability to all remote transactions, including online transactions, but rather that the Legislature addressed pay-at-the-pump transactions against the backdrop of the statute’s applicability to in-person transactions at ordinary brick-and-mortar retailers, the paradigmatic type of transaction addressed by the statute’s text. Compared to ordinary brick-and-mortar retailers, gas stations with payment island automated cashiers may indeed have heightened fraud concerns, and it would make sense for the Legislature to grant them more leeway to record personal identifying information. Indeed, the 2011 amendment supports the view that the Legislature’s policy behind the statute has been, and continues to be, to protect consumer privacy without putting retailers in the position of having to accept credit card payments when they are unable to confirm that the person using the card is authorized to do so.
We acknowledge that the legislative history of the 2011 amendment contains some indications that appear to support Krescent’s position. The gas station exemption became law with the passage of Assembly Bill No. 1219 (2011-2012 Reg. Sess.). One version of the bill proposed to “amend the Song-Beverly Credit Card Act in a manner that would restrict its application to instances in which a card is ‘physically presented’ to a retailer, apparently with the intent of allowing retailers to collect personal information for fraud prevention purposes where the card is not physically presented, as in an on-line or other electronic transaction.” (Assem. Com. on Judiciary, Analysis of Assem. Bill No. 1219 (2011-2012 Reg. Sess.) as amended May 4, 2011, p. 1, italics & underscoring omitted.) In reviewing this version, the Assembly Committee on Judiciary concluded it “sweeps too broadly in effectively removing on-line and telephonic transactions from the scope of the existing law’s protection.” (Ibid., italics omitted.) Because “this was not the bill’s intent” according to its sponsor, the committee said it “strongly recommends that this language come out of the bill.” (Id. at p. 5, underscoring omitted.) Consistent with that recommendation, Assembly Bill No. 1219 (2011-2012 Reg. Sess.) was enacted without the restrictive language. (§ 1747.08, as amended by Stats. 2011, ch. 690, § 2; see Sen. Com. on Judiciary, Analysis of Assem. Bill No. 1219 (2011-2012 Reg. Sess.) as amended June 22, 2011, p. 2.) As passed, the bill provided a specific exemption for automated cashiers at gas stations.
For several reasons, however, we do not find this legislative history persuasive on the meaning of section 1747.08 as enacted in 1990. First, “[t]he declaration of a later Legislature is of little weight in determining the relevant intent of the Legislature that enacted the law.” (Peralta Community College Dist. v. Fair Employment & Housing Com. (1990) 52 Cal.3d 40, 52 [276 Cal.Rptr. 114, 801 P.2d 357]). This is especially true where, as here, “a gulf of decades separates the two [legislative] bodies.” (Western Security Bank v. [146]Superior Court (1997) 15 Cal.4th 232, 244 [62 Cal.Rptr.2d 243, 933 P.2d 507].) We thus give little weight to the views of the Legislature of 2011 as to what the Legislature of 1990 intended.
Second, “[u]npassed bills, as evidences of legislative intent, have little value.” (Dyna-Med, Inc. v. Fair Employment & Housing Com. (1987) 43 Cal.3d 1379, 1396 [241 Cal.Rptr. 67, 743 P.2d 1323].) Although plaintiff contends that the never-enacted provisions were premised on the Legislature’s understanding that section 1747.08 applies to online transactions, the Legislature’s decision not to enact those provisions plausibly supports the opposite inference: the Legislature may have concluded that it was unnecessary to remove online transactions from the statute’s coverage because such transactions were never covered by the statute in the first place.
Third, the legislative history on whether the statute applies to online transactions is conflicting. For example, when the 2011 amendment was first proposed, a federal district court had already ruled in Saulic v. Symantec Corp. (C.D.Cal. 2009) 596 F.Supp.2d 1323 that section 1747.08 does not apply to online transactions, and “the Legislature is deemed to be aware of existing laws and judicial decisions in effect at the time legislation is enacted and to have enacted and amended statutes 1 “in the light of such decisions as have a direct bearing upon them.” ’ ” (People v. Overstreet (1986) 42 Cal.3d 891, 897 [231 Cal.Rptr. 213, 726 P.2d 1288].) In addition, an Assembly analysis of proposed Senate amendments noted that “this bill simply creates an express exemption in current law from the prohibition on collecting zip code information in a retail credit card transaction at a motor fuel dispenser so long as the zip code information is used to prevent fraud, theft or identity theft,” an exemption that “the courts may determine in current litigation . . . always existed.” (Assem. Floor analysis Assem. Bill No. 1219 (2011-2012 Reg. Sess.) Sept. 8, 2011, p. 3, italics added.) Similarly, the sponsor of the unenacted proposal to remove online and telephonic transactions from the statute’s coverage indicated that the proposal was “intended to clarify existing law.” (Assem. Com. on Judiciary, Analysis of Assem. Bill No. 1219 (2011-2012 Reg. Sess.) as amended May 4, 2011, p. 2.)
Fourth, in contrast to the conflicting evidence and legally dubious inferences from the 2011 legislative history as to whether the 1990 statute applies to online transactions, what is clear from the legislative history is that the 2011 amendment was enacted to address a very specific problem. Our 2011 holding in Pineda, supra, 51 Cal.4th 524, that a ZIP code constitutes “ ‘personal identification information’ ” within the meaning of section 1747.08(b) applied retroactively to uses of the ZIP code prior to our ruling. The California Retailers Association, the sponsor of Assembly Bill No. 1219 (2011-2012 Reg. Sess.), “claim[ed] that about 150 lawsuits [had] been filed [147]against retailers in the wake of the Supreme Court decision, including against gas stations that collect zip codes for fraud prevention purposes.” (Assem. Com. on Judiciary, Analysis of Assem. Bill No. 1219 (2011-2012 Reg. Sess.) as amended May 4, 2011, p. 1, italics omitted.) The Western States Petroleum Association argued to the Legislature that “[w]ithout specific language expressly exempting fraud prevention, ... its member companies ‘may face years of costly litigation.’ ” (Id. at p. 8; see Assem. Com. on Banking and Finance, Analysis of Assem. Bill No. 1219 (2010-2011 Reg. Sess.) as amended Apr. 25, 2011, p. 2 [“The need for this bill arises from . . . Pineda v. Williams-Sonoma Stores, Inc. . . .”].) In response, the Legislature created an “express exemption from the prohibition against the collection and retention of zip code information when the zip code is used solely for prevention of fraud, theft, or identity theft in a sales transaction at a retail motor fuel dispenser or retail motor fuel payment island automated cashier.” (Assem. Floor analysis, Assem. Bill No. 1219 (2011-2012 Reg. Sess.) Sept. 8, 2011, p. 1.)
Thus, the problem the Legislature sought to address in 2011 was a narrow one: how to deal with lawsuits filed against traditional brick-and-mortar retailers, particularly gas stations, that had been collecting ZIP codes for years under the mistaken belief that they were not prohibited from doing so under section 1747.08. Given the Legislature’s specific focus, it is not surprising that the Assembly Committee on Judiciary recommended that the bill be written narrowly, without the use of broad language unnecessary to address the particular problem faced by gas stations that use automated cashiers. In sum, we cannot draw any firm conclusion concerning the applicability of section 1747.08 to online transactions from the legislative history of the 2011 gas station exemption for the simple reason that the Legislature in 2011 was not presented with that issue.
IV.
Finally, the California Online Privacy Protection Act of 2003 (COPPA) shows that the Legislature knows how to make clear that it is regulating online privacy and that it does so by carefully balancing concerns unique to online commerce. COPPA provides that “[a]n operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service shall conspicuously post its privacy policy on its Web site . . . .” (Bus. & Prof. Code, § 22575, subd. (a).) The privacy policy must: “(1) Identify the categories of personally identifiable information that the operator collects through the Web site or online service about individual consumers who use or visit its commercial Web site or online service and the categories of third-party persons or entities with [148]whom the operator may share that personally identifiable information, [f] (2) If the operator maintains a process for an individual consumer who uses or visits its commercial Web site or online service to review and request changes to any of his or her personally identifiable information that is collected through the Web site or online service, provide a description of that process, [f] (3) Describe the process by which the operator notifies consumers who use or visit its commercial Web site or online service of material changes to the operator’s privacy policy for that Web site or online service, [f] (4) Identify its effective date.” (Bus. & Prof. Code, § 22575, subd. (b).)
Although it is theoretically possible to construe COPPA as imposing requirements on online transactions that go above and beyond the requirements of section 1747.08, we find no evidence of such a legislative intent. Instead, there is evidence to the contrary. The Senate Rules Committee’s third reading analysis of COPPA indicated that this legislation was necessary because “[e]xisting law does not directly regulate the privacy practices of online business entities.” (Sen. Rules Com., Off. of Sen Floor Analyses, 3d reading analysis of Assem. Bill No. 68 (2003-2004 Reg. Sess.) as amended Sept. 3, 2003, p. 2.) The bill’s author explained that because “many consumers refuse to do business online because they have little protection against abuse,” online retailers should be required at least to disclose in their online privacy policies what personal information may be collected and how it is used. (Assem. Com. on Business and Professions, Analysis of Assem. Bill No. 68 (2003-2004 Reg. Sess.) as amended Apr. 28, 2003, p. 2; see Assem. Com. on Judiciary, Analysis of Assem. Bill No. 68 (2003-2004 Reg. Sess.) as amended Apr. 2, 2003, p. 3 [“ ‘Any policy will do. The bill simply requires that an operator have a policy and then follow it.’ ”].) According to the bill’s author, this disclosure regime would “provided meaningful privacy protection[] that will help foster the continued growth of the Internet economy.” (Assem. Com. on Business and Professions, Analysis of Assem. Bill No. 68 (2003-2004 Reg. Sess.) as amended Apr. 28, 2003, p. 2.)
The enactment of COPPA suggests that when the Legislature intends to address online transactions, it does so unambiguously. In addition, the fact that COPPA enacts merely a disclosure regime suggests that the Legislature in 2003 sought to proceed cautiously in regulating online commerce or, at least for the time being, to strike a different policy balance than the Credit Card Act did in 1990 for the collection of personally identifiable information.
COPPA also refutes our dissenting colleagues’ assertion that today’s decision will leave online retailers “free to require personal identification information as a condition of credit card acceptance and to use such information for whatever purposes they wish.” (Dis. opn. of Baxter, J., post, at p. 164; see dis. opn. of Kennard, J., post, at pp. 151, 154-155.) As noted, [149]COPPA requires online retailers to “conspicuously post” their privacy policies, to disclose “the categories of personally identifiable information” they collect, and to identify “the categories of third-party persons or entities with whom [they] may share that personally identifiable information.” (Bus. & Prof. Code, § 22575, subds. (a), (b).) If a consumer is not satisfied with the policy of a particular retailer, he or she may decline to purchase a product from that retailer. The Legislature could have reasonably believed that its disclosure regime creates significant incentives, in light of consumer preferences, for online retailers to limit their collection and use of personally identifiable information.
Federal law also provides some degree of protection against the use of personal identification information for unwanted commercial solicitation. The Telephone Consumer Protection Act of 1991 (TCPA; Pub.L. No. 102-243 (Dec. 20, 1991) 105 Stat. 2394) was enacted “to protect the privacy interests of residential telephone subscribers by placing restrictions on unsolicited, automated telephone calls to the home and to facilitate interstate commerce by restricting certain uses of facsimile . . . machines and automatic dialers.” (Sen.Rep. No. 102-178, 1st Sess., p. 1 (1991), reprinted in 1991 U.S. Code Cong. & Admin. News, p. 1968; see 47 U.S.C. § 227.) “[T]he TCPA instructs the [Federal Communications Commission] to issue regulations ‘concerning the need to protect residential telephone subscribers’ privacy rights to avoid receiving telephone solicitations to which they object.’ ” (Charvat v. NMP, LLC (6th Cir. 2011) 656 F.3d 440, quoting 47 U.S.C. § 227(c)(1).) “In 2003, two federal agencies—the Federal Trade Commission (FTC) and the Federal Communications Commission (FCC)—promulgated rules that together created the national do-not-call registry. [Citations.] The national do-not-call registry is a list containing the personal telephone numbers of telephone subscribers who have voluntarily indicated that they do not wish to receive unsolicited calls from commercial telemarketers. Commercial telemarketers are generally prohibited from calling phone numbers that have been placed on the do-not-call registry, and they must pay an annual fee to access the numbers on the registry so that they can delete those numbers from their telephone solicitation lists.” (Mainstream Marketing Services v. FTC (10th Cir. 2004) 358 F.3d 1228, 1233-1234, fns. omitted.) Thus, federal legislation limits the commercial use of customer telephone numbers.
There can be no doubt that retail commerce has changed dramatically since section 1747.08 was enacted and even since COPPA and the federal TCPA were enacted. In 1990, the idea of computerized transactions involving the sale and purchase of virtual products was beyond any legislator’s imagination. Such technology was not even a twinkle in Steve Jobs’s eye; at the time, Jobs had just begun to experiment with the concept of “interpersonal computing.” (New Models of NeXT Computer Lauded; Users, Analysts Praise Changes in Hardware, Software, Rocky Mountain News [150](Sept. 23, 1990) p. B8; see Isaacson, Steve Jobs (2011) pp. 211-237, 293-294 [discussing Jobs’s attempted innovations in personal computing during the late 1980s and early 1990s].) Today, retail “e-commerce” sales in the United States approach $200 billion a year (see U.S. Census Bur., E-Stats (May 10, 2012) pp. 3-4 <http://www.census.gov/econ/estats/2010/2010reportfinal.pdf> [as of Feb. 4, 2013]), and it has been estimated that iTunes alone will generate as much as $13 billion in revenue for Apple in 2013 through the sale of apps, music, movies, and e-books (see Gobry, Apple Will Generate $13 Billion in iTunes Revenue in 2013, Says Analyst, Business Insider, July 5, 2011 <http ://w ww.businessinsider. com/apple-itunes-revenue-2013-2011-7> [as of Feb. 4, 2013]). Although “[statutory interpretation must be prepared to accommodate technological innovation ...” this is only possible “if the technology is otherwise consistent with the statutory scheme.” (Slocum, supra, 196 Cal.App.4th at p. 1652.) Having thoroughly examined section 1747.08’s text, purpose, and history, we are unable to find the clarity of legislative intent or consistency with the statutory scheme necessary to conclude that the Legislature in 1990 intended to bring the enormous yet unforeseen advent of online commerce involving electronically downloadable products—and the novel challenges for privacy protection and fraud prevention that such commerce presents—within the coverage of the Credit Card Act.
In light of our holding today, the Legislature may wish to revisit the issue of consumer privacy and fraud prevention in online credit card transactions, just as it revisited the use of ZIP codes in the wake of our 2011 decision in Pineda. We cast no doubt on Krescent’s claim that protecting consumer privacy in online transactions is an important policy goal, nor do we suggest that combating fraud is as important or more important than protecting privacy. We express no view on this significant issue of public policy. Our role is to determine what the Legislature intended by the statute it enacted. Here the statutory scheme, considered as a whole, reveals that the Legislature intended to safeguard consumer privacy while also protecting retailers and consumers against fraud. This accommodation of interests struck by the Legislature would not be achieved if section 1747.08 were read to apply to online transactions involving electronically downloadable products. Because we cannot make a square peg fit a round hole, we must conclude that online transactions involving electronically downloadable products fall outside the coverage of the statute.
CONCLUSION
For the foregoing reasons, the Court of Appeal’s judgment summarily denying the petition for writ of mandate or prohibition is reversed, and the matter is remanded to that court with directions to issue a writ consistent with this opinion.
Cantil-Sakauye, C. J., Werdegar, J., and Corrigan, J., concurred.