Online retailers can breathe easier about electronic order confirmations

Federal appeals court rules for 1-800 Contacts in transaction security case.

Thad Rueter

The risk that online retailers will face lawsuits for including payment card information on electronic order confirmations diminished this week after a federal appeals court handed down a ruling involving 1-800 Contacts Inc.

The ruling came in a suit filed by Eduard Shlahtichman who used his credit card to make an online purchase from 1-800 Contacts in 2009. The online contact lens retailer sent him an e-mail order confirmation that included the credit card’s expiration date. Shlahtichman sued the retailer, contending that by including the expiration date, 1-800 Contacts violated the Fair and Accurate Credit Transactions Act.

The law, enacted in 2003, aims to reduce identity theft and boost payment security by prohibiting retailers from producing printed receipts that contain either expiration dates or more than five digits of a payment card number. The idea is that even small bits of card information, if, for example, recovered from a dumpster, can help thieves. Violations can result in damages of up to $1,000 per instance. Shlahtichman filed a class action suit after receiving the order confirmation.

In its decision this week, the U.S. Court of Appeals for the Seventh Circuit affirmed a lower court’s opinion that an e-mailed order confirmation is not a printed receipt under the federal law. Shlahtichman had argued that the display of the expiration date on his computer screen constituted printing. But the appeals court rejected that contention, saying that “print” normally means putting information on paper. The act does not offer a specific definition of “print.”

Neither Shlahtichman nor his attorney could be reached. Joe Zeidner, general counsel for 1-800 Contacts, No. 95 in the Internet Retailer Top 500 Guide, contends that the retailer never violated the federal law, and that the retailer includes truncated card data—that is, only the last four digits of payment card numbers—on receipts. Zeidner says he does not expect an appeal.

The appeals court decision is binding only for the area served by the court—Illinois, Indiana and Wisconsin—notes David Almeida, a lawyer with Michael Best & Friedrich LLP who has represented retailers in similar class action lawsuits. The ruling presumably will prevent lawyers from filing similar suits in the 7th Circuit and give pause to lawyers in other areas of the country, he says.

“This is the only appellate decision in the entire country that says e-commerce confirmations are not printed receipts,” he says. “Not nearly as many of these cases are going to be filed. It is a very good development for Internet retailers.”

He estimates that consumers have filed at least 100 class action suits involving e-commerce payment card information, with cases especially concentrated in Florida and Arizona. Despite the ruling, Almeida advises online retailers to make sure they display on receipts and confirmations no more than the last five digits of payment card numbers and no expiration dates.


1-800 Contacts Inc., card expiration date, David Almeida, Eduard Shlahtichman, Fair and Accurate Credit Transactions Act, Identity theft, Joe Zeidner, Michael Best & Friedrich, payment card data, payment card number, payment security, receipts, truncated card data, U.S. Court of Appeals for the Seventh Circuit