CA SB383

Authorizes merchants accepting credit cards for online transactions involving electronic downloadable products to require customers to provide personal identification information solely for detecting, investigating, or preventing fraud, theft, identity theft, criminal activity, or enforcing terms of sale.

Requires merchants to destroy or dispose of collected personal identification information in a secure manner after it is no longer needed for the authorized purposes.

Prohibits merchants from aggregating or sharing the personal identification information they collect with other entities, except as required by law or when contractually obligated to verify information, complete transactions, or prevent fraud.

Allows merchants to require consumers to establish accounts as a condition of purchase and permits consumers to opt in to collection of additional personally identifiable information with proper notice of the purpose and intended use.

Maintains civil penalties of up to $250 for first violations and $1,000 for subsequent violations, enforceable by consumers, the Attorney General, or local district/city attorneys.