Research · 6 min read
When a Checkout Hands Your Payment Details to a Second Company
A 2010 federal statute makes it unlawful for an online merchant to pass a customer's account number to a different seller, and separately regulates what that second seller must do before charging anything.
Key takeaways
- 15 U.S.C. 8402(b) makes the handoff itself unlawful: an initial merchant may not disclose a customer's account number or billing information to a post-transaction third party seller for that seller's own Internet sale.
- A post-transaction third party seller must disclose, before obtaining billing information, that it is not affiliated with the merchant the consumer came to — a required negative, not just an accurate name.
- Consent under the section requires the consumer to supply the full account number plus name, address and contact means, and then take an additional affirmative action such as clicking a confirmation button.
- The neighboring section, 15 U.S.C. 8403, covers negative option features and is a different prohibition; satisfying one says nothing about the other.
- The Telemarketing Sales Rule contains a parallel provision at 16 CFR 310.4(a)(6) barring disclosure or receipt of unencrypted account numbers for consideration, while expressly permitting the sharing needed to process the customer's own payment.
- Enforcement runs through the Federal Trade Commission under 15 U.S.C. 8404, with a state attorney general action for injunctive relief under 15 U.S.C. 8405, subject to notice to the Commission and a bar during a pending federal action.
Answer first: the handoff itself is the prohibited act
15 U.S.C. 8402(b) is one sentence, and it prohibits a transfer rather than a charge. "It shall be unlawful for an initial merchant to disclose a credit card, debit card, bank account, or other financial account number, or to disclose other billing information that is used to charge a customer of the initial merchant, to any post-transaction third party seller for use in an Internet-based sale of any goods or services from that post-transaction third party seller."
Nothing in that sentence turns on whether the second company charged anything, whether the customer noticed, or whether the offer was a good one. The disclosure of the number for that purpose is the violation.
The statute defines both parties. An "initial merchant" is "a person that has obtained a consumer's billing information directly from the consumer through an Internet transaction initiated by the consumer." A "post-transaction third party seller" is a person that sells or offers goods or services on the Internet, "solicits the purchase of such goods or services on the Internet through an initial merchant after the consumer has initiated a transaction with the initial merchant," and is not the initial merchant, a subsidiary or corporate affiliate of it, or a successor to either.
That definition is the shape of the practice the section addresses: an offer that appears during or immediately after someone else's checkout, from a company the buyer did not go to.
What the second seller has to do if it is going to charge anyone
Section 8402(a) governs the post-transaction third party seller directly. It makes it unlawful for such a seller "to charge or attempt to charge any consumer's credit card, debit card, bank account, or other financial account for any good or service sold in a transaction effected on the Internet" unless two conditions are met, and the statute spells out both.
The first is disclosure, and it has to come before the account details do. "Before obtaining the consumer's billing information, the post-transaction third party seller has clearly and conspicuously disclosed to the consumer all material terms of the transaction," including "a description of the goods or services being offered"; "the fact that the post-transaction third party seller is not affiliated with the initial merchant, which may include disclosure of the name of the post-transaction third party in a manner that clearly differentiates the post-transaction third party seller from the initial merchant"; and "the cost of such goods or services."
The middle item is the one that distinguishes this section from ordinary disclosure law. The seller must disclose a negative — that it is not the company the buyer came to — not merely identify itself accurately.
The second condition is consent, defined by what the seller must collect and what the consumer must do. The seller must have "received the express informed consent for the charge from the consumer whose credit card, debit card, bank account, or other financial account will be charged," by obtaining "the full account number of the account to be charged" and "the consumer's name and address and a means to contact the consumer," and by "requiring the consumer to perform an additional affirmative action, such as clicking on a confirmation button or checking a box that indicates the consumer's consent to be charged the amount disclosed."
The full account number requirement is deliberate. A seller that already holds a number cannot satisfy this by asking the consumer to approve a charge to it; the statute requires the consumer to supply the whole number.
How this differs from the negative-option section beside it
The next section of the same chapter, 15 U.S.C. 8403, is the one most often quoted, and it addresses a different problem. It makes it unlawful "to charge or attempt to charge any consumer for any goods or services sold in a transaction effected on the Internet through a negative option feature" unless the person "provides text that clearly and conspicuously discloses all material terms of the transaction before obtaining the consumer's billing information," obtains express informed consent before charging, and "provides simple mechanisms for a consumer to stop recurring charges."
The two sections answer different questions. Section 8403 asks whether a recurring charge was properly set up by whoever set it up. Section 8402 asks whether the party doing the charging is a stranger to the transaction the consumer started, and whether the merchant the consumer trusted passed the details along.
One consequence is that a company can satisfy the negative-option rules and still be inside § 8402, and the reverse. They are not alternative descriptions of the same conduct.
The chapter also preserves other law. Section 8402(c) states that "Nothing in this chapter shall be construed to supersede, modify, or otherwise affect the requirements of the Electronic Funds Transfer Act or any regulation promulgated thereunder."
A parallel prohibition on the telephone side
The account-number-as-commodity problem is not unique to the web, and the Federal Trade Commission's Telemarketing Sales Rule contains a provision built on the same idea.
16 CFR 310.4(a)(6) makes it an abusive telemarketing act to disclose or receive, "for consideration, unencrypted consumer account numbers for use in telemarketing." It then carves out the ordinary case: the paragraph does not apply to "the disclosure or receipt of a customer's or donor's billing information to process a payment for goods or services or a charitable contribution pursuant to a transaction."
Read alongside § 8402(b), the shared principle is visible. Passing an account number onward so that a second party can sell something is treated differently from passing it onward to complete the sale the customer actually made. The first is the subject of both provisions; the second is expressly excluded from the telemarketing one.
That distinction is a useful test for a reader looking at a checkout flow. The question is not whether a company shared payment details, which every online purchase involves. It is whether the sharing was to complete the purchase, or to enable a further offer from someone else.
Who enforces the chapter
Two sections at the end of the chapter answer that, and they answer it in a specific order.
Section 8404(a) provides that a violation "shall be treated as a violation of a rule under section 18 of the Federal Trade Commission Act regarding unfair or deceptive acts or practices," and that the Commission "shall enforce this chapter in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act were incorporated into and made a part of this chapter." Section 8404(b) makes violators "subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act" on the same footing.
Section 8405(a) gives a state attorney general, or another authorized state officer, a right of action on behalf of state residents "to obtain appropriate injunctive relief." The state must give the Commission prior written notice with a copy of the complaint, or immediate notice if prior notice is not feasible, and the Commission "may intervene" and if it does may be heard on all matters and file petitions for appeal.
Section 8405(e) sets a priority rule: "No separate suit shall be brought under this section if, at the time the suit is brought, the same alleged violation is the subject of a pending action by the Federal Trade Commission or the United States under this chapter."
Section 8405(d) preserves state law independently — nothing in the section prevents a state officer from exercising powers conferred by state law or from proceeding in state or federal court on an alleged violation of a state statute.
This page describes what those provisions say about agencies and officers. It does not describe what any individual may do, and it is not advice about anyone's situation.
Sources
- 15 U.S.C. 8402 — Prohibitions against certain unfair and deceptive Internet sales practicesThe data-pass prohibition at subsection (b); the pre-charge conditions at subsection (a), including clear and conspicuous disclosure of all material terms before obtaining billing information, the description of goods or services, the required disclosure of non-affiliation with the initial merchant, the cost, the full account number, name, address and contact means, and the additional affirmative action; the definitions of initial merchant and post-transaction third party seller at subsection (d); and the Electronic Fund Transfer Act savings clause at subsection (c).
- 15 U.S.C. 8403 — Negative option marketing on the InternetThe three conditions the section imposes before charging through a negative option feature — clear and conspicuous text disclosing all material terms before obtaining billing information, express informed consent before charging, and simple mechanisms to stop recurring charges — quoted here only to distinguish that section from 15 U.S.C. 8402.
- 15 U.S.C. 8404 — Enforcement by Federal Trade Commission; 15 U.S.C. 8405 — Enforcement by State attorneys generalThe treatment of a chapter violation as a violation of a rule under section 18 of the FTC Act and the incorporation of the Act's powers and penalties, at 15 U.S.C. 8404(a) and (b); and the state attorney general right of action for injunctive relief, the prior-notice requirement, the Commission's intervention rights, the preservation of state law, and the bar on a separate state suit during a pending federal action, at 15 U.S.C. 8405(a)-(e). Section 8404 was fetched at its own URL in the same session and confirmed by its printed heading.
- 16 CFR 310.4(a)(6) — Telemarketing Sales Rule, abusive conduct generally (unencrypted consumer account numbers)The prohibition on disclosing or receiving, for consideration, unencrypted consumer account numbers for use in telemarketing, and the carve-out for disclosure or receipt of billing information to process a payment pursuant to a transaction.
Frequently asked questions
What exactly does the data-pass prohibition forbid?
Section 8402(b) makes it unlawful for an initial merchant to disclose a card or account number, or other billing information used to charge its customer, to a post-transaction third party seller for use in that seller's own Internet sale. The prohibited act is the disclosure, and the section does not require that a charge follow.
Who counts as a post-transaction third party seller?
Under § 8402(d)(2), a person who sells or offers goods or services on the Internet, solicits their purchase through an initial merchant after the consumer has begun a transaction with that merchant, and is not the initial merchant, a subsidiary or corporate affiliate of it, or a successor to either.
What must such a seller disclose before charging?
Before obtaining billing information it must clearly and conspicuously disclose all material terms, including a description of the goods or services, the cost, and the fact that it is not affiliated with the initial merchant — which the statute says may include naming itself in a way that clearly differentiates it from that merchant.
Why does the statute require the full account number?
Section 8402(a)(2)(A) requires the seller to obtain from the consumer the full account number of the account to be charged, along with the consumer's name, address and a means of contact, and then to require an additional affirmative action such as clicking a confirmation button or checking a box. A seller that already holds the number cannot rely on holding it.
Is this the same as the online negative-option rule?
No. Section 8403 addresses charging through a negative option feature and requires pre-billing disclosure, express informed consent, and simple mechanisms to stop recurring charges. Section 8402 addresses who is doing the charging and whether the original merchant passed the account details on. A company can be within one and outside the other.
Who can bring an action under this chapter?
Section 8404 assigns enforcement to the Federal Trade Commission, treating a violation as a violation of a rule under section 18 of the FTC Act. Section 8405 gives state attorneys general and other authorized state officers a right to sue for injunctive relief on behalf of residents, with prior notice to the Commission and a bar on a separate suit while the same alleged violation is the subject of a pending federal action.