The article talks about the plaintiff being asked for their zip code, but not ID. I don't see in the article or in the snippets of law it references where proo

The article talks about the plaintiff being asked for their zip code, but not ID. I don't see in the article or in the snippets of law it references where proof of ID is unlawful. Perhaps its perfectly fine to ask for proof of id to authenticate the credit card holder, but not ok to record the ID info into the company's marketing database.