Credit and debit card receipt truncation and card-transaction information limits
ORS 646A.200-646A.214
Financial · Data security
Limits card receipts to the customer's name and five digits of the card number, requires destruction of fuller receipt copies within 36 months, and limits collecting card numbers or recording extra personal information on card slips.
- Where
- Oregon
- Citation
- ORS 646A.202, 646A.204, 646A.210, 646A.214
- Status
- In force
- Enforced by
- Oregon Attorney General (rules under ORS 646A.206); ORS 646A.210 and 646A.214 violations are unlawful practices under ORS 646.608(1)(mm)
- People can sue
- Limited
- Penalties
- Violations of ORS 646A.210 and 646A.214 are unlawful practices under ORS 646.608, enforceable by the AG (up to $25,000 per willful violation) and by consumers with an ascertainable loss (actual damages or $200) (ORS 646.638, 646.642).
- Applies to
- Persons accepting credit or debit cards and sellers of payment processing systems; merchants accepting checks
Practices it requires
- Customer receipts may show no more than the customer's name and five digits of the card number; payment systems sold or leased must comply.ORS 646A.202; 646A.204(1)
- Do not require a credit card number or expiration date as a condition of accepting a check, with listed exceptions.ORS 646A.210
- A merchant may ask for extra identifying information to verify a cardholder but may not write it on the card transaction form.ORS 646A.214(1)
Security duties
- Destroy retained receipt copies with more information by the earlier of microfilming or 36 months after the transaction.ORS 646A.204(2)
Sources
- Official text
- ORS 646A.200 to 646A.214 (ORS chapter 646A, 2025 edition)
- ORS 646.608 and 646.638 (ORS chapter 646)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Original effective dates not verified (sections were formerly ORS 646.887-646.894). | Private action applies only to ORS 646A.210 and 646A.214 via ORS 646.608(1)(mm); whether receipt-truncation violations are privately actionable was not confirmed.
Research reference, not legal advice.