Civ. Code, § 1747.09

(a) Except as provided in this section, no person, firm, partnership, association, corporation, or limited liability company that accepts credit or debit cards for the transaction of business shall print more than the last five digits of the credit or debit card account number or the expiration date upon any of the following:

(1) Any receipt provided to the cardholder.

(2) Any receipt retained by the person, firm, partnership, association, corporation, or limited liability company, which is printed at the time of the purchase, exchange, refund, or return, and is signed by the cardholder.

(3) Any receipt retained by the person, firm, partnership, association, corporation, or limited liability company, which is printed at the time of the purchase, exchange, refund, or return, but is not signed by the cardholder, because the cardholder used a personal identification number to complete the transaction.

(b) This section shall apply only to receipts that include a credit or debit card account number that are electronically printed and shall not apply to transactions in which the sole means of recording the person’s credit or debit card account number is by handwriting or by an imprint or copy of the credit or debit card.

(c) This section shall not apply to documents, other than the receipts described in paragraphs (1) to (3), inclusive, of subdivision (a), used for internal administrative purposes.

(d) Paragraphs (2) and (3) of subdivision (a) shall become operative on January 1, 2009.