Internet sales; prohibited practices.

(1) As used in this section, the term:

(a) “Initial merchant” means a person who obtains a consumer’s billing information directly from the consumer through an Internet transaction initiated by the consumer.

(b) “Posttransaction third-party seller” means a person who:

1. Sells or offers for sale any good or service over the Internet; and

2. Solicits the purchase of such good or service over the Internet through an initial merchant after the consumer has initiated a transaction with the initial merchant.

The term does not include the initial merchant, a subsidiary or corporate affiliate of the initial merchant, or a successor of the initial merchant.

(2) A posttransaction third-party seller may not charge or attempt to charge a consumer’s credit card, debit card, bank account, or other account for any good or service sold in a transaction conducted over the Internet, unless:

(a) Before obtaining the consumer’s billing information, the posttransaction third-party seller clearly and conspicuously discloses to the consumer all material terms of the transaction, including:

1. A description of the goods or services being offered.

2. A statement that the posttransaction third-party seller is not affiliated with the initial merchant. Such statement must include the disclosure of the posttransaction third-party seller’s name in a manner that clearly differentiates the posttransaction third-party seller from the initial merchant.

3. The cost of such goods or services.

4. How and when the charges will be processed by the posttransaction third-party seller.

(b) The posttransaction third-party seller receives the express informed consent for the charge from the consumer whose credit card, debit card, bank account, or other account will be charged by:

1. Obtaining from the consumer:

a. The full account number of the account to be charged or other account information necessary to complete the transaction.

b. The consumer’s name and address.

c. A means to contact the consumer.

2. Requiring the consumer to perform an additional affirmative action, such as selecting a confirmation button or checking a box, which clearly and conspicuously indicates the consumer’s consent to be charged the amount disclosed.

(c) Before processing the consumer’s credit card or otherwise charging the consumer or soon thereafter, the posttransaction third-party seller sends written notice confirming the transaction to the consumer by first-class United States mail or e-mail. Such notice must clearly and conspicuously disclose the following:

1. The good or service purchased.

2. The amount that the consumer will be charged.

3. The timing and frequency of charges.

4. A short and plain statement disclosing the posttransaction third-party seller’s cancellation and refund policy.

5. A telephone number, mailing address, Internet website address, and e-mail address where the posttransaction third-party seller may be contacted.

6. The name of the initial merchant or fictitious name under which the initial merchant is doing business, if known.

7. The name of the posttransaction third-party seller or fictitious name under which the posttransaction third-party seller is doing business.

8. A statement that the posttransaction third-party seller is an unaffiliated and separate entity from the initial merchant.

9. A statement that the consumer is being charged by the posttransaction third-party seller for a transaction that is separate from the consumer’s transaction with the initial merchant.

If the posttransaction third-party seller sends the notice required under this paragraph by e-mail, the only words appearing in the e-mail’s subject line shall be “Notice that (name or fictitious name of the posttransaction third-party seller) is charging your (type of account) account.”

(3) An initial merchant may not disclose a consumer’s credit card number, debit card number, bank account number, or other account number, or disclose other consumer billing information, to a posttransaction third-party seller.

(4) A posttransaction third-party seller may not:

(a) Charge a consumer without providing a simple mechanism for the consumer to cancel the good or service and stop charges within a reasonable time after delivery of the written notice confirming the transaction; or

(b) Change its vendor code, or otherwise materially change the way the posttransaction third-party seller is identified on the consumer’s account, more than once per year, unless the posttransaction third-party seller provides the consumer with written notice of the change.

(5) A violation of this section is deemed an unfair or deceptive trade practice within the meaning of part II of chapter 501. A person who violates this section is subject to the penalties and remedies provided therein.