• by Wendy Davis , Staff Writer @wendyndavis, February 11, 2011

When Jessica Pineda checked out via credit card at a Williams-Sonoma store in California, the store clerk requested her ZIP code. Pineda provided it, only to find that the store used that information, combined with her name, to learn her street address and send her marketing catalogs.

Pineda then filed a class-action lawsuit, alleging that Williams-Sonoma violated a California law that bans marketers from asking credit card purchasers for personal identification information.

This week, the California Supreme Court agreed with Pineda. ZIP codes, the court ruled, constitute personal identification information for purposes -- at least for purposes of the state's law regarding credit card transactions.

That decision is in line with what researchers, statisticians and others have long known: Data that seems meaningless in itself can be combined with other information to create portraits of specific individuals. It's also in line with a growing body of examples detailing how people were identified based on "anonymous" information.

Consider, AOL's "Data Valdez" -- the company's decision to release search queries for 650,000 "anonymized" users -- showed that people's names could be discovered based on their search queries. Likewise researchers at the University of Texas published research concluding that it was possible to identify specific Netflix users by comparing reviews of obscure movies on Netflix with reviews on Imdb.com that were published under screen names.

Many ad companies have traditionally argued that any privacy risks posed by behavioral targeting are negligible because ad companies that track people online don't collect personally identifiable information. If nothing else, the California Supreme Court's ruling this week seems to indicate that behavioral targeting companies might have a hard time pressing that point to lawmakers, regulators and judges.