Pub. L. 108-159, tit. I, subtit. A, sec. 113
TRUNCATION OF CREDIT CARD AND DEBIT CARD ACCOUNT NUMBERS.
SEC. 113. TRUNCATION OF CREDIT CARD AND DEBIT CARD ACCOUNT NUMBERS. Section 605 of the Fair Credit Reporting Act (15 U.S.C. 1681c) is amended by adding at the end the following:“(g) Truncation of Credit Card and Debit Card Numbers.—“(1) In general.—Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.“(2) Limitation.—This subsection shall apply only to receipts that are electronically printed, and shall not apply to transactions in which the sole means of recording a credit card or debit card account number is by handwriting or by an imprint or copy of the card.“(3) Effective date.—This subsection shall become effective—“(A) 3 years after the date of enactment of this subsection, with respect to any cash register or other machine or device that electronically prints receipts for credit card or debit card transactions that is in use before January 1, 2005; and“(B) 1 year after the date of enactment of this subsection, with respect to any cash register or other machine 117 STAT. 1960 or device that electronically prints receipts for credit card or debit card transactions that is first put into use on or after January 1, 2005.”.