Protecting Privacy in Purchases Act

The bill would prohibit payment card networks from requiring firearms retailers to use, and would prohibit covered entities (payment processors and related businesses) from assigning, a merchant category code that identifies a business as a firearms, ammunition, accessories, or components seller. The Attorney General would enforce the ban, set up a complaint process within 90 days of enactment, investigate complaints, and could seek a federal injunction against networks or processors that fail to fix violations within 30 days of notice. The bill creates no private right of action. The bill would also preempt state and local laws regulating the assignment, use, or disclosure of firearms-specific merchant codes, though it would not block compliance with other fraud, dispute-processing, or cybersecurity rules. It would not restrict how card networks classify non-firearms merchants, and it would not change any other payment-processing regulation.

Payment card networks such as Visa and Mastercard, payment processors and other entities that assign merchant category codes, and firearms retailers who sell guns, ammunition, accessories, or components. State and local governments with existing merchant-code laws would also be affected, since their rules on this topic would be preempted.

Firearms retailers and gun-rights advocates have argued that a distinct merchant code could enable surveillance or discrimination against lawful gun purchases; this bill would foreclose that possibility nationwide. Payment networks and processors would face federal investigations and injunctions if they use or assign such codes, and states would lose authority to regulate the practice themselves.

Within 90 days of enactment, the Attorney General must establish a process for individuals, including firearms retailers, to file complaints about violations. The Attorney General investigates complaints, and if a violation is found, sends written notice requiring the payment network or covered entity to remedy it within 30 days; failure to comply allows the Attorney General to seek a federal court injunction. The Attorney General must also report annually to Congress on investigations, their outcomes, and data on the law's effectiveness.