. . . "The state's consumer privacy law, adopted in 1997, exempts some businesses such as gas stations that require ZIP codes for security purposes." .