Protecting Privacy in Purchases Act

The prohibition on merchant category codes was broadened. Previously it only banned codes that distinguished firearms retailers from general-merchandise or sporting-goods retailers. Now it bans any code used 'only or primarily for firearms retailers' or that identifies a retailer as selling firearms, ammunition, accessories, or components.

A new preemption limitation was added allowing payment card networks and covered entities to comply with any Federal, State, or local law related to dispute processing, fraud, compliance management, or protecting transaction integrity from illegal or suspicious activities, data breaches, or cyber risks.

The preemption clause was broadened from preempting state/local laws 'regulating merchant category codes for firearm retailers' to preempting laws 'regulating the assignment, use, or disclosure of merchant category codes' that identify firearms retailers, covering a wider range of regulatory activity.

The definition of 'firearms retailer' was significantly expanded to include 'accessories of firearms' and 'components of firearms' (previously only firearms and ammunition), added 'retail location' as a covered type of entity, added a requirement that the entity be 'physically located in the United States,' and removed the word 'lawful.'

The definition of 'covered entity' now explicitly includes entities that already have a relationship with a merchant as of the date of enactment, not just those establishing new relationships afterward.

The definition of 'payment card network' changed 'licensed member' to 'network participant' and added 'prepaid transactions' alongside credit and debit transactions.