[qwename]

One could say that non-cash (debit/credit) transactions are recorded by the devices that enable them, and thus recorded and tied to an identity. The information could then be used by matching your card number when you use it online or elsewhere.

[ThrustVectoring]

This is at least complicated somewhat by PCI compliance. Are you allowed to store irrecoverable hashes of card numbers?

[mcpherrinm]

Yes, you can store tokens representing a credit card number (whether an hmac, database identifier, etc) outside of PCI scope. https://www.pcicomplianceguide.org/how-you-can-use-tokenizat...

[qwename]

I am not familiar with the PCI compliance stuff, but I found this after a quick search: "How Companies Learn Your Secrets" http://www.nytimes.com/2012/02/19/magazine/shopping-habits.h...

[tracker1]

You don't need the card number, the name + zip (+ store location) is enough to correlate enough of the time.