Cal. Civ. Code § 1789.135
To protect against fraud and identity theft, when a credit services organization sends a written communication by facsimile, electronic mail, United States mail, overnight courier, or other means that contains personal information of a consumer, the credit services organization shall redact the personal information to include only the last four digits of the social security number, taxpayer identification number, or state identification number, the last four digits of the financial account number, credit card number, or debit card number, or the month and year of the consumer's date of birth, unless the inclusion of the full number or date is otherwise required by law, or is legally permissible and required to achieve the desired objective. Redacting information pursuant to this subdivision shall not be considered a violation of subdivision (w) of Section 1789.13.
Ca. Civ. Code § 1789.135