Is it legal for a retailer to share credit card numbers with Nielsen/Billboard (USA)

Lately, in the music world, there is a big uproar over how fans purchase artist’s merchandise. It was set off when rapper 6ix9 accused Ariana Grande of cheating on sales because, as he claims, 60,000 of her merchandise bundle sales were purchased by just 5 credit cards. In reply to that, her manager, music mogul, Scooter Braun replied via Instagram that Billboard audits sales and anything over 4 sales per credit card will be thrown out.

There is a lot of background, but I will keep it brief.

  1. Neilsen (who collects music data on behalf of Billboard via Soundscan) has a point of sale system for brick and mortar physical music seller, but insists that "bundled" sales (music that sells as a download while buying non music merchandise) are handled through a musician’s personal website, with a latest reporting time of Friday afternoon for the prior week’s sales.
  2. Nielsen does impose a maximum of 4 sales of a particular bundled merchandise item per transaction. rules on reporting per shopify Billboard-Nielsen full details (January 2020)
  3. Shopify seems to be the go to site for most musician sites for selling merchandise. https://singlemusic.com/
  4. Shopify claims to report all sales automatically (electronically?) the next day to Neilsen Soundscan.
  5. Most musicians have their merchandise storefronts stop an end user from purchasing more than 4 of an item per transaction, but allows the user to buy more merchandise or song downloads after completing a transaction on the same card.
  6. No shops that I tested stopped a card from being used to purchase the exact same thing again.

That is a lot to unpack, I know, but I will stop here with my questions. As I am not sure who to believe, I am wondering if it is legal to submit the credit card number to Nielsen, a 3rd party? If not, could there have been a mistake in Scooter Braun’s word choice (credit card/transaction)? If credit card numbers are being passed to Billboard, wouldn’t musicians also have their developer code a restriction against reusing the same credit card? I don’t know, something doesn’t quite sync.

Thanks Tas