That whole sentence is even more interesting: "the FTC alleges that CafePress failed to implement reasonable security measures to protect sensitive information stored on its network, including plain text Social Security numbers, inadequately encrypted passwords, and answers to password reset questions." Why would CafePress have anyone's SSN? I suppose potentially a merchant selling on it might need to have provided banking details, but that still doesn't seem like it should include a SSN?
An individual can sell custom/branded merchandise on CafePress. If CafePress is sending more than $600 per year to an individual, they have to issue a 1099, which has to have a TIN, which is going to be an SSN for most individuals.
> You must show your individual name and you may also enter your
business or DBA name on the “Business name/disregarded entity”
name line. You may use either your SSN or EIN (if you have one), but the
IRS encourages you to use your SSN.
That's straight from the W-9 instructions. You _can_ use an EIN. In my opinion you _should_ use an EIN.
Now I'm even more confused, heh. From the previous page:
> If you are a single-member LLC that is disregarded as an entity
separate from its owner, enter the owner’s SSN (or EIN, if the owner has
one). *Do not enter the disregarded entity’s EIN*
Edit: I suppose the distinction is that you should have an EIN for your name
