In an earlier stage of this litigation, the Supreme Court held that the Little Tucker Act, 28 U.S.C. § 1346(a)(2), does not waive the sovereign immunity of the United States in a suit seeking to collect damages for an asserted violation of the Fair Credit Reporting Act (FCRA), 15 U.S.C. §§ 1681-1681x. United States v. Bormes, — U.S. -, 133 S.Ct. 12, 184 L.Ed.2d 317 (2012). Although the case reached the Supreme Court from the Federal Circuit, the Supreme Court remanded it to us, because the suit originated in the Northern District of Illinois. (The original appeal had been routed to the Federal Circuit only because of the Tucker Act.) The Supreme Court told us to decide “whether FCRA itself waives the Federal Government’s immunity to damages under § 1681n.” Id. at 20.
James Bormes, an attorney, tendered the filing fee for one of his suits via-pay.gov, which the federal courts use to facilitate electronic payments. The web site sent him an email receipt that included the last four digits of his credit card’s number, plus the card’s expiration date. Bormes, who believes that § 1681c(g)(l) allows a receipt to contain one or the other of these things, but not both, then filed this suit against the United States seeking damages.
Any “person” who willfully or negligently fails to comply with the Fair Credit Reporting Act is liable for damages. 15 U.S.C. §§ 1681n(a), 1681o(a). “Person” is a defined term: “any individual, partnership, corporation, trust, estate, cooperative, association, government or governmental subdivision or agency, or other entity.” 15 U.S.C. § 1681a(b) (emphasis added). The United States is a government. One would suppose that the end of the inquiry. By authorizing monetary relief against every kind of government, the United States has waived its sovereign immunity. And so we conclude. (As far as we can tell, this is the first appellate decision on the issue.)
The United States maintains that the definition should not be given its natural meaning. As originally enacted in 1970, § 1681n authorized damages against only consumer reporting agencies and users of information. In 1996 Congress amended § 1681n to authorize damages against all “persons.” According to the United States, none of the legislative history analyzing or explaining this amendment discusses the fact that this change, applied according to the terms of § 1681a(b), exposes the Treasury to monetary awards. Because Congress in 1996 did not evince knowledge of how the revised version of § 1681n interacts with § 1681a(b), the argument concludes, the FCRA does not waive sovereign immunity for damages even though the definition of “person” includes the United States.
The United States concedes that it is a “person” for the purpose of the Act’s substantive requirements. It denies only that § 1681n authorizes damages. But if the United States is a “person” under § 1681a(b) for the purpose of duties, how can it not be one for the purpose of remedies? Nothing in the FCRA allows the slightest basis for a distinction.
The absence of legislative history discussing sovereign immunity in 1996 is hardly surprising. Immunity had been waived in 1970. Why bring the subject up again? Apparently no one in the Executive Branch asked Congress to revise the definition in § 1681a(b) when changing the category of entities for which § 1681n authorizes awards of damages.
The argument that a silent legislative history prevents giving the enacted text its natural meaning has been made before— and it has not fared well. Why should Congress have to reenact § 1681a(b), or *796repeat it in the committee reports, every time it amends some other portion of the statute? Section 1681a(b) does what it has done since 1970, no matter what happens to other sections, and what § 1681a(b) does is waive sovereign immunity for all requirements and remedies that another section authorizes against any “person.”
Congress need not add “we really mean it!” to make statutes effectual. See, e.g., Swain v. Pressley, 430 U.S. 872, 378 & n. 11, 97 S.Ct. 1224, 51 L.Ed.2d 411 (1977); Harrison v. PPG Industries, Inc., 446 U.S. 578, 592, 100 S.Ct. 1889, 64 L.Ed.2d 525 (1980) (“it would be a strange canon of statutory construction that would require Congress to state in committee reports or elsewhere in its deliberations that which is obvious on the face of a statute”). It takes unequivocal language to waive the national government’s sovereign immunity, Department of Energy v. Ohio, 503 U.S. 607, 615, 112 S.Ct. 1627, 118 L.Ed.2d 255 (1992), but this means unequivocal language in a statute, not in a committee report.
The FCRA says that courts may award punitive damages for willful violations. 15 U.S.C. § 1681n(a)(2). According to the government, this shows that § 1681n can’t apply to it, no matter what § 1681a(b) says, for there is a tradition that the United States is not subject to punitive damages. (The Federal Tort Claims Act, for example, forbids them. 28 U.S.C. § 2674 ¶ 1.) A tradition differs from a rule of law, however. Congress can authorize punitive awards against the United States. If the interaction of § 1681a(b) and § 1681n(a)(2) creates excessive liability — which it won’t if federal officers obey the statute — then the solution is an amendment, not judicial rewriting of a pellucid definitional clause. See, e.g., Michigan v. Bay Mills Indian Community, — U.S. - 134 S.Ct. 2024, 2033-34, 188 L.Ed.2d 1071 (2014).
The government also observes that three provisions of the FCRA expose “persons” to criminal penalties, which in principle could include state prosecutions. 15 U.S.C. §§ 1681n, 1681p, 1681s. The United States expresses incredulity that Congress could have authorized state prosecutions of federal employees. But why not? The idea that a criminal prosecution of a federal employee alleged to have deliberately violated a federal statute might begin in state court is not so outlandish that we should read § 1681a(b) to mean something other than what it says. Federal employees’ protection is the right to remove and have the adjudication in federal court, see 28 U.S.C. § 1442(a)(1), not a rule of construction that eliminates the possibility of prosecution altogether.
The United States has one final argument about the scope of § 1681a(b). It observes that the definition treats states and the national government identically. Its brief maintains that Congress lacks the authority to subject states to damages through statutes enacted under the Commerce Clause, see Seminole Tribe v. Florida, 517 U.S. 44, 116 S.Ct. 1114, 134 L.Ed.2d 252 (1996), and asks us to infer that, since states need not pay damages, the national government need not do so either.
The premise of this argument is not entirely correct. States may not be at risk of damages in private litigation, but the United States may enforce the FCRA against the states and collect damages. See Monaco v. Mississippi, 292 U.S. 313, 328-29, 54 S.Ct. 745, 78 L.Ed. 1282 (1934) (collecting authority). No state has sovereign immunity vis-á-vis the national government. And if we are to consider how § 1681a(b) treats other sovereigns, what of foreign governments, which are “persons” under that statute? Foreign governments that engage in commerce in the United *797States cannot invoke immunity under the Foreign Sovereign Immunities Act. See generally Argentina v. NML Capital, Ltd., — U.S. -, 134 S.Ct. 2250, 189 L.Ed.2d 234 (2014). If the definition in § 1681a(b) exposes foreign nations to damages for commercial activity, why not the United States?
What is more, the conclusion of this argument would not follow if the premise had been correct. No rule of law establishes that, if states cannot be liable, then the United States is not liable. The Religious Freedom Restoration Act illustrates the point. It forbids all governmental bodies to impose substantial burdens on religious exercise, unless those burdens are justified by a compelling governmental interest. 42 U.S.C. § 2000bb-1. City of Boerne v. Flores, 521 U.S. 507, 117 S.Ct. 2157, 138 L.Ed.2d 624 (1997), holds that Congress lacks authority under § 5 of the Fourteenth Amendment to subject states to that substantive rule. If the argument the United States makes here were sound, units of local government and the United States today would be free of RFRA’s obligations. But since Boeme the Supreme Court has continued to apply the statute to the United States. See, e.g., Burwell v. Hobby Lobby Stores, Inc., — U.S. -, 134 S.Ct. 2751, 189 L.Ed.2d 675 (2014); Gonzales v. O Centro Espírita Beneficente União do Vegetal, 546 U.S. 418, 126 S.Ct. 1211, 163 L.Ed.2d 1017 (2006). These decisions show that federal statutes can apply to the national government even if principles of sovereign immunity prevent awards of damages against the states. Congress can give consent for itself even though not for the states.
Our conclusion that § 1681a(b) waives the United States’ immunity from damages for violations of the FCRA brings us to the question whether Bormes has a good claim. The United States, which prevailed in the district court on a sovereign-immunity defense, 638 F.Supp.2d 958 (N.D.I11. 2009), has asked us to affirm on the merits if we rule against it on sovereign immunity. It is entitled to make such an argument in defense of its judgment without the need for a cross-appeal. Massachusetts Mutual Life Insurance Co. v. Ludwig, 426 U.S. 479, 96 S.Ct. 2158, 48 L.Ed.2d 784 (1976).
Bormes relies on 15 U.S.C. § 1681c(g)(l), which provides that “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.” (The exception in § 1681c(g)(2) for transactions completed by handwriting or an imprint does not apply.) Bormes reads this statute to forbid the display of both the last few digits (pay.gov used four rather than five) and the expiration date in the same document. We may assume that this is correct. But the United States maintains that it did not “print” anything — instead it sent Bormes an email, which was electronic. If the email was printed after receipt, that was Bormes’s doing rather than its own, the government maintains. Moreover, whatever printing took place was not “provided ... at the point of the sale or transaction.” Bormes transacted with a web site, and the receipt was sent to his email account, from which he could obtain access in multiple ways over the Internet.
This conclusion has the support of Shlahtichman v. 1-800 Contacts, Inc., 615 F.3d 794 (7th Cir.2010). Bormes concedes that Shlahtichman is dispositive against him but asks us to overrule it. Because the only other appellate decision on the subject has agreed with Shlahtichman, see Simonoff v. Expedia, Inc., 643 F.3d 1202, 1207-10 (9th Cir.2011), overruling would create a conflict among the circuits. *798Nonetheless, Bormes maintains, reading § 1681c(g)(l) as Shlahtichmcm did makes the statute substantially inapplicable to transactions on the Internet, and he thinks that we should avoid that consequence in order to achieve more of what he sees as the legislative goal.
Having persuaded us to stick with the text of § 1681a(b) and reject the United States’ arguments about good public policy, Bormes can hardly expect us to do an about face and modify the text of § 1681c(g)(l) in favor of his own arguments about good public policy. The text is what it is, no matter which side benefits. We said in Van Straaten v. Shell Oil Products Co., 678 F.3d 486 (7th Cir.2012), that § 1681c(g) would be applied as written, without contraction or enlargement based on anyone’s notions of wise policy.
To the extent policy matters, we don’t get Bormes’s argument. The concern underlying § 1681c(g)(l), as we explained in Van Straaten, is that receipts printed at the point of sale may be thrown away on the spot. If those receipts contain the full name, card number, and expiration date of the credit card, they may facilitate identity theft. But if nothing is printed at the point of sale, the risk is substantially less. (Indeed, without most of the credit card’s 15 or 16 digits, the risk is zero; adding the expiration date to the last four numbers does not pose a risk.) A consumer might print an email at home, then throw it away, but few people search residential garbage in quest of credit-card numbers; before § 1681c(g) the pickings were much better in stores.
As we have said, however, arguments pro and con about wise policy are irrelevant. The statute as written applies to receipts “printed ... at the point of the sale or transaction.” The email receipt that Bormes received meets neither requirement. So although the United States has waived its immunity against damages actions of this kind, it did not violate the statute and prevails on the merits.
Affirmed