Surveillance Pricing Laws Are Taking Effect. What Do They Require?

What Is Surveillance Pricing?

Surveillance pricing is the practice of setting a price for a specific consumer, or a group of consumers, based on their personal data. New York's law calls it "personalized algorithmic pricing," while the FTC calls it personalized pricing. Connecticut and New Jersey use the term surveillance pricing and define it to include data gathered through device tracking, cameras, and sensors, in physical or digital environments.

The data can come from many sources, including the tracking tools on websites and apps. In January 2026, California's Attorney General asked businesses how they use "shopping and internet browsing history, location, demographics, inferential, or other data" to set prices. A year earlier, FTC staff noted that placing an item in a cart without buying it "could hypothetically be used to infer" a shopper's "emotional state, purchase intent, or financial sensitivity."

Surveillance pricing is different from dynamic pricing, in which prices change for everyone based on conditions such as demand or the time of day. The new state bans generally exempt price differences based on costs or supply and demand. However, New York's law defines its covered practice as "dynamic pricing set by an algorithm that uses personal data," so the two can overlap.

Which States Regulate Surveillance Pricing?

Four states have enacted surveillance pricing laws, each with its own scope, requirements, and exemptions. The table lists them and an unsigned New York bill:

Based on the New York, Maryland, Connecticut, and New Jersey texts, as of October 2026.

New York's disclosure has to read "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA," in the same medium as the price and near it. In a January 2026 letter to Instacart, the Attorney General said a disclosure reached by clicking fine print "does not appear to comply" with the law. A federal judge rejected a First Amendment challenge to the law in October 2025. That ruling is on appeal.

New York's legislature also passed the One Fair Price Act, which would replace the disclosure with a ban on setting prices "using surveillance pricing." As of October 31, 2026, the bill had not been delivered to the Governor.

Connecticut's law also requires any business that uses surveillance pricing online for a reason other than offering a discount to label those prices "THIS PRICE WAS INCREASED USING YOUR PERSONAL DATA." It must also tell consumers about their rights under the state's privacy law.

New Jersey's law makes a violation an unlawful practice under the state's Consumer Fraud Act. That Act gives consumers who suffer a financial loss the right to sue.

Other states have stopped short of a ban. Governor Polis vetoed Colorado's bill in June 2026, writing that it would also penalize lower prices. California's AB 2564 passed both houses but never received a final vote.

How Are the FTC and California Approaching It?

In August 2026, the FTC proposed an enforcement policy statement noting that Congress "has not given the Commission the authority to prohibit personalized pricing in all circumstances." Instead, where consumers expect prices not to vary based on their personal data, it says businesses should disclose that a price is personalized, "the basis for that personalization," and the types of data used. Failing to make these disclosures "is likely to constitute an unfair or deceptive act or practice," according to the statement.

The proposed statement adds that collecting or using personal data for personalized pricing "without adequate disclosures or without obtaining consent" may also violate federal law. One of its examples describes a retailer charging more on its website because data shows the visitor is inside one of its stores or parking lots. The comment period closed in September 2026. A final version has not been published.

On October 28, 2026, the FTC ordered nine companies, including Walmart, Target, and Delta, to explain whether their prices vary from one consumer to the next. The orders are part of a study, not an enforcement action. FTC Chairman Andrew Ferguson said that consumers "deserve to know whether companies use their web surfing habits or other personal data to estimate the highest price they can charge each consumer."

California's Attorney General is approaching the practice through the CCPA. As part of a January 2026 sweep, the office sent letters to businesses with a significant online presence in the retail, grocery, and hotel sectors. The announcement cites the law's "purpose limitation principle," which limits the use of personal information to purposes consistent with consumers' reasonable expectations. It says businesses that use data to set individualized prices in ways consumers "might not expect" may be violating California law.

What Does This Mean for Businesses?

Businesses that do not set individual prices may still use tools that personalize offers, such as discounts triggered by browsing behavior or abandoned carts. Some of these tools may rely on the same data that the tracking tools on their websites collect.

Whether these offers are covered depends on the state. Maryland's ban applies only to higher prices, while Connecticut and New Jersey exempt certain discounts and loyalty programs. In contrast, New York's disclosure law exempts discounts only for existing subscribers. The state's Attorney General has described individualized discounts in apps and loyalty programs as common forms of algorithmic pricing.

The FTC's proposed statement and California's sweep both depend on what consumers reasonably expect. A privacy notice that never mentions pricing may make it harder to show that consumers expected their data to be used that way. When businesses begin using personal data to set prices, their privacy notices may need to be updated to describe it.

I recommend that businesses confirm whether any of their pricing, discount, or promotion tools use personal data, including data from the tracking tools on their websites and apps. Where they do, businesses should check their price displays and privacy notices against the rules in each state where they sell.