From Disclosures to Prohibitions: The New Legal Landscape on the Use of Consumer Data for Personalized Pricing

Three states—Maryland, Connecticut, and New Jersey—have enacted laws banning or restricting companies from using personal data for personalized pricing, with the FTC signaling potential enforcement and other states likely to follow. While these laws share the goal of regulating surveillance pricing, they differ significantly in their definitions, scope, covered entities, permitted exceptions, and enforcement mechanisms, creating a complex patchwork of requirements for businesses to navigate.

As spring 2026 turned into the dog days of summer, three states (in chronological order Maryland, Connecticut, and New Jersey) have enacted laws that, once they become effective, will ban or restrict companies from using personal data to set personalized prices. Other states are likely to follow suit. This type of pricing has been called by many names, depending on the features in focus, including algorithmic pricing, surveillance pricing or personalized pricing. But regardless of what it is called it has become one of the defining AI and privacy issues of the year with a flurry of state legislative action and the Federal Trade Commission (FTC) signaling potential enforcement ahead.

Two years ago (July 2024), the FTC initiated a market study and issued preliminary findings in January 2025 that highlighted emerging privacy and other consumer protection issues addressing surveillance and algorithmic pricing. On Aug. 19, 2026, the FTC followed up on its study with a proposed policy statement that commits to strong enforcement against companies that fail to appropriately disclose how personal data is used to set prices. See FTC, FTC Seeks Comment on Enforcement Policy Statement Regarding Personalized Pricing (Aug. 19, 2026). The FTC also announced a public comment period on the proposed policy statement, with comments due Sept. 25, 2026 (extended from Sept. 18, 2026). The comment period has closed, and the FTC has not yet issued a final policy statement.

Several state and city governing bodies have also been studying the issue, and taking action. On April 28, 2026, Maryland Gov. Wes Moore signed into law the Protection from Predatory Pricing Act—a statewide ban on certain merchants and delivery providers from using personal consumer data to dynamically price certain foods and food-delivery services. See H.B. 895, ch. 0154 (Apr. 28, 2026). This law, the first in the nation to enact an express prohibition on certain retail surveillance pricing practices, went into effect on Oct. 1, 2026. See Sections 1–2, 1, 10.

This summer, Connecticut Gov. Ned Lamont signed into law the nation’s second ban on surveillance pricing by retail sellers and food-delivery services, along with imposing certain online disclosure requirements on persons doing business in Connecticut that use such pricing. The statute phases the effective date of various provisions with some “data broker” related provisions taking effect as of Oct. 1, 2026. The surveillance pricing provisions of Connecticut’s law will go into effect on July 1, 2027. See Conn. Pub. Act No.26-130 (2026).

On July 23, 2026, New Jersey’s Gov. Mikie Sherrill signed into law the Fair Price Protection Act, which prohibits the use of online activity and other personal information to personalize prices for groceries and other necessities. The law also made New Jersey the first state to provide for a private right of action included in a surveillance pricing law (through the New Jersey Consumer Fraud Act). See Assemb. Comm. Substitute for Assemb. Nos. 4085 and 4523 (Third Reprint), 222d Leg. Sections 1–3, 9, (N.J. 2026). The New Jersey surveillance pricing prohibition will take effect on Aug. 1, 2027.

New York is on the cusp of becoming the fourth state to prohibit certain surveillance pricing—and is poised to adopt a broader prohibition than Maryland, Connecticut or New Jersey. Last year, New York became the first state to pass a law requiring businesses to disclose when they used personalized algorithmic pricing, but had not yet restricted the use of such algorithms. See N.Y. Gen. Bus. Law, ch. 20, art. 22-A, Section 349-A. New York’s State Assembly and New York State Senate passed the One Fair Price Act in June 2026, and it awaits action by Gov. Kathy Hochul. If signed, the legislation will broadly prohibit surveillance pricing, rather than adopting a sector-specific prohibition. In its current form, the bill mandates that “no entity or service provider shall collect, use, sell, retain, share for valuable consideration, or disclose personal data for the purpose of facilitating surveillance pricing to a consumer.” See S.B. 8623--B, An act to amend the general business law, in relation to prohibiting the use of surveillance pricing (Dec. 19, 2025).

As federal, state and even municipal policymakers continue to refine their approaches to surveillance pricing, businesses that understand how their pricing systems use personal data and build compliance, privacy principles and AI governance into those systems will be best positioned to adapt. Numerous state legislatures also have considered bills restricting surveillance pricing practices. See Jameson Spivack, The Price is Right: Responsible Uses of Personal Data in Pricing (Apr. 2026).

What Is 'Surveillance,' 'Personalized' or 'Algorithmic' Pricing?—an Elusive QuestionTo date, there is no consensus among governing bodies as to what constitutes “surveillance pricing.” The laws passed and bills to date focus on different criteria, even as policymakers across the country seek to regulate surveillance pricing. Some of the laws and proposed legislation focus on the mechanism of pricing, prohibiting pricing by algorithm. (This can create complications as there may be many types of algorithmic pricing that is in no way specific to a consumer or category of consumers). Other laws focus on the data inputs to pricing, prohibiting the use of individualized or personal data (even if not driven by algorithm) as a pricing input. And, some laws focus on the variability of the pricing, such as dynamic pricing.

For example, the synopsis to Maryland’s Protection from Predatory Pricing Act describes prohibited conduct as “dynamic pricing or using consumer personal data to set a price for consumer goods or services.” The New York bill defines the relevant pricing as “pricing set completely or in part by an algorithm that uses personal data to offer different prices to different customers for the same goods or services and does not include bona fide custom discounts.” See S.B. 8623--B(f) and S.B. 8623--A. The Connecticut law reads in relevant part:

“Surveillance pricing” means the practice of establishing a customized price for a consumer good or consumer service that is specific to a consumer or group of consumers based, in whole or in part, on the consumer’s personal data collected through any technology or technological method, system or tool, including, but not limited to, any biometric monitoring, camera, device tracking or sensor, that is used to gather personal data in a physical or digital environment, and by the person establishing the customized price either directly or indirectly by gathering, purchasing or otherwise acquiring such personal data from a third party.

Even municipalities are weighing in. For example, the City Council of Seattle passed the Fair Pricing and Transparency Ordinance on Sept. 22, 2026, and Mayor Katie Wilson signed it on Oct. 5, 2026. The ordinance, which takes effect on Sept. 1, 2027, prohibits “algorithmic-based price discrimination.” C.B. 121267 Section 35.000(B) (Seattle, Wash. 2026), which it defines as “the practice of setting, altering, or manipulating the price of goods offered to a consumer or a segment of consumers, based in whole or in part on monitoring, tracking, or automated analysis of the consumer's behavior, location, demographic characteristics, biometric data, or other personal information, including personal information acquired from a third party or personal information that is collected, gathered, purchased, or collected by a covered retailer using electronic surveillance technology.”

It includes practices such as using “an electronic shelf label system to display a price that has been modified using algorithmic-based price discrimination, for goods where a covered retailer is prohibited from using algorithmic-based price discrimination to modify the price of goods.”

At the federal level, the FTC has described personalized pricing as one where merchants “personalize prices for goods and services that traditionally did not vary from person to person and which American consumers therefore reasonably expect will not be any different for them than they will be for their friends or neighbors” but has stated that “Congress has not given the commission the authority to prohibit personalized pricing in all circumstances, but the commission intends to enforce the law aggressively against any deceptive or unfair personalized pricing practices that violate Section 5 of the FTC Act or any other law enforced by the commission.” See FTC, Federal Trade Commission’s Proposed Enforcement Policy Statement Regarding Personalized Pricing.

The Emerging Patchwork of Surveillance Pricing Laws

While the laws and bills discussed above address similar pricing practices, they take different regulatory approaches. Some states’ proposals may require disclosure of personalized pricing practices, and others may ban them altogether. Proposed legislation may target specific sectors—groceries, rideshares, housing—or broadly prohibit all “persons” from engaging in surveillance pricing. Also, they may anchor these claims under different classifications of consumer protection law. For example, California has framed surveillance pricing through a privacy lens, arguing that such practices may violate the California Consumer Privacy Act’s “purpose limitation principle,” which restricts businesses’ use of personal information to purposes consistent with consumers’ reasonable expectations. SeebCal. Dep’t of Just., Off. of the Att’y Gen., On Data Privacy Day, Attorney General Bonta Focuses on Surveillance Pricing, Compliance with California Consumer Privacy Act (Jan. 27, 2026). In contrast, the New York legislature justified the passage of the One Fair Price Act by framing surveillance pricing as a potentially deceptive trade practice that also presents risks of unlawful discrimination against certain protected classes.

The different approaches among these state laws underscore the importance of tracking not only if a state has enacted a surveillance pricing ban, but how that law is structured. As states contemplate policy strategies to regulate innovations in pricing, businesses may want to consider focusing on four features of each law: the entities regulated, the conduct prohibited and permitted, the scope of liability, and the applicable enforcement mechanisms.

Which Entities Are Regulated?

As referenced supra, state surveillance pricing laws and bills differ significantly in the entities they regulate—some barring surveillance pricing broadly, while some target specific sectors. For example, Maryland’s law applies to “food retailers” and “third-party delivery service providers.” Connecticut covers “retail sellers” and “third-party delivery services … outside a retail food establishment’s business operation, that facilitate delivery or online ordering services to retail food establishment customers.”

Several states explicitly exclude particular industries from their surveillance pricing laws. Connecticut and New York have certain exemptions applicable to insurers and creditors. Some states also extend coverage beyond the businesses that set consumer prices. New York’s proposed law would prohibit not only sellers from engaging in surveillance pricing, but also data collectors and providers from collecting, retaining or selling personal data for the purpose of facilitating surveillance pricing.

What Do the Laws Require?

States regulate surveillance pricing in two principal ways. Some require businesses to refrain from engaging in defined surveillance pricing practices, while others permit the practice but require heightened transparency.

Requiring disclosure of surveillance pricing is not new. Last summer, New York became the first state to regulate surveillance pricing by requiring businesses to disclose when they used personalized algorithmic pricing. However, neither New York nor any other state outright prohibited the practice at the time.
Maryland was the trailblazer. As described supra, the Protection from Predatory Pricing Act prohibits covered entities from engaging in personalized pricing in the food and delivery sectors.To comply with the law, regulated parties must abstain from setting personalized higher prices (subject to exceptions, some of which are described below).

Connecticut borrowed from both approaches and adopted a hybrid model. While the Constitution State’s law prohibits surveillance pricing by retail sellers and third-party delivery services, it permits other persons to engage in surveillance pricing provided they disclose that “THIS PRICE WAS INCREASED USING YOUR PERSONAL DATA” (or a substantially similar disclosure) in specified online transactions and advertisements and to notify consumers of their rights under the state’s consumer data privacy law.

New York is poised to change its current approach from mandating disclosure to mandating abstention. The One Fair Price Act would expand the disclosure regime to add a prohibition. Rather than simply requiring businesses to inform consumers that prices have been personalized, the proposed law would prohibit entities and service providers from using personalized pricing to set or adjust the price of a good or service.

What Do the Laws Permit?

Although surveillance pricing laws impose new restrictions on the use of personal data in pricing decisions, they generally seek to preserve pricing practices that consumers have come to expect. Many states’ legislation categorizes certain forms of discounts as legitimate—including status-based discounts for individuals, discounts associated with loyalty programs, or pricing that reflects actual differences in the cost of providing services.

Preserved discounts are often those offered to consumers based on self-identified characteristics, such as military status, veteran status, student status, educator status, or age. These statutory exceptions are generally available on equal terms to consumers who satisfy predefined eligibility criteria. New York’s proposed One Fair Price Act, for example, expressly excludes discounts offered to veterans, military personnel, educators, and senior citizens, provided the discounts are offered on equal terms to all qualifying consumers.

With regard to loyalty programs, the laws define the contours of these programs differently; and, the statutory exceptions for certain loyalty programs may not fully exempt some programs in their current implementation. Colorado’s 2021 privacy law, the Colorado Privacy Act (CPA), shows the challenges of defining and governing loyalty programs. Colorado has not enacted a surveillance pricing statute (Governor Jared Polis vetoed a proposed ban on June 2, 2026), but the CPA directly governs one aspect of personalized pricing by regulating certain disclosures relating to loyalty programs. In so doing, the CPA acknowledges that businesses may offer different prices, rates, levels, quality, or selection of goods or services through certain loyalty programs. See C.R.S. Section 6-1-1308(1)(d) (2025).

The Colorado Attorney General issued extensive implementing regulations to define and govern such a program. Colorado defines a “bona fide loyalty program” as one in which participation is voluntary, and whose primary purpose in processing personal data is to provide the “bona fide loyalty program benefits.” See Rule 2.02. To operate a bona fide loyalty program, the program must include detailed notices of how personal data is used, opt-out options, explanations of individuals’ legal rights, and measures to permit customers in certain circumstances to continue receiving non-personalized loyalty program benefits without sharing their personal data. Colorado privacy law defines “personal data” broadly as any information that is “linked or reasonably linkable to an identified or identifiable individual,” and excludes publicly available or deidentified data. The broad definition of personal data presents challenges; organizations must distinguish between their personalized and non-personalized loyalty program benefits, and determine a method of offering loyalty members non-personalized discounts.

The Colorado example demonstrates that determining what counts as a “bona fide loyalty program” may not be a simple exercise. Maryland’s Protection from Predatory Pricing Act, New York’s passed (but not yet enacted) One Fair Price Act and several other states’ similar bills often preserve some form of loyalty or rewards program. Yet, none to date provides the detailed statutory or regulatory guidance found in Colorado’s privacy framework. As a result, organizations may need to home in on where a traditional loyalty program ends and potentially prohibited surveillance pricing begins.

States also differ on whether consumers may consent to surveillance pricing, even outside of a loyalty program. Maryland, for example, permits personalized pricing where a consumer agrees to provide personal data in exchange for obtaining a given price. New York’s unsigned One Fair Price Act and Connecticut’s surveillance pricing law contain no comparable consent exception.

How Are the Laws Enforced?

State surveillance pricing laws also differ in the mechanisms they use to enforce compliance. While each law relies on public enforcement to some degree, states have taken different approaches to private litigation, administrative enforcement and the relationship between surveillance pricing laws and existing consumer protection statutes.

The first key distinction is the availability of a private right of action, which other than New Jersey, most states so far have rejected. Maryland incorporated the Protection from Predatory Pricing Act into the Maryland Consumer Protection Act. However, the Maryland law expressly does not create a private right of action. Enforcement rests exclusively with the Maryland Attorney General’s Consumer Protection Division, which must first provide notice and a 45-day opportunity to cure. See Md. Code Ann. Com. Law Section 13-321(e). Similarly, New York’s unsigned One Fair Price Act does not create an express private right of action—lawmakers removed an earlier private suit provision during negotiations and instead provided for enforcement directly by the Office of the Attorney General.

Specialized statutes aside, states could also impose penalties for surveillance pricing through existing legal frameworks. For example, California Attorney General Rob Bonta has characterized surveillance pricing as a potential privacy issue under the California Consumer Privacy Act’s purpose-limitation principle and has launched investigative sweeps examining businesses’ use of personal data for individualized pricing. This suggests that California may enforce restrictions on surveillance pricing under existing laws. California also seeks information regarding companies’ compliance with competition and civil rights laws, illustrating that regulators may view surveillance pricing through multiple legal lenses.

Preparing for Compliance

As surveillance pricing laws continue to proliferate, businesses may want to review their pricing systems’ use of personal data and assess whether those practices align with the varying requirements of emerging state laws. Businesses that engage in algorithmic pricing may want to begin by mapping how their pricing systems use personal data. They may also want to take a closer look at how that data affects pricing decisions and the operations of the algorithms, as well as which surveillance pricing laws (enacted and future-looking) apply to them, and whether they fall within the scope of particular legislative schemes or statutory exemptions.

Moreover, as surveillance pricing legislation continues to evolve, businesses may benefit from viewing compliance as an ongoing process rather than a one-time exercise. Organizations may want to position themselves for future developments by documenting how pricing algorithms use personal data, implementing safeguards governing the use of that data and monitoring new state legislation and regulatory guidance.

The emerging patchwork of surveillance pricing laws demonstrates that states are converging on the goal of regulating personalized pricing while diverging on the details. Businesses that understand how their pricing systems operate—and how those systems align with the differing requirements of state law—may be better positioned to adapt as this rapidly evolving regulatory landscape continues to develop.

Margaret M. Baughman, a 2026 summer associate with the firm in its Washington, D.C. office, contributed to the preparation of this article.

Reprinted with permission from the October 26, 2026 edition of Law.com © 2026 ALM Global Properties, LLC, trading as Centellic. All rights reserved. Further duplication without permission is prohibited, contact 877-256-2472 or asset-and-logo-licensing@alm.com.