Surveillance Pricing: How Your Data Shapes What You Pay

Last updated 2 weeks ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.

Two shoppers can be offered different prices for the same product because of their personal data, according to the Federal Trade Commission (FTC). A personal offer can benefit one shopper and disadvantage another.

The practice is called surveillance pricing: using information about a particular consumer to set an individualized price. A personalized price is not automatically unlawful.

A shopper trying to avoid an expensive offer can compare prices, limit tracking or both. Without knowing what information shaped the price, the shopper may not know which change might affect the next offer.

When the price responds to the shopper

The FTC also uses the term personalized pricing for the use of personal data to set prices according to the amount a company believes a consumer is willing to spend. The FTC contrasts personalized pricing with changes in supply and demand that affect everyone participating in the same market. A market-wide price change and a personal offer may look the same on a screen, but only the personal offer uses information about a particular shopper.

The limited economic research cited in a policy statement the FTC proposed in August 2026 suggests that some consumers benefit while others lose, and that consumers are less likely to benefit as the practices grow more sophisticated. A personalized price is therefore not always a higher one, but the reason for a difference can be hidden from the shopper weighing the offer.

In January 2025, FTC staff published research summaries of their initial findings, labeled a staff perspective, from a study of the practice that was then underway. Those findings describe that early work; they are not a claim that every retailer now uses each method.

How a data trail becomes an offer

The FTC study focuses on intermediaries: middlemen hired by retailers that can adjust and target prices by algorithm. The staff perspective says the same product could have a different price or promotion depending on a consumer’s behavior and preferences and on where, when and through which channel the consumer buys.

In their initial findings, FTC staff identify location, demographics, browsing patterns and shopping history among the information used to target pricing. Staff also found that mouse movements on a webpage and products left unpurchased in an online cart can be tracked and used to tailor prices.

In the initial staff findings, the intermediaries examined worked with at least 250 clients, including grocery stores and apparel retailers. That figure describes the reach of the intermediaries examined; it does not show what share of purchases are priced personally or how much the practice costs any one shopper.

The staff perspective also describes the capacity to steer shoppers toward higher-priced products based on search and purchase activity. Its hypothetical illustration involves a consumer profiled as a new parent who sees higher-priced baby thermometers on the first page of search results. The example shows how the set of choices presented can matter even without changing the price printed on an individual product.

What the FTC findings establish

In July 2024 the FTC issued orders to eight firms under its Section 6(b) authority, which allows wide-ranging studies without a specific law-enforcement purpose, to obtain information for the study. Participation in that study does not itself establish that a firm violated the law.

The FTC describes the research summaries as a preview of a study underway. The agency says it aggregates or anonymizes information to protect trade secrets, which is why its staff perspective uses hypothetical examples. The thermometer example shows how a method works; it is not a documented account of a real parent receiving a particular offer. The examples do not establish how many shoppers are affected.

Federal law and a proposed disclosure policy

The Federal Trade Commission Act declares unfair methods of competition and unfair or deceptive acts or practices in commerce unlawful. A practice counts as unfair under that law only if it causes or is likely to cause substantial injury to consumers that they cannot reasonably avoid and that is not outweighed by benefits to consumers or to competition. Those conditions require more than showing that two shoppers saw different prices.

Personalized pricing is also not the same as price fixing. The FTC's competition guidance says price fixing requires an agreement among competitors and that each company generally must establish its prices independently. A seller personalizing its own offer and competing sellers agreeing on prices raise different questions.

The FTC’s policy statement on personalized pricing is a proposal: the agency posted it for public comment on August 18, 2026, and comments were due September 25, 2026. By October 2026, that deadline had passed; the proposal should not be treated as a completed new rule.

Where consumers reasonably expect that a price will not vary based on their personal data, the proposal says businesses should clearly disclose that the price is personalized, the basis for it and the types of data used. The draft describes failure to make those disclosures as likely unfair or deceptive under existing law. The FTC says it lacks authority to prohibit all personalized pricing outright. For consumers, a disclosure could make the reason for a price more visible without guaranteeing a lower price.

Maryland restricts certain grocery pricing

Maryland's Chapter 154 took effect October 1, 2026, after approval by the governor on April 28, 2026. The law prohibits covered food retailers and third-party delivery service providers from using personalized dynamic pricing or personal data to set a higher price for food exempt from Maryland's sales and use tax. The Comptroller lists eggs, fruit, vegetables and unheated meat among grocery foods that can be tax-exempt when sold by a substantial grocery or market business for consumption off the premises. The protection is tied to particular food transactions and covered businesses, so it is not a statewide ban on every personalized retail price.

Under this law, dynamic pricing means a consumer-specific personalized price based on personal data, whether the seller collected or purchased that data. Here the phrase describes personalization, rather than every price change caused by supply and demand.

A covered food retailer operates an establishment of at least 15,000 square feet that sells the specified tax-exempt food. A third-party delivery service provider facilitates delivery of that food as a consumer service and does not include a food retailer.

The covered businesses also may not use protected-class data in offering or selling consumer goods or services if the effect is to withhold or deny a consumer access or benefits provided to others. The law defines protected-class data as information that directly or by implication identifies a characteristic legally protected from discrimination under state or federal law. Maryland's public-accommodation law, for example, protects race, sex, age, color, creed, national origin, marital status, sexual orientation, gender identity and disability.

The statute excludes customer-retention promotions and temporary discounts, objective shipping or tax costs, geographic supply-demand differences, and costs associated with availability or supply. Other exceptions cover voluntary loyalty or rewards programs open to any consumer, subscription agreements, prices obtained by consenting to provide information, pricing-error corrections and resets after outages. A lower membership price or a location-related cost difference should not automatically be treated as evidence of a prohibited practice.

Before an enforcement action under this law, a business must receive a notice of violation and 45 days to fix, or cure, it. If the business cures the violation in that time, an enforcement action under this law may not be brought. The law also does not authorize a private right of action, so a consumer cannot sue a business under this statute alone.

In an April 23, 2026 letter to the governor, Maryland Attorney General Anthony G. Brown found the bill constitutional and legally sufficient but warned that the cure requirement would fundamentally weaken enforcement. He wrote that cure provisions can be appropriate for technical or inadvertent violations but not for dynamic pricing, which he called a deliberate business strategy. The requirement, he wrote, would leave the state to bear the cost of complex investigations while a business that stops only after a notice faces no penalty. That is Brown's assessment of the enforcement design before enactment, not a demonstrated account of how the new law has performed.

Disclosure and data rights in other states

New York's Algorithmic Pricing Disclosure Act requires most businesses to display a clear notice near prices personalized using consumer data, according to the state attorney general. The required notice states, “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA.” That notice identifies personalization; it does not promise that the price is lower or prohibit the transaction.

The disclosure section excludes insurance-regulated parties, specified financial institutions and affiliates, and prices offered to existing subscribers below the price in their subscription agreement. It also excludes location data that for-hire or transportation-network vehicles use solely to calculate a fare from a trip’s mileage and duration. So a missing notice has to be weighed against those exclusions; not every price difference requires one.

New York legislators have also advanced the One Fair Price Act, A9349B/S8623B, which would prohibit surveillance pricing and the use of personal data to facilitate it. The bill passed both chambers and was returned to the Assembly on June 4, 2026. The Assembly action history ends with that return and lists no later delivery to the governor, signature or veto. After passage in both chambers, a New York bill goes to the governor, who can sign it, allow it to become law without a signature or veto it. That record documents legislative passage, rather than a completed ban.

Under the California Consumer Privacy Act (CCPA), California residents may opt out of the sale of their personal information and of its sharing for advertising that tracks activity across different contexts. The request can also be made through an opt-out preference signal the user turns on. An opt-out preference signal, such as Global Privacy Control, is a browser setting or extension that automatically sends an opt-out request to covered businesses you visit online. You can turn on a supported signal in your browser settings or install an extension that sends it. Businesses cannot resume the sale or sharing after an opt-out unless the consumer later consents. Those rights address the flow of information that can feed personalization, rather than setting a single lawful retail price.

California regulations prohibit a price difference imposed because a consumer exercised CCPA rights. A difference is allowed when it is reasonably related to the value of the consumer’s data and the business can support it with a good-faith estimate of that value.

Actions that help, and what they cannot prove

The FTC recommends deleting cookies and browsing history, resetting phone tracking identifiers and adjusting browser privacy and location settings. Those steps reduce the tracking they address; they do not guarantee the lowest available price. Private browsing can erase local history when the session ends, but does not stop websites from seeing online activity, the FTC cautions.

New York’s attorney general recommends comparing an item’s price before and after an action the business can track, such as searching for the item elsewhere or shopping from a new location. A new price afterward may be a sign that it was set using personal data. Keep a record of the price, product, timing and any nearby disclosure when evaluating or reporting a concern. A price difference is worth noting, but ordinary market changes and lawful exceptions can also explain it.

Maryland’s attorney general lists rights under the state’s data privacy law: to know what personal data businesses have and how they use it, correct inaccurate data, request deletion with some exceptions, and opt out of the sale or sharing of their data. Those rights concern the data that can feed a personalized price, and only businesses the law covers must honor them. That law, which is separate from the grocery pricing law, covers businesses that operate in Maryland or target its residents if, in the prior calendar year, they controlled or processed the personal data of at least 35,000 Marylanders. It also covers those that handled the data of at least 10,000 Marylanders and derived more than 20 percent of gross revenue from selling personal data.

Maryland consumers can submit a complaint to the Consumer Protection Division online or by mailing its complaint form. The FTC takes reports of fraud, scams and bad business practices at ReportFraud.ftc.gov. The FTC says it does not act on individual complaints. It and its law-enforcement partners use complaints to identify enforcement targets and, with appropriate safeguards, as evidence in enforcement proceedings. A report can contribute to oversight without becoming a promise of a personal refund.