Surveillance Pricing: How Your Data Shapes What You Pay

Last updated 7 hours ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.

Two shoppers can be offered different prices for the same product because of their personal data, according to the Federal Trade Commission (FTC). A personal offer can benefit one shopper and disadvantage another.

The practice is called surveillance pricing: using information about a particular consumer to set an individualized price. A personalized price is not automatically unlawful.

A shopper trying to avoid an expensive offer can switch sellers, limit tracking or both. Without knowing what information shaped the price, the shopper cannot tell which change might affect the next offer.

When the price responds to the shopper

The FTC contrasts personalized pricing with changes in supply and demand that affect everyone participating in the same market. A market-wide price change and a personal offer may look similar on a screen, but they answer different questions. One asks what the market will bear; the other uses information about a particular person to shape the offer.

The information need not announce a budget or a maximum price to become relevant to a sale. A history of shopping choices can be treated as a clue about what someone wants and how to present it.

The limited economic research summarized in the FTC's Proposed Enforcement Policy Statement Regarding Personalized Pricing suggests that benefits to some consumers accompany losses to others. The risk is not simply that every personalized price is higher, but that the basis for the difference can be hidden from the person evaluating the offer.

FTC Surveillance Pricing 6(b) Study: Research Summaries, a staff perspective dated January 2025, presents initial findings from the study. The following findings describe that initial work, rather than a claim that every retailer now uses each method.

How a data trail becomes an offer

In their initial findings, FTC staff identify location, demographics, browsing patterns and shopping history among the information used to target pricing. The findings also identify mouse movements and products left in a cart without a purchase as details intermediaries can use to tailor prices. That makes the relevant data trail broader than a list of completed purchases.

The FTC study focuses on intermediaries that retailers hire to algorithmically target prices to consumers. The staff perspective says the same product or promotion can vary with behavior, preferences, location, timing and purchase channel. An intermediary supplies a connection between the seller's offer and the information associated with the shopper. For a consumer trying to understand a price, the retailer's visible checkout screen is only the end of that chain.

In the initial staff findings, the intermediaries examined worked with at least 250 clients, including grocery stores and apparel retailers. That describes the reach of the intermediaries examined, rather than the share of all purchases priced personally. A client count cannot establish how often a particular shopper encounters the practice or how much it costs that shopper.

The staff perspective also describes the capacity to steer shoppers toward higher-priced products based on search and purchase activity. Its hypothetical illustration involves a consumer profiled as a new parent who sees higher-priced baby thermometers on the first page of search results. The example shows how the set of choices presented can matter even without changing the price printed on an individual product. A shopper deciding among the visible results is also deciding within a selection someone else has arranged.

What the FTC findings establish

The FTC uses its Section 6(b) authority, which allows wide-ranging studies without a specific law-enforcement purpose, to obtain information from eight firms. Participation in that study does not itself establish that a firm violated the law.

The FTC's surveillance-pricing feature describes the research summaries as a preview of a study underway. The agency says it aggregates or anonymizes information to protect trade secrets, which is why its staff perspective uses hypothetical examples. The thermometer example explains a mechanism; it is not a documented account of a named parent receiving a particular offer. At the October 2026 check, the FTC continued to describe the work as a preview, so the examples should not be read as a completed population-wide impact assessment.

Federal law and a proposed disclosure policy

The Federal Trade Commission Act declares unfair methods of competition and unfair or deceptive acts or practices in commerce unlawful. For an unfairness finding, the law requires substantial or likely substantial injury that consumers cannot reasonably avoid and that is not outweighed by benefits to consumers or competition. Those conditions require more than showing that two shoppers saw different prices. The legal question includes how the practice works, what harm it causes and whether consumers can avoid that harm.

The FTC's competition guidance says price fixing requires an agreement among competitors and that each company generally must establish its prices independently. A seller personalizing its own offer and competing sellers agreeing on prices raise different questions. Using software does not make those two mechanisms interchangeable.

The proposed statement remains listed as proposed on the FTC public-comment page, which records a September 25, 2026 comment deadline. By October 2026, that deadline had passed; the proposal should not be treated as a completed new rule.

Where consumers reasonably expect prices not to vary based on personal data, the proposal calls for clear disclosure of personalization, its basis and the types of data used. The draft describes failure to make those disclosures as likely unfair or deceptive under existing law. The FTC says it lacks authority to prohibit all personalized pricing outright. The proposed approach focuses on an undisclosed practice that conflicts with consumer expectations, rather than declaring every personal offer unlawful. For consumers, a disclosure could make the reason for a price more visible without guaranteeing a lower price.

Maryland restricts certain grocery pricing

Maryland's Chapter 154 took effect October 1, 2026, after approval by the governor on April 28, 2026. The law prohibits covered food retailers and third-party delivery service providers from using personalized dynamic pricing or personal data to set a higher price for food exempt from Maryland's sales and use tax. The protection is tied to particular food transactions and covered businesses, so it is not a statewide ban on every personalized retail price.

Under this law, dynamic pricing means a consumer-specific personalized price based on personal data, whether the seller collected or purchased that data. Here the phrase describes personalization, rather than every price change caused by supply and demand. The statutory definition matters more than the label a business puts on its pricing technology.

A covered food retailer operates an establishment of at least 15,000 square feet that sells the specified tax-exempt food. A third-party delivery service provider facilitates delivery of that food as a consumer service and does not include a food retailer.

The covered businesses also may not use protected-class data to deny a consumer an accommodation, advantage or privilege accorded to others in offering or selling consumer goods or services. The law defines protected-class data as information that directly or by implication identifies a characteristic legally protected from discrimination under state or federal law. Maryland's public-accommodation law, for example, protects race, sex, age, color, creed, national origin, marital status, sexual orientation, gender identity and disability. In plain language, this provision bars using that information to withhold access or benefits offered to other customers.

The statute excludes customer-retention promotions and temporary discounts, objective shipping or tax costs, geographic supply-demand differences, and costs associated with availability or supply. Other exceptions cover voluntary loyalty or rewards programs open to any consumer, subscription agreements, prices obtained by consenting to provide information, pricing-error corrections and resets after outages. A lower membership price or a location-related cost difference should not automatically be treated as evidence of a prohibited practice.

Before enforcement, Maryland's Office of the Attorney General must give notice and 45 days to cure a violation; a timely cure bars an enforcement action. The law does not authorize a private right of action. A consumer cannot rely on this statute alone as permission to bring a personal lawsuit. For public enforcement, correction after notice can end the matter before an action begins.

In an April 23, 2026 assessment, Maryland Attorney General Anthony G. Brown warned that the cure requirement fundamentally weakens enforcement after technical investigations have already incurred costs. That is Brown's assessment of the enforcement design before enactment, not a demonstrated account of how the new law has performed.

Disclosure and data rights in other states

New York's Algorithmic Pricing Disclosure Act requires most businesses to display a clear notice near prices personalized using consumer data, according to the state attorney general. The required notice states, “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA.” That notice identifies personalization; it does not promise that the price is lower or prohibit the transaction. A disclosure approach and Maryland's restriction on specified grocery prices give consumers different kinds of protection.

The disclosure section excludes insurance-regulated parties, specified financial institutions and affiliates, and prices offered to existing subscribers below the price in their subscription agreement. It also excludes trip-location data used by the specified for-hire or transportation-network vehicles solely to calculate fares from mileage and trip duration. A missing notice therefore has to be assessed against those limits, rather than assuming every price difference requires one.

New York legislators have also advanced the One Fair Price Act, A9349B/S8623B, which would prohibit surveillance pricing and the use of personal data to facilitate it. The Assembly tracker records passage in both chambers and return to the Assembly on June 4, 2026, with no enactment listed. At the October 2026 status check, passage by legislators had not become an enacted replacement for the disclosure framework.

Under the California Consumer Privacy Act (CCPA), California residents may opt out of the sale of personal information and its sharing for advertising that tracks activity across different contexts, including through a user-enabled opt-out preference signal. Businesses cannot resume the sale or sharing after an opt-out unless the consumer later consents. Those rights address the flow of information that can feed personalization, rather than setting a single lawful retail price.

California regulations prohibit discriminatory price differences because a consumer exercised CCPA rights, but permit differences reasonably related to the value of the data when supported by a good-faith estimate. Exercising a privacy right and voluntarily obtaining a data-linked benefit are not treated as the same situation.

Actions that help, and what they cannot prove

The FTC recommends deleting cookies and browsing history, resetting phone tracking identifiers and adjusting browser privacy and location settings. Use those controls to reduce the tracking mechanisms they address; do not treat them as a guarantee of the lowest available price. Private browsing can erase local history when the session ends, but does not stop websites from seeing online activity, the FTC cautions.

New York's attorney general recommends comparing prices before and after actions a business can track, such as a search elsewhere or a change in location, as possible signs of personalization. Keep a record of the price, product, timing and any nearby disclosure when evaluating or reporting a concern. A price comparison is a useful observation, but ordinary market changes and lawful exceptions can still complicate its explanation.

Maryland's consumer-data privacy guidance identifies rights to know how data is used, correct inaccurate data, request deletion with exceptions, and opt out of sale or sharing. A request for information or correction targets the data behind an offer, instead of requiring a shopper to infer that data from a price alone. That separate privacy law covers Maryland-serving entities processing at least 35,000 residents' data in the prior year, or at least 10,000 residents' data while deriving more than 20 percent of gross revenue from personal-data sales. Its coverage test differs from the grocery pricing law's store-size and transaction requirements.

Maryland consumers can submit a complaint to the Consumer Protection Division online or by mailing its complaint form. The FTC takes reports of fraud, scams and bad business practices at ReportFraud.ftc.gov. The FTC says it does not act on individual complaints; it and its law-enforcement partners use complaints to identify enforcement targets and, with appropriate safeguards, as evidence in enforcement proceedings. A report can contribute to oversight without becoming a promise of a personal refund.

A changed number on a screen is the beginning of the inquiry, not its conclusion. The useful next step is to connect the offer to the information used, the business and transaction involved, and the protection that actually applies. That connection turns a suspicion about an expensive purchase into a question a consumer or regulator can examine.