Key points

• Personalized pricing, sometimes called surveillance pricing, uses data about an individual shopper to set or adjust the price that shopper sees. It is now a legislative and enforcement priority.
• New York already requires a conspicuous disclosure when a price is set by an algorithm using personal data, and other states have introduced bills that would disclose, restrict or ban the practice.
• Existing law reaches the practice without any new statute. Unfair and deceptive practices laws, state privacy laws, anti-discrimination law and, in some settings, antitrust law all apply.
• Retailers should inventory where individualized pricing and offers occur, document the inputs, and be ready to explain them to a regulator in plain terms.
• Loyalty offers, coupons and dynamic pricing are not all personalized pricing in the legal sense. Drawing that line carefully early reduces both over-compliance and exposure.

Why lawmakers are focused on pricing

Retailers have long varied prices by location, channel, time of day and inventory. What has changed is the volume and granularity of the data now available. When a retailer can combine purchase history, device signals, location and inferred income or urgency, a price can in principle be tailored to what a particular shopper is likely to accept. Legislators and regulators describe this as surveillance pricing, and the label alone signals how the issue is being framed.

The Federal Trade Commission opened a study of the practice in 2024 and published preliminary observations about the data and tools vendors offer. Federal policy since then has been less settled, which has left states to move first. For retailers operating nationally, the result is a patchwork that is still forming.

What states have done so far

New York's algorithmic pricing disclosure law is the clearest example. It requires a business that sets prices using an algorithm that relies on a consumer's personal data to display a prescribed statement next to the price. A trade association challenged the law, and a federal court declined to block it, so businesses serving New York consumers have needed to assess whether the law reaches their pricing.

Other states, including California, have seen bills that would go further, for example by restricting the use of certain categories of personal data in pricing, or by prohibiting individualized price increases. Several bills have addressed grocery and food retail in particular, reflecting political concern about household costs. Most proposals have been narrowed, delayed or amended as they moved, and the text a retailer reads in September may not be the text that passes. We recommend tracking bills by their operative definitions, because the scope of terms such as personal data, algorithm and price determines who is covered.

Existing law already applies

No dedicated statute is needed for a regulator to ask whether a pricing practice is unfair or deceptive. State attorneys general have broad authority under their consumer protection statutes, and the FTC Act prohibits unfair or deceptive acts or practices. Three fact patterns draw the most attention: prices that differ materially between shoppers without any disclosure, claims such as lowest price or member price that are not accurate for the individual, and pricing that appears to track a shopper's inferred vulnerability or urgency.

Privacy law adds a second layer. Many comprehensive state privacy laws give residents the right to opt out of profiling used for decisions with significant effects, and they limit the processing of sensitive data. Where sensitive inferences feed a pricing model, the processing may require consent. Notices must also describe the purposes accurately. A privacy notice that says data is used to improve services may not be enough if the data is used to set individual prices.

Anti-discrimination law matters as well. If a pricing model produces systematically different outcomes by reference to a protected characteristic, even through proxies such as geography, the retailer may face questions under civil rights and fair lending style theories, depending on the sector and state.

Antitrust and algorithmic pricing

Personalized pricing is a distinct issue from algorithmic pricing coordination, but the two are often discussed together. When several competitors use the same pricing vendor, regulators and private plaintiffs have asked whether shared tools and data amount to an agreement or an unlawful exchange of information. Retailers should keep the two questions separate in their analysis and read our related note on algorithmic pricing and information exchange.

A practical approach

First, build an inventory. Identify every place where price, discount or offer varies by shopper, and record what data feeds each decision. Many retailers discover that the pricing engine, the loyalty program and the marketing platform each make individualized decisions that were never reviewed together.

Second, classify. Time-limited promotions open to everyone, location-based pricing tied to costs and standard loyalty benefits are different from a system that changes a price based on a predicted willingness to pay. The legal analysis should follow the actual mechanics rather than the internal label.

Third, test the disclosures. Where a state requires a notice, check that it appears where the price appears, in the required wording, on every channel including apps and kiosks. Where no notice is required, consider whether the retailer would be comfortable explaining the practice publicly.

Fourth, put governance around changes. Data science teams can alter a model quickly. A lightweight review by legal and compliance before new inputs are added, with a record of the decision, is a modest cost against the reputational and enforcement risk.

Corvane Ryle's Privacy & Cyber, Consumer Protection and Antitrust & Competition teams work together on pricing questions for retailers, marketplaces and technology providers.