The Federal Trade Commission has put out a draft enforcement policy on personalized pricing. The target is not every custom quote. It is retailers and platforms that use personal data to set different prices and never say so in a way a shopper can actually see.
Stakeholders get 30 days to comment after the text lands in the Federal Register.
What Ferguson is willing to do
Chair Andrew Ferguson was direct about the legal box. The FTC “does not have the legal authority to ban personalized pricing in all circumstances, but businesses that fail to tell consumers how their personal data is being used to set a price may be in violation of the FTC Act and other laws we enforce.” He added that the current Commission “will not hesitate to enforce the law in this space.”
That is a disclosure theory, not a prohibition. Companies that can explain the inputs and show the personalization in plain language have a path. Companies that quietly vary the number based on location, browsing, or a profile assembled from the rest of the web do not.
The 2025 study and the change in chairs
Staff studied the practice in January 2025 and reported that sensitive information could feed prices on everyday goods. Then-Chair Lina Khan said the data in play could run “from a person’s location and demographics, down to their mouse movements on a webpage.”
Khan wanted more work after the administration changed. Ferguson stopped a follow-on request for information when he took the chair. In his dissent from the 2025 study he thanked staff and then called the product “far from a comprehensive report.”
“The Commission should not be releasing staff’s early impressions that ‘can be outdated with new information’ because the fact gathering process on the very issues being presented to the public is still underway,” he wrote. “Publishing ‘ideas’ and ‘initial observations’ accompanied by hypothetical use cases rather than robust factual findings may undermine the trust placed in the Commission’s Section 6(b) work.”
The new draft is his Commission’s first public line on how it will treat the same conduct: tell people the price is tailored, tell them why, name the kinds of data in the model.
States and Congress are already further down the road
Critics say disclosure is late and thin. Nidhi Hegde, executive director of the American Economic Liberties Project, told the Wall Street Journal the proposal is “two years too late and not nearly enough,” pointing to state bills that go past labels. Connecticut, Maryland, and New Jersey have banned some personalized pricing. Twenty-four other states have floated similar ideas.
Grace Gedye, a senior policy analyst at Consumer Reports, called the draft “encouraging” and then joined the same complaint about timing. “It should not be consumers’ responsibility to read detailed disclosures on each item while shopping online to avoid being hit with a higher price,” she said. “Instead, the FTC, Congress, and states should take action to prohibit companies from using consumers’ individual data to personalize prices in the first place.”
On the Hill the language is hotter. At an August 4 Senate Judiciary subcommittee hearing, Sen. Josh Hawley, R-Mo., called personalized pricing “one of the biggest scams in American history” and “the unholy trinity of everything Americans hate: spying on people, ripping them off, and taking away jobs.”
Rep. Frank Pallone Jr., D-N.J., ranking member on House Energy and Commerce, opened an inquiry in May to 25 companies and later added major airlines. He said he is “very concerned about companies potentially using Americans’ personal data to determine what prices they see and pay.” “Consumers deserve to know if businesses are using their personal information to manipulate the prices they pay or experiment with algorithms to set the prices they see.”
Hawley’s and Pallone’s offices did not immediately comment to the IAPP on the FTC draft.
What companies should do while comments run
If you vary price with identity, device, location, or inferred willingness to pay, assume the FTC will ask whether a reasonable shopper could see that fact and the data categories behind it. Fine print in a privacy policy is not “clear and conspicuous” next to the cart. Neither is a generic “prices may vary.”
Map the inputs. Separate inventory and inventory-based yield from person-level scoring. If a state already bars the practice, disclosure will not save a prohibited model. If you sell in Maryland, New Jersey, or Connecticut, read the statute before you write the banner.
The comment window is short. The political fight is not. The Commission is offering a Section 5 theory centered on hidden use of personal data. States and some members of Congress want the use itself off the table. Retailers and platforms that treat those as the same problem will write the wrong fix.