Surveillance Pricing: What It Is, Which Laws Apply, and How Compliance Teams Should Respond

Shoppers have started comparing phones. In a report published October 25, 2026, the Wall Street Journal described a man who saw a hard drive listed at $369 in Walmart’s app while the same drive showed up $110 cheaper on his wife’s phone. Walmart, McDonald’s and other large companies have rejected the idea that they set prices based on who is buying. The suspicion has spread anyway, and lawmakers have stopped waiting for proof that the practice is widespread before writing rules for it.

This explainer covers what surveillance pricing means, what the companies at the center of the debate have said, which laws are actually in force as of late October 2026, and what a privacy or compliance team should do if any part of its pricing touches personal data. The answer to that last question is usually “more than you think,” because the data that feeds a pricing model often comes from the same tags, SDKs and loyalty systems a privacy program already governs.

What surveillance pricing means

Surveillance pricing, also called personalized pricing or personalized algorithmic pricing, is setting the price a specific person sees based on personal data about that person: browsing and purchase history, location, device, inferred income or an estimate of how much they are willing to pay. Two people can see different prices for the same product at the same moment.

It is different from dynamic pricing, where a price moves for everyone based on demand, time or inventory. A concert ticket that costs more on Saturday night is dynamic pricing. A ticket that costs more for you because a model has decided you are less likely to comparison-shop is surveillance pricing. Electronic shelf labels sit in the middle of the debate: they make price changes faster to execute, but on their own they do not identify customers.

The Federal Trade Commission studied the tools behind the practice. In July 2024 it sent orders under Section 6(b) of the FTC Act to eight intermediary firms that sell pricing and promotion technology to retailers. In January 2025, staff released initial findings based on documents from six of them (Mastercard, Accenture, PROS, Bloomreach, Revionics and McKinsey & Co.). Staff found that signals ranging from precise location and browsing history to mouse movements and items left in an online cart can be used to tailor prices, and that the intermediaries worked with at least 250 clients, from grocery stores to apparel retailers. The Commission voted 3-2 to release the findings, with then-Commissioners Andrew Ferguson and Melissa Holyoak dissenting. The study was described as ongoing, and because 6(b) material is confidential, the published examples were hypothetical.

What the retailers say

The companies most often named in the debate have issued unusually direct denials. In an October 5, 2026 letter to Lindsay Owens of the Groundwork Collaborative, Walmart wrote: “We price products, not people. Walmart does not and will not use an individual customer’s personal information, income, shopping history, urgency or willingness to pay to set an individualized price.” The company also said it does not use dynamic pricing and that its digital shelf labels “do not identify customers, nor do they independently set prices.” Owens has publicly disputed Walmart’s account, pointing to the company’s patents.

McDonald’s responded to a Reuters report about a pricing recommendation tool by stating that “AI does not set the price of a Big Mac or any other menu item” and that franchisees set their own prices. The company is also defending a proposed federal class action that alleges the tool facilitates price coordination among franchisees, which McDonald’s has called “filled with inaccuracies.” Kroger has said publicly in recent years that it does not use dynamic or surge pricing to set individualized prices, even as it uses electronic shelf labels and AI-driven markdown tools for perishables.

Those statements are claims about current practice, not findings by a regulator. For compliance purposes they are still instructive. Each company drew its line in the same place: no use of an individual’s personal data to set that individual’s price. That is also the line most new laws draw.

The legal landscape as of October 2026

There is no federal ban. Four states have enacted laws that specifically address surveillance pricing, and they take different approaches. Scope matters more than headlines here, because most of the bans cover specific sectors.

Federal: the FTC’s proposed disclosure standard

On August 19, 2026, the FTC proposed an enforcement policy statement on personalized pricing. It says the Commission lacks authority to prohibit personalized pricing in all circumstances, but that where consumers reasonably expect prices not to vary based on their personal data, businesses should clearly and conspicuously disclose that a price is personalized, the basis for the personalization and the types of data used. Failing to make those disclosures, the draft says, is likely to be an unfair or deceptive practice under Section 5. The comment period was extended to September 25, 2026. As of this writing the statement is still a proposal, not a final policy. We covered the draft in more detail in the FTC’s draft enforcement policy on personalized pricing.

State laws in force or enacted

• New York (in force). The Algorithmic Pricing Disclosure Act, General Business Law § 349-a, requires a business that sets a price with an algorithm using a consumer’s personal data to display the statement “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA.” The attorney general began enforcing it on November 10, 2025. It is a disclosure rule, not a ban. See our explainer on New York’s algorithmic pricing law.
• Maryland (in force since October 1, 2026). The Protection From Predatory Pricing Act bars food retailers with stores of at least 15,000 square feet and third-party food delivery services from using personal data to set a price for a specific shopper for most groceries. Loyalty programs, subscriptions and differences based on supply, location or operating costs are allowed, and businesses get 45 days to cure before enforcement.
• New Jersey (effective August 1, 2027). The Fair Price Protection Act, signed by Gov. Mikie Sherrill in July 2026, prohibits using personal data to set individualized grocery prices and places a one-year moratorium on installing new electronic shelf labels. Our breakdown of New Jersey’s Fair Price Protection Act covers the exceptions.
• Connecticut (effective July 1, 2027). Signed by Gov. Ned Lamont in June 2026, Connecticut’s law broadly prohibits retail sellers and third-party delivery services from surveillance pricing, with exceptions for discounts and price differences unrelated to a shopper’s personal data. A later act delayed the provisions to July 1, 2027.

According to Stateline’s reporting, lawmakers in at least 11 states considered similar bills in 2026, often against opposition from business groups that argued the bills were broad enough to catch ordinary discounts. Several of those efforts stalled or failed this year. California’s AB 2564 did not reach the governor before the session ended, and Colorado’s governor vetoed a surveillance pricing bill, citing concern that it would sweep in common discounts. In New York, a broader ban known as the One Fair Price Act passed both chambers in June 2026 but, at last check, had not been signed. Any of these could return in 2027.

Where the data comes from

A pricing model is only as personal as the data it receives. For most retailers, that data is already moving through systems the privacy team knows about, often under a different label. A typical flow looks like this:

• Collected: on-site behavior from analytics and session tools (pages viewed, time on page, cart abandonment), app and device signals, precise or IP-based location, loyalty and account history, and sometimes third-party data bought from brokers.
• Recipients: the retailer’s pricing or promotion engine, an outside pricing intermediary, ad platforms that build audiences, and the data brokers that enrich profiles.
• Purpose: frequently recorded as “personalization,” “marketing” or “analytics,” which may not tell a regulator, or a consumer, that the data also influences price.
• Retention: behavioral data kept for model training long after the session that produced it.
• Controls: consent banners, opt-out signals such as Global Privacy Control, and loyalty program terms, which may or may not actually stop the data from reaching the pricing system.

That last point deserves attention. A consent banner that records a “reject” choice is not proof that the tag feeding the pricing engine stopped firing. A loyalty program’s terms are not proof that only loyalty data, and nothing inferred, sets the member price. The legal exposure lives in the gap between what the notice says and what the systems do.

What compliance teams should do now

Even a company that is confident it does not personalize prices should be able to show that. The FTC’s draft and New York’s disclosure rule both turn on facts about data use, and Maryland, New Jersey and Connecticut turn on them even more sharply. A practical sequence:

1. Ask the pricing question directly. Get a written answer from pricing, e-commerce and merchandising teams on whether any price, discount or ranking is influenced by data about an individual or their device. Include outside vendors, which may run models the business does not fully understand.
2. Map the inputs. For every pricing or promotion system, record what personal data it receives, from which source, for what purpose and for how long. A data map that lists the pricing engine as a recipient is the record you will want if a regulator asks.
3. Separate permitted from prohibited signals. The enacted laws allow certain loyalty, subscription, group and cost-based differences. Document which category each pricing variation falls into, and flag anything that depends on browsing behavior, device type or inferred willingness to pay.
4. Test the controls. Scan the site and app to confirm which tags and SDKs fire before and after a user opts out, and whether any of them feed pricing or promotion tools.
5. Update notices so they match practice. If personal data influences price or offers anywhere, say so plainly, and check New York’s required statement where it applies. If it does not, avoid language vague enough to suggest otherwise.
6. Review vendor contracts. Make sure pricing intermediaries cannot use your customers’ data to train models that set prices elsewhere, and that they will support disclosures, audits and deletion requests.
7. Plan by effective date. New York applies now and Maryland since October 1, 2026. New Jersey and Connecticut arrive in mid-2027. Assign owners and deadlines rather than treating “surveillance pricing” as one future project.

Captain Compliance’s data mapping software is designed for step two: it records systems, processing activities, data categories, purposes, recipients and retention, and flags unclear purposes or unapproved vendors for review. Our privacy notice generator, cookie scanning and consent management tools support the testing and notice steps. These tools help a team see and document what is happening; they do not make a pricing practice lawful, and the conclusions about scope and exceptions still need legal review.

Frequently asked questions

Is surveillance pricing illegal?

In most states there is no law that specifically addresses it. New York requires a disclosure. Maryland bans it for covered groceries sold by large food retailers and delivery services, and New Jersey and Connecticut have enacted bans that take effect in 2027. General consumer protection law, including the FTC Act, can still apply if the practice is deceptive or unfair.

Do loyalty discounts count as surveillance pricing?

Generally not under the enacted laws, which carve out loyalty, membership and similar programs. The details differ by state, so a program that relies on inferred data rather than published, uniform terms deserves a closer look.

Are electronic shelf labels a privacy issue?

The labels themselves display prices and do not identify shoppers. They become a concern when combined with in-store identification or personal data. New Jersey’s law places a temporary moratorium on new installations while the state studies their effects.

Does the FTC require disclosure today?

The August 2026 policy statement is a proposal. It signals how the Commission intends to approach enforcement under Section 5, but it is not a final rule, and the comment period closed September 25, 2026.

We only use personal data to give discounts, never to raise prices. Are we covered?

It depends on the law. Some exemptions cover publicly available or loyalty-based discounts, but a discount offered to one person and not another can still mean a higher effective price for everyone else. Document how each discount is decided and which data it uses.

For now, the major retailers say they price products, not people, and the laws largely agree that is where the line belongs. The harder question for most companies is whether they can prove which side of the line they are on, because the first time a regulator asks, the answer will come from the data map and the tag logs, not from the press release.