FTC Proposes Enforcement Policy On Personalized Pricing As States And Congress Move Toward Broader Restrictions

The Federal Trade Commission (FTC) has taken another important step in the rapidly developing debate over “surveillance pricing.” On August 19, the FTC issued for public comment a Proposed Enforcement Policy Statement Regarding Personalized Pricing, warning businesses that using consumers’ personal data to set individualized prices without adequate disclosure may violate Section 5 of the FTC Act. 

The timing is noteworthy. The FTC’s proposal comes just two weeks after the Senate Judiciary Committee held a hearing entitled “Your Data, Their Profit: The Consumer Cost of AI Surveillance Pricing,” at which senators from both parties expressed concern about the use of personal information to determine what individual consumers pay. 

The FTC’s proposal also comes as states are beginning to enact laws specifically addressing surveillance pricing. Connecticut, Maryland and New Jersey have enacted laws this year restricting the use of personal data to set individualized prices, while lawmakers in numerous other states have considered similar legislation. 

The FTC’s approach, however, is narrower than some of these state laws and proposed federal legislation.

What the FTC Is Proposing

The FTC begins by acknowledging an important limitation: “Congress has not given the Commission the authority to prohibit personalized pricing in all circumstances.”

The Commission therefore is not proposing an outright ban. Instead, it says it intends to “enforce aggressively” against companies that use personalized pricing practices that violate Section 5’s prohibition against unfair or deceptive acts or practices.

Where consumers reasonably expect that a price will not vary based on their personal data, the FTC says businesses using personalized pricing should clearly and conspicuously disclose:

1. that the price is personalized;
2. the basis for the personalization; and
3. the types of data used to personalize the price.

According to the FTC, failure to provide those disclosures is likely to constitute a deceptive or unfair practice under Section 5. 

The Commission gives some striking examples:

A food-delivery company could raise a price based on information indicating that a consumer is unlikely or unable to leave home to purchase food. A grocery company could charge a customer more for milk because data indicates that several children live in the household. A hotel could charge more because it knows the customer is traveling for a funeral. And a rideshare company could charge more because data indicates that the customer has not installed competing rideshare applications—or because the customer appears to be experiencing a medical emergency. 

These examples demonstrate that the FTC is particularly concerned about using personal information to identify consumers who have less ability to walk away from a transaction.

The FTC Is Targeting the Lack of Transparency

The proposed policy statement relies on both deception and unfairness theories under Section 5.

The deception theory is relatively straightforward. If consumers reasonably believe that a price is the same price being offered to other consumers, a company may deceive them by failing to disclose that the price has actually been personalized.

The FTC also says that a company could mislead consumers about the basis for the price. For example, a consumer might believe that a lower price is a loyalty-program discount when the price actually reflects information about the consumer’s income or shopping behavior. 

The Commission separately concludes that some undisclosed personalized pricing could be unfair because consumers may suffer substantial injury that they cannot reasonably avoid.

Importantly, the FTC says it is not taking a position at this time on whether personalized pricing can be unfair even when it is fully disclosed. That reservation is significant. It leaves open the possibility of future enforcement against certain personalized-pricing practices even where disclosure has been provided.

The Proposal Does Not Prohibit Personalized Pricing

As stated above, the proposed policy statement does not establish a categorical prohibition on personalized pricing. Nor does it purport to declare that every instance of charging different consumers different prices violates Section 5. Indeed, the FTC expressly recognizes that price differences are sometimes legitimate. Insurance and credit, for example, necessarily involve individualized characteristics because the price reflects the risk associated with a particular consumer. The FTC also distinguishes personalized pricing from ordinary variations caused by supply, demand, geography, taxes and other market conditions. 

The proposal therefore leaves considerable room for legitimate dynamic pricing. At the same time, it makes clear that the FTC will not treat “personalized pricing” as a safe harbor simply because the company has an algorithm determining the price.

A Direct Connection to the Senate Judiciary Hearing

The FTC’s proposal fits squarely within the debate that emerged at the August 4 Senate Judiciary hearing.

Lee Hepner, one of the witnesses, advocated a much broader legislative prohibition on using personal information to set or inform individualized prices. He also argued for narrowly drawn exceptions for transparent discounts, such as publicly advertised senior, student or veteran discounts and equally available loyalty-program benefits.

Dr. John Zhang, another witness, presented the opposing economic perspective. He argued that personalized pricing can sometimes benefit consumers, particularly price-sensitive consumers, and cautioned against banning legitimate forms of price variation. He concluded that policymakers should target “abusive surveillance and market power — not every form of price variation.”

The FTC’s proposal occupies something of a middle ground. It does not endorse a general prohibition. Instead, it focuses initially on the information asymmetry between businesses and consumers and on whether consumers are being deceived or subjected to substantial injury without knowing that personalization is occurring.

Connecticut, Maryland and New Jersey Take Different Approaches Than the FTC

Connecticut’s recently enacted law provides one of the broadest state approaches. It generally prohibits retail sellers and third-party food-delivery services from engaging in “surveillance pricing,” defined as establishing a customized price for a consumer or group of consumers based on personal data collected through technology. The statute contains exceptions for certain legitimate discounts and rewards, as well as price differences attributable to justifiable cost differences, such as delivery distance or time. 

Maryland’s Protection From Predatory Pricing Act restricts the use of personalized pricing, consumer data-driven pricing, and certain AI-enabled pricing practices, particularly in the food retail (operating establishments of at least 15,000 square feet) and delivery sectors. Although the statute expressly excludes financial institutions from portions of the law, it should be viewed as an important signal of where Maryland state lawmakers may be headed next.

New Jersey’s Fair Price Protection Act also takes a targeted approach. It prohibits retail food stores and third-party grocery-delivery platforms from using personalized algorithmic pricing, surveillance pricing, or other pricing strategies that vary grocery and other food prices based on personal data. 

So far this year, there have been 11 other states that have introduced bills specifically dealing with surveillance pricing.

These laws illustrate an important point: there is not yet a uniform state approach to surveillance pricing. The scope of covered businesses, products, data and permissible pricing practices varies from state to state. 

States May Not Need a New Surveillance-Pricing Statute

There is another, potentially less appreciated, avenue for state enforcement. States do not necessarily need to enact a statute specifically addressing surveillance pricing.

Virtually every state has a statute prohibiting unfair or deceptive acts or practices which are often referred to as a UDAP statute or “mini-FTC Act.” These statutes generally authorize state attorneys general or consumer-protection agencies to challenge conduct that is unfair or deceptive, much as the FTC does under Section 5 of the FTC Act. 

Some state statutes go further by expressly directing state regulators and courts to look to Section 5 of the FTC Act and FTC precedent when interpreting the state statute. Connecticut’s Unfair Trade Practices Act, for example, expressly provides that the commissioner and state courts “shall be guided by” interpretations of Section 5(a)(1) of the FTC Act by the FTC and federal courts. The Connecticut Supreme Court has repeatedly recognized this statutory linkage. 

That means the FTC’s proposal could have an impact beyond FTC enforcement. If the Commission ultimately adopts the policy, state regulators operating under UDAP statutes that look to Section 5 precedent may have a ready-made framework for addressing surveillance pricing without waiting for their legislatures to enact new special legislation targeted at surveillance pricing.

This state activity creates an increasingly complicated compliance environment for businesses operating nationally.

The Federal Debate Is Now Moving

The Senate hearing demonstrated that surveillance pricing is no longer simply a consumer-advocacy issue.

Chairman Josh Hawley and Ranking Member Richard Durbin expressed substantial concerns about the practice, while Senator Richard Blumenthal called for a federal law, federal standards and national safeguards. Hawley has indicated that he intends to pursue legislation, and Blumenthal said that he and Hawley already have a legislative framework under discussion. (

The FTC’s proposal adds another piece to that rapidly developing picture. For now, the Commission is saying: businesses do not necessarily have to stop using personalized pricing, but they cannot assume that consumers have no right to know that it is happening.

The larger question, one that Congress and the states will have to resolve, is whether disclosure is enough or whether the use of personal information to determine individualized prices should itself be prohibited.

The debate over surveillance pricing therefore is not simply a question of whether Congress or the states will enact new laws. The FTC has now signaled that existing federal law may already provide a basis for challenging undisclosed personalized pricing. And in many states, existing UDAP statutes may provide a similar enforcement vehicle. The result is that businesses may face meaningful regulatory risk even in states that have not enacted a surveillance-pricing-specific prohibition.

And with the states moving toward outright restrictions and bipartisan interest emerging in Congress, this is an issue that businesses using AI and consumer data to set prices will need to watch very closely.