Privacy & Cybersecurity Law Blog

On August 19, 2026, the Federal Trade Commission announced that it is seeking public comment on a proposed enforcement policy statement regarding personalized pricing—the practice of using personal data to set prices based on what a company believes an individual consumer is willing to pay. The proposed policy statement outlines the FTC’s legal concerns with the practice and signals the agency’s intent to pursue enforcement actions against businesses that fail to make adequate disclosures to consumers.

Background

The proposed policy statement arrives amid a rapidly evolving regulatory landscape in which multiple states have enacted or introduced legislation targeting surveillance pricing. Maryland became the first state to enact a law directly prohibiting certain personalized pricing practices in the grocery sector, and New Jersey recently followed. Connecticut has amended its data privacy law to impose both disclosure requirements and substantive bans on surveillance pricing by retailers and third-party delivery services. New York also recently passed a bill prohibiting surveillance pricing. California’s Office of the Attorney General has launched an investigative sweep targeting businesses that use personal data for algorithmic pricing in potential violation of the California Consumer Privacy Act. Additional states, including Colorado and Illinois, also recently have considered legislation that would impose similar restrictions.

The FTC’s proposed policy statement represents the federal government’s most direct articulation to date of how existing consumer protection law applies to personalized pricing.

Key Provisions of the Proposed Policy Statement

The proposed policy statement emphasizes that consumers generally expect the prices they see to be the same prices offered to other consumers for the same product or service. According to the FTC, retailers who represent or imply that a price is static when it in fact varies by individual consumer are at risk of engaging in deceptive practices in violation of Section 5 of the FTC Act.

The statement further notes that the undisclosed collection or use of personal data for the purpose of setting personalized pricing could constitute both an unfair and a deceptive practice under the FTC Act. As FTC Chairman Andrew Ferguson stated in the announcement, “businesses that fail to tell consumers how their personal data is being used to set a price may be in violation of the FTC Act and other laws we enforce.”

The FTC also acknowledged the limits of its authority, noting that it “does not have the legal authority to ban personalized pricing in all circumstances.” Instead, the statement focuses on the disclosure obligations of businesses and the potential harms arising from opaque pricing practices. Specifically, the FTC observed that informed consumers might take protective measures, such as using a virtual private network, private browsing sessions, or simply avoiding retailers engaged in personalized pricing, if they were aware that their personal data was being used to set prices.

Public Comment Period

Once the statement is published in the Federal Register, interested parties will have 30 days to submit comments electronically. The FTC vote authorizing the Federal Register notice was 2-0.

Takeaways

The proposed enforcement policy statement is consistent with the broader trend of increased regulatory scrutiny of personalized and algorithmic pricing. While the FTC’s approach is disclosure-focused rather than prohibitory, it reinforces the message that businesses using consumer data to engage in personalized pricing face legal risk absent clear and conspicuous disclosures.

Businesses engaged in or considering personalized pricing practices should assess whether their current disclosures adequately inform consumers that personal data is being used to set prices. Companies should also monitor the FTC’s public comment process and the final policy statement, as well as the growing patchwork of state surveillance pricing laws, to ensure ongoing compliance across jurisdictions.