Surveillance pricing: one price, published rules

Two people look at the same product, on the same site, at the same moment. One sees a higher price. Not because stock ran low or a sale ended, but because a system decided that person would probably pay more.

That is surveillance pricing. Its supporters call it personalised pricing. The mechanics are the same.

What it is

Surveillance pricing sets a price, discount or offer for an individual using data about that individual. The inputs vary:

• what they browsed, searched for or left in a basket
• the device or browser they use
• where they are, precise or inferred
• their purchase history and how price-sensitive they have been before
• a model’s estimate of their income, circumstances or willingness to pay

It is not the same as dynamic pricing, where prices move for everyone at once with demand, stock or time of day. A train fare that rises as seats sell out is dynamic. A fare that rises because you are on a new phone is surveillance pricing.

Evidence that it happens

Hard evidence is thin, because the point of the practice is that each customer sees only their own price. But there is some.

The FTC study. On 17 January 2025 the US Federal Trade Commission released initial staff findings from a study of six firms that sell pricing and personalisation tools to retailers. The FTC said those firms served at least 250 clients, and that their tools could use data such as precise location, demographics, browsing history, mouse movements and items left in a basket to set targeted prices. The commission voted 3–2 to release the findings; the two Republican commissioners dissented. These were preliminary findings about what the tools are sold to do, not a count of how often prices were personalised in practice.

The Instacart tests. In December 2025 Consumer Reports, the Groundwork Collaborative and More Perfect Union published a study using more than 400 volunteers shopping at the same time in four US cities. They found that nearly three-quarters of the grocery items tested showed different prices to different shoppers, and that basket totals for identical items varied by about 7%. Instacart said the tests were randomised and never based on personal data, demographics or individual shopping behaviour. On 22 December 2025 it said it would end them. New York’s Attorney General wrote to the company in January 2026 asking about its pricing and its compliance with the state’s disclosure law.

The Instacart case matters for a different reason than the FTC study. It was not, on the company’s account, personal-data pricing. It was undisclosed price experimentation. To the shopper at the till, the difference is hard to see.

Where the law stands

United States

New York. The Algorithmic Pricing Disclosure Act took effect on 10 November 2025. If a price is set by an algorithm using a consumer’s personal data, the business must show, clearly and near the price: “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA.” The Attorney General enforces it, with penalties of up to $1,000 per violation. A federal court dismissed a First Amendment challenge by the National Retail Federation in October 2025. A stronger bill, the One Fair Price Act, which would ban surveillance pricing outright, passed the legislature in June 2026. As of early September 2026 it had not been signed.

Maryland. The Protection from Predatory Pricing Act, signed in April 2026, takes effect on 1 October 2026. It bars large food retailers (15,000 sq ft and over) and third-party delivery services from setting personalised prices for food and some household goods from personal data. It allows promotions, loyalty schemes, subscription pricing and cost-based differences.

Connecticut. A law passed in June 2026 bans surveillance pricing by retail sellers and third-party delivery services across retail, not only food, with exceptions for published discounts, group discounts such as students and veterans, loyalty schemes and cost-based differences. It also requires a disclosure where a price is increased using personal data. Most sources give the start date for these provisions as 1 July 2027.

New Jersey. Signed on 23 July 2026, New Jersey’s law bans surveillance pricing on groceries and related goods from 1 August 2027. It is the first of these laws with a private right of action.

California. A surveillance pricing bill, AB 446, was moved to the Senate’s inactive file in September 2025. Other proposals are in the legislature. Nothing specific to personal-data pricing is in force.

European Union

The EU has no dedicated ban. Since May 2022, the Consumer Rights Directive, as amended by the Omnibus Directive, has required traders selling online or off-premises to tell consumers when a price has been personalised on the basis of automated decision-making. The European Commission plans a Digital Fairness Act, with a proposal expected in the fourth quarter of 2026, to deal with “unfair personalisation practices” among other things. Whether it covers pricing, and how, will be clear only when the text is published.

United Kingdom

There is no UK law aimed at personalised pricing. The Competition and Markets Authority has studied it since at least 2018, and its January 2021 paper on algorithms listed personalised pricing as a potential consumer harm, while noting the evidence was “uncertain, though growing”. Its June 2025 work on dynamic pricing focused on demand-based pricing, not personal data. General law still applies: misleading consumers about how a price is set is prohibited under the Digital Markets, Competition and Consumers Act 2024, which gives the CMA power to fine directly. Using personal data for pricing also has to meet UK GDPR.

Our pledge: P-1

Pledge P-1 is short. No price or offer is set by predicted willingness to pay, device, inferred location or browsing. Declared, published criteria are fine.

The test

Could you publish the rule that set the price? “Students get 10% off with a valid card” can go on your website. “People on newer phones who looked twice get no discount” cannot. If you would be uncomfortable writing the rule down, that is usually the answer.

A/B price tests

Price testing is common and often harmless in intent. But a shopper who is randomly shown a higher price has still paid more than their neighbour without knowing why. The pledge text treats undisclosed price tests as out. If you test prices, tell people: on the page, at the time, in plain words. Testing copy, layout or images is not affected.

What to check

Ask whoever runs pricing, and the vendor behind any pricing tool, three things. Which inputs can change a price or offer? Can any of them be tied to one person or device? Could we publish the full list today? If a tool can use browsing, device or location, switch those inputs off and keep the vendor’s written confirmation.