States are leading the charge to combat data-driven pricing manipulation as federal regulators try to catch-up, potentially saddling companies with a patchwork of compliance obligations.
This year, state lawmakers have introduced more than 70 bills to crack down on surveillance pricing across industries, including travel, grocery stores, and rental markets. Meanwhile, the FTC recently raised concerns about transparency around personalized pricing in an advanced notice of proposed rulemaking regarding unfair and deceptive practices in online food and grocery delivery services.
But companies in those industries warned that cracking down on the technology could impose burdensome compliance costs and hamper their ability to offer discounts.
“The compliance risk is real. With different definitions and requirements potentially across more than a dozen states, companies are left with little guidance on how to comply at scale and this creates untenable risk for serious penalties,” David Shapiro, chief legal officer of rebate app Ibotta Inc., wrote in an email. “That reduces savings for consumers and stifles innovation.”
FTC Weighs in
Surveillance pricing, also known as data-driven pricing, is the term economists and lawmakers use to describe the practice of companies using a customer’s personal data to determine the price of a good.
The Federal Trade Commission popularized the term when it launched an investigatory study into the practice in 2024. The fate of the work has been unclear after new leadership at the agency closed a comment period on its request for information in January 2025.
But FTC Chairman Andrew Ferguson reignited interest when he told Congress at an April oversight hearing the agency’s work on the issue continues. He said agency staff is exploring whether to issue a policy statement on required disclosures around the use of “highly personalized pricing.” He also pointed to the agency’s investigation into Instacart’s plans to use algorithmic price testing, which the company dropped after scrutiny.
However, with state surveillance pricing bills already becoming law, it’s unlikely the FTC will pose as big a threat to the practice as states anytime soon, said Joanna Forster, partner at Crowell & Moring.
“It’s not a game-changer,” she said.
Interest from federal lawmakers into the practice, however, could complicate the landscape. In March, the House Oversight and Government Reform Committee sent letters to several travel and retail companies, including Booking Holdings Inc., Expedia Group Inc., Uber Technologies Inc., and Lyft Inc.
Expedia and Lyft both denied using personalized data to set prices in emailed statements.
“Lyft prices rides, not riders,” Sid Patil, Lyft’s executive vice president of marketplace, said in a statement. “Static pricing would result in significant service gaps, disproportionately harming riders in rural communities, low-income areas, and transportation deserts.”
States Move Ahead
When Maryland Gov. Wes Moore (D) signs the Predatory Pricing Act, recently passed by the General Assembly, it will become the first law in the US to ban grocery stores from using surveillance data to set individualized prices and curb other forms of dynamic pricing.
The surveillance pricing bill is the first of many that state lawmakers are pushing to enact this year. Hawaii, California, Illinois, Kentucky, and Connecticut are among more than a dozen states with over 70 pending bills to regulate or prohibit pricing tailored to consumers’ personal data.
The wave of legislation follows a New York law, effective last November, requiring companies to clearly disclose when algorithms use consumers’ personal information to set prices.
The latest batch of bills, however, go much further than disclosure, said Jameson Spivack, deputy director for artificial intelligence at the Future of Privacy Forum. States are seeking to prohibit surveillance pricing, though they often include carve outs. Some, for instance, exempt rewards programs based on personal information such as senior citizen or military status.
“The legislators and the governors are saying, ‘We like discounts, but they have to be available to everybody,’” Forster said.
The Maryland bill may serve as a model that gains industry approval. The bill generally exempts traditional loyalty program discounts and uniform category-based discounts, such as for senior citizens.
Laura Chadwick, president of the Travel Tech Association, said her group supports using existing state privacy laws to govern how personal data is used, rather than banning a technology. The association’s members are largely companies that let consumers compare travel experiences but don’t set prices.
Business owners, including Aaron Fessler, founder and CEO of travel-tech platform TripWorks, said they don’t object to lawmakers trying to prevent price gouging based on sensitive personal data. But broad strokes that also capture consumer-friendly programs should be narrowed.
“I support the intent behind it. I don’t think consumers should be priced upon whether or not they have an iPhone 6 or 15. I don’t think it should be based on personal data,” he said. “I’m most concerned about having a myriad of interpretations of this. Leaving it to highly fragmented state-by-state policies is challenging for operators.”
Compliance Challenges
State laws are unlikely to advance without industry resistance. The National Retail Federation, for example, sued to block the New York law in a case now on appeal to the Second Circuit.
But companies shouldn’t wait around for new laws to clear before evaluating their pricing practices, especially since actions from attorneys general demonstrate their capacity to act at any time.
In January, California Attorney General Rob Bonta announced an investigative sweep under the state’s privacy law into the travel and retail industries’ use of consumers’ personal data to set individualized prices.
Spivack and Forster said companies can prepare by auditing what personal data they collect and how they use it.
“They need to understand specifically if there’s anything with respect to protected class. That would be the first line of audit,” Forster said. “Are they making any assumptions or assignments about the buyer’s gender, race, age, socioeconomic class—even based on proxies?”
To contact the reporter on this story:
To contact the editors responsible for this story: