Making Sense of New Surveillance, Dynamic, and Algorithmic Pricing Laws
by: Rosanne Yang
Legislatures, regulators, and class action attorneys, often supported by consumer advocacy groups’ research and reporting, are rapidly turning their attention to how businesses use consumers’ personal data to set and advertise prices to them. The new laws being considered and passed are not consistently approaching it the same way, can be internally confusing, and uniformly blend privacy considerations with pricing and deceptive advertising laws. Outside of pricing-specific regulations, consumers and regulators are leveraging already existing laws to address these pricing practices. And at all turns, even traditional retail practices such as segmentation of offers may be in the crosshairs.
Today, we try to simplify the present and coming compliance concerns for retailers, and provide some next steps toward preparing the business for compliance.
Terminology
The terminology unfortunately varies by each statute. Different states are using “surveillance pricing,” “personalized pricing,” “dynamic pricing,” or “algorithmic pricing,” all to refer to the same issue. No matter what the laws call it, what is at issue is the use of consumers’ personal data — e.g., purchase history, browsing history, device type, location, demographics, and even mouse movements on a webpage — to set prices that are individualized to a person or group of people.
We will use the term surveillance pricing for simplicity.
Overview
New Statutes
There is recent legislative activity on surveillance pricing in well over 20 states.[1] As of publication, there are just 3 that have become law:
| New York | Maryland | Connecticut | |
|---|---|---|---|
| Affected Businesses | All businesses (except insurance, financial) |
Food retailers (15,000+ square foot stores, selling tax-exempt foods) + food delivery services |
Part 1: All retailers + food delivery services Part 2: All other businesses (except insurances, some financial) |
| Form of Regulation | Disclosure | Ban | Part 1: Ban Part 2: Disclosure, if price was increased as result of surveillance pricing |
| Effective | Now (since November 2025) | October 1, 2026 | July 1, 2027 |
Litigation and Regulatory Action
Class litigation is pending in New York and Washington, D.C. over surveillance pricing, which litigation leverages other legal theories such as the federal Electronic Communications Privacy Act and similar state laws and state deceptive business practices laws. These are national class cases, with subclasses on the various state laws.
California’s Attorney General announced an investigation into these practices, leveraging the California Consumer Privacy Act (CCPA).
Key Features of New Laws
As with all laws, the devil is in the details of each regulation, but here are some of the important features for retailers to understand at a glance:
| New York | Maryland | Connecticut | |
|---|---|---|---|
| Discounts in Scope | Unclear | No | Yes |
| Loyalty in Scope | Unclear | No | Yes |
| Publication of Discount Eligibility Criteria in Scope |
No | No | Yes, to fit into an exception |
| Disclosure of Surveillance Pricing |
Yes | No- just a ban | 1. No- just a ban 2. Yes- if the price was increased |
| Enforcement | -AG only -Cure period (set by AG during enforcement) -$1000/violation |
-AG only -45-day cure period -Damages per the MD Consumer Protection Act |
-AG only -No cure period -Damages per deceptive trade practices law |
In more detail:
Discounts Can Be in Scope. The first question we are often asked is whether these new laws apply just to determination of the regular (base) price that is displayed/advertised to a consumer, or also to discounted prices (e.g., via strike-through of the full price with a new price advertised, a % off, or a $ off offer). The answer varies as set forth above. Importantly, note that the Maryland law applies only where prices are being increased by the use of personal data, and that the New York law discusses prices without defining whether that might include discounts.
Loyalty Program Discounts Can Be in Scope. Loyalty programs have for a long time been considered an A+ way to offer ongoing discounts to consumers without running afoul of longstanding pricing laws that require a product be sold at its base price for a reasonable amount of time. However, loyalty programs are becoming less flexible. For Connecticut note, that loyalty discounts are subject to the regulation to the extent the retailer uses data to extend offers that vary amongst loyalty members and/or automatically enrolled customers. However, if all loyalty members enrolled voluntarily and receive the same discount, then it is outside the scope of the law.
Publication of Discount and Eligibility Criteria May Be in Scope. Although Connecticut has a broad ban on using surveillance data even to determine prices or discounts offered to groups of people, one way to scoot around that is to publicly disclose the discount and discounted price, as well as the eligibility criteria and other terms of the offer. This works if the retailer wants to extend the same price or discount to, for instance, all members of a mailing list or all teachers. It does not work if the retailer does not want to publicly disclose the eligibility criteria for the offer or the offer itself.
Affirmative Disclosure of Surveillance Pricing May Be Required. Some states are regulating surveillance pricing by requiring disclosure that the price was set as a result of it. For now, only New York has a broad disclosure requirement in that it requires retailers to state clearly and conspicuously that a personalized price was set by algorithm, using this disclosure: “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA." In Connecticut, there is no disclosure option for retailers or food delivery services; disclosure is, however, a requirement for other businesses where the practice resulted in a higher price being charged to the customer.
Exclusions
As with just about any law, there are certain exclusions:
Non-Personalized Offers. Some of the laws are making it clear that prices and discounts set in other ways are exempted. Both Maryland and Connecticut state that their laws do not affect price changes or discounts arising from the following:
changes in price due to the retailer’s own objective cost differentials in providing the product in different geographies;
changes due to fluctuations in supply and demand; or
correcting a price.
Personal But Not Surveillance Pricing. Both Connecticut’s and Maryland’s laws provide exclusions for discounts associated with retaining a customer. Exactly how far that goes remains to be seen. Connecticut’s law also makes exceptions for offers made to attract new customers and lapsed customers.
Actions to Take Now
If you are a retailer of any kind or a food delivery service operating in Connecticut, or a food retailer or food delivery service operating in Maryland, now is the time to dig into the specifics to determine what needs to happen imminently.
For all other retailers, thoughtful preparation is warranted. In addition to the litigation and regulatory threats that could come at any time, new laws may become effective on relatively short notice. Maryland food retailers received only 5 months to pivot their businesses, and had the Colorado law been signed by the governor, it would have taken effect 4 short months later. Therefore, all retailers, even if they are not currently within the cross-hairs of the above regulations, should take the following steps now:
Establish Your Base Prices. If you are not already properly establishing your base prices, prioritize this right away. In addition to being necessary for compliance with longstanding laws affecting prices, this should help protect your retail business from allegations that the base prices fall within these regulations. Because price establishment can take a while and then needs to be maintained over time, it is best to get started on that as soon as possible.
Determine How Personal Data Affects Your Prices & Discounts. It is important to begin understanding the depth and breadth of your reliance on personal data for prices and discounts well ahead of new laws coming into effect. This will help you determine the impact to the business, whether replacement strategies are needed, and what those replacement strategies might look like.
Plan New Approaches. Disclosure of the practices in the privacy policy, and honoring privacy rights requests, are not by themselves sufficient to insulate a retailer from the effects of these new laws. Therefore, especially if your retail business is heavily reliant on surveillance pricing, the changing regulatory and litigation landscape may have significant revenue impact. Retailers may need to pivot their approaches substantially, so it is best to start planning and testing those new approaches to soften the impact.
Note too that non-retailers may also be affected by these same laws, so while our update focuses on retail implications, if you are a business that is in any way using personal data and/or algorithms to set prices or offer discounts, close attention to these developments is warranted.
[1] There are bills on this topic currently pending in Arizona, California, Georgia, Hawaii, Illinois, Iowa, Louisiana, Maryland, Massachusetts, Minnesota, New Hampshire, New Jersey, New Mexico, New York, Ohio, Pennsylvania, Rhode Island, Tennessee, Vermont, Washington. The pending bills are evolving as they progress through the legislative process, but continue to fall into 2 main categories: bans and disclosure requirements. There are also recently abandoned efforts in 3 more states – Colorado (vetoed), Texas (lapsed), and Kentucky (lapsed). These could come back in later sessions given the momentum behind this topic.
Originally published by InfoLawGroup LLP. If you would like to receive regular emails from us, in which we share updates and our take on current legal news, please subscribe to InfoLawGroup’s Insights HERE. This summary does not constitute legal advice.