State regulators and legislatures throughout the country have continued to focus on “algorithmic,” “surveillance” or “personalized” pricing as a regulatory and enforcement priority. Personalized pricing is the use of individual consumer personal data to set prices or provide special offers or promotions to consumers as discussed in our article Personalized Pricing: What Business Lawyers Need to Know. A few states, such as New York and New Jersey, have passed specific laws aimed at curbing this practice. Other states’ regulators, such as the California attorney general’s office, are examining how existing law, in particular the California Consumer Privacy Act, intersects with this type of activity.
On August 19, 2026, the Federal Trade Commission (FTC) reaffirmed its own interest in this area by voting 2-0 to open comments on a proposed enforcement policy relating to personalized pricing. The proposed Enforcement Policy Statement Regarding Personalized Pricing (Policy Statement) addresses concerns that businesses are using modern technology and personal data to tailor individual prices for consumers in a manner that does not align with consumer expectations. The FTC noted that while it does not have the authority to prohibit personalized pricing in all contexts, it intends to enforce Section 5 of the FTC Act against practices it deems to be unfair or deceptive to consumers, as well as other applicable laws within its jurisdiction, which could include those related to personalized pricing in some circumstances. The agency is specifically concerned with consumers receiving inadequate disclosures regarding personalized pricing practices, in terms of whether personalized pricing is used in the first place as well as the particular criteria used to set the price.
For businesses that implement personalized pricing, including through loyalty programs or personalized offers, this enforcement policy from the FTC is the latest in a series of developments to pay attention to. Regulators at both the state and federal levels are closely evaluating companies’ practices in this regard and are utilizing both specific statutes that regulate this activity and their general consumer protection authority. Companies engaging in this activity should closely review their current practices to ensure they are consistent with the evolving legal framework.
The FTC’s comment period for the proposed policy statement will conclude on September 18, 2026. We have provided additional details summarizing the Policy Statement and key takeaways for businesses below. To stay up to date on notable data protection developments, please subscribe to the WilmerHale Privacy and Cybersecurity Law Blog.
Overview of the Policy Statement
The Policy Statement defines personalized pricing as setting a price based on analysis of a consumer’s personal data and resulting conclusions, such as what the business believes that individual is willing to pay. First, the Policy Statement is premised on a consumer-expectations theory, namely that retailers may deceive or mislead consumers when they personalize prices in ways consumers do not reasonably expect. Specifically, the Policy Statement highlights that consumers browsing products reasonably expect that the price they see is the same price any other consumer would see at the same place and time, and that prices in general move with supply and demand rather than with a consumer’s browsing history or buying patterns. The FTC adopts the position that a business engaged in personalized pricing must clearly and conspicuously disclose all relevant information, such as that the price is personalized, the basis for the personalization, and the type of data used. The Policy Statement explains that “a clear and conspicuous disclosure that a personalized price is based on a consumer’s estimated willingness to pay derived from data about that consumer’s previous purchases from the same retailer through the same login account—if accurate and complete—would likely be enough to dispel any reasonable expectation that the posted price is not personalized and give the consumer the information he needs to identify potentially incorrect information, take measures to avoid the personalized price, or avoid the future collection of data for personalized pricing, as well as alert him that it might be in his interest to take such steps.”
Privacy-Based Risks
The Policy Statement also advances a privacy-based enforcement theory. The agency argues that the undisclosed collection or use of personal data for the purpose of personalized pricing or without obtaining consent can itself violate Section 5 of the FTC Act. Section 5(a) provides that “unfair or deceptive acts or practices in or affecting commerce . . . are . . . declared unlawful.” 15 U.S.C. Sec. 45(a)(1). The FTC explains that the agency has “applied Section 5 to protect consumers’ data privacy.” The agency appears concerned that personalized pricing may cause substantial injury to consumers. At the same time, it recognizes that personalized pricing may not result in substantial injury in all circumstances and may be appropriate where retailers provide adequate disclosures that address potential privacy concerns. For example, the Policy Statement cites the insurance industry as an acceptable model for using personalized pricing when a company discloses personalized pricing based on the individual’s behavior (i.e., to properly reflect the risk of providing an insurance policy or loaning money to the consumer). The agency also provides seven non-exhaustive scenarios in which personalized pricing without adequate disclosure would raise Section 5 concerns.
Personalized Pricing Without Adequate Disclosures May Lead to Enforcement
The Policy Statement suggests the onus is on retailers to provide consumers with the basis of a personalized price to allow consumers to identify potentially incorrect information, take measures to avoid the personalized price, or avoid the future collection of data for personalized pricing, as well as alert the consumer that it might be in their interest to take such steps. For example, a rideshare company charging a user more on the basis of data revealing that the user has not installed any of the company’s competitors’ apps on the user’s phone or charging a user more for transit to a medical facility on the basis that the user has a life-threatening medical emergency or condition would raise Section 5 concerns. Another illustration provides an example of similar upward price personalization—specifically, that a retailer charging more for a product sold on its website to consumers it believes are inside one of the retailer’s physical locations or parking lots at the time of browsing the retailer’s website could run afoul of Section 5 of the FTC Act.
Key Takeaways
While the Policy Statement does not prohibit personalized pricing, it signals that the FTC intends to closely scrutinize the practice and expects companies engaging in it to be transparent about their practices. Retailers that personalize pricing, including those offering personalized discounts or offers, should take steps to inventory where and how personalization occurs, identify the data inputs driving those decisions, and assess existing disclosures about the pricing methods. Retailers should also consider taking proactive measures to allow consumers to dispute or correct inaccurate information collected about them that is leading to higher prices or discount offerings and offer personalized pricing only on an opt-in or opt-out basis. Additionally, the current comment period provides the public with an opportunity to shape how the FTC frames its enforcement priorities regarding personalized pricing going forward.
