Same cart, different price: What businesses need to know about surveillance pricing

In late 2025, a joint investigation by several consumer advocacy groups revealed that a major online grocery delivery platform was running large-scale, AI-enabled pricing experiments on unsuspecting customers. Researchers tracked over 400 shoppers across four U.S. cities and found that nearly three-quarters of grocery items were offered at different prices to different customers, even when those customers were ordering from the same store at the same time. Some items even carried up to five different price points simultaneously. At one grocery store in Washington, D.C., the same dozen eggs appeared at $3.99, $4.28, $4.59, $4.69, and $4.79. That average price variation could cost a family of four roughly $1,200 per year.

Within weeks, the grocery delivery platform halted the practice under pressure from Congress, the FTC, and the public. But the episode was not an outlier. It was a preview of a much larger trend.

With more than 250 companies already deploying surveillance pricing tools, this practice now sits squarely at the intersection of data privacy, consumer protection, and business strategy.

What is surveillance pricing?

At its core, surveillance pricing uses personal data (browsing activity, precise location, purchase history, device information, and inferred demographics) alongside algorithms to set an individualized price for a specific consumer. The goal is simple: figure out the maximum price a particular customer will pay and charge it.

This is not the same as ordinary dynamic pricing where a storewide sale or a demand-based surge adjusts the price for everyone. Rather, surveillance pricing targets a specific individual based on what a system has learned about them. And the data inputs powering these systems are remarkably granular too: geolocation, browser and purchase history, demographics, device type, battery life, and even mouse clicks. The FTC’s surveillance pricing study, released in January 2025, confirmed that this range of personal data is already being used to set individualized consumer prices. Naturally, the consumer concern is straightforward: two people shopping in the same virtual aisle may see entirely different prices for identical goods, and neither one knows it.

The commercial ecosystem behind surveillance pricing

It is important to recognize that surveillance pricing does not happen in a vacuum. Rather, it is powered by a massive commercial ecosystem of data brokers and intermediary firms that collect, aggregate, and resell consumer data. In 2025, the global data broker market was valued at approximately $294 billion and is projected to surpass $448 billion by 2031, growing at a compound annual growth rate of roughly 7.3%. Industry estimates suggest there may be as many as 5,000 data brokers operating globally, alongside millions of open datasets, with consumer data accounting for approximately 46% of the market.

As part of its surveillance pricing study, the FTC issued orders to eight intermediary companies, specifically targeting firms that use AI and other technologies along with personal information to help retailers set individualized prices. The FTC’s study found that these intermediaries could deliver 2–5% revenue growth and 1–4% margin increases for their clients through personalized pricing.

All that to say, there is a thriving business-to-business market built on the buying and selling of consumer data that is here to stay.

Current regulatory posture

The regulatory environment around surveillance pricing is evolving at a remarkable pace. Here is what businesses need to know about the current landscape.

At the federal level, the FTC issued a proposed enforcement policy statement on August 19, 2026, warning businesses that using consumers’ personal data to set individualized prices without adequate disclosure may violate Section 5 of the FTC Act. The FTC has acknowledged that Congress has not given it the authority to ban personalized pricing outright, but even so, it intends to enforce aggressively against any deceptive or unfair personalized pricing practices.

Under the FTC’s framework, businesses using personalized pricing must clearly and conspicuously disclose three things: (1) that the price is personalized, (2) the basis for personalization, and (3) the types of data used to set that price. Failing to provide these disclosures likely constitutes an unfair or deceptive practice under Section 5. Generic language like “prices may vary” will not cut it.

Separately, the FTC has been exploring whether formal rulemaking is needed to mandate these disclosures, and advocacy groups have petitioned the Commission to promulgate a trade regulation rule requiring them.

At the state level, legislatures have moved even further. Maryland became the first state to enact a surveillance pricing ban when Governor Wes Moore signed the Protection From Predatory Pricing Act (HB 895) on April 28, 2026. The law prohibits food retailers operating establishments of at least 15,000 square feet, as well as third-party delivery service providers, from using consumers’ personal data to set higher individualized prices for food products. Violations carry penalties of up to $10,000 per offense, or $25,000 for repeat violations.

New Jersey followed suit when Governor Mikie Sherrill signed the Fair Price Protection Act on July 23, 2026. The Act prohibits the use of surveillance pricing or any other pricing strategy that determines or varies the sale price of groceries and related goods based on personal data. New Jersey’s law is also the first to grant consumers a private right of action, including class action claims, under the state’s Consumer Fraud Act.

Connecticut has also enacted similar restrictions, and more than 50 surveillance pricing bills are pending across 26 states.

In short, state legislatures have made it abundantly clear—they will not wait for federal action.

Impact and risk to businesses

The grocery delivery platform example illustrates what happens when surveillance pricing goes wrong publicly. But even businesses that never make headlines face a convergence of legal, reputational, and operational risk that is difficult to ignore.

On the legal front, the exposure is real and growing. The FTC has made clear it intends to enforce aggressively against personalized pricing practices that lack adequate disclosure. State legislatures are going further, enacting outright bans in certain sectors, and New Jersey’s law now gives consumers a private right of action, including class action claims. For businesses that collect consumer data to fuel pricing algorithms without sufficient disclosure or consent, the result is a widening aperture of enforcement actions, civil penalties, and private litigation.

Then there is the court of public opinion. Polling shows that more than eight in ten Americans believe businesses should charge all customers the same price for the same item, and more than three-quarters support banning companies from using personal data to set individualized prices. The bipartisan Senate Judiciary Committee hearing titled “Your Data, Their Profit: The Consumer Cost of AI Surveillance Pricing” is a signal of how deeply this issue has penetrated public discourse. When consumers learn a company has been quietly charging them more based on their personal data, the reputational fallout can be swift and lasting.

From an operational standpoint, the compliance picture is getting more complicated by the month. Different states are adopting different definitions, scopes, and enforcement mechanisms. The terminology itself is a moving target: “dynamic pricing,” “surveillance pricing,” “algorithmic pricing,” and “personalized pricing” are used interchangeably across different statutes, and what triggers a violation in one state may not even be covered in another.

Practical steps for businesses

Businesses that want to stay ahead of the curve should consider the following steps.

The first step is a close look at the pricing stack. Many businesses do not have full visibility into whether their pricing tools incorporate consumer personal data. That includes not just proprietary pricing engines but also third-party analytics platforms, loyalty program integrations, and electronic shelf label technologies. If a vendor is feeding consumer data into a pricing recommendation, the business needs to know about it.

Next, businesses should trace their data flows end to end. Where is consumer data being collected? How is consent being obtained? Is data being shared with or received from third parties who use it for pricing purposes? These questions matter because the FTC has signaled that data collection practices tied to personalized pricing can independently violate Section 5, even apart from the pricing itself.

Consumer-facing disclosures should also be tested against the FTC’s three-part framework: do they clearly tell consumers that a price is personalized, explain the basis for the personalization, and identify what data was used? If a company’s consumer-facing language amounts to “prices may vary” or something similarly vague, it will not hold up under the standard the FTC is proposing.

Finally, the right people need to be in the room. Surveillance pricing compliance cannot live solely within one department; it touches legal, data privacy, IT, marketing, and other areas. The businesses that get ahead of this will be the ones that convene cross-functional teams now, rather than scrambling to assemble them after an enforcement action or class action complaint lands on their desk.

To learn more about surveillance pricing and how it affects your business, contact a member of the McDonald Hopkins’ national data privacy and cybersecurity team.