FTC expands personalized pricing scrutiny as states, Congress, regulators turn up pressure

The spotlight on so-called personalized or surveillance pricing grew more intense this week after the U.S. Federal Trade Commission ordered nine companies to provide detailed information on how personal data and AI are used to set consumer prices and worker compensation. 

Under Section 6(b) of the FTC Act, the agency sent orders to Delta, United, JetBlue, Lyft, Uber, DoorDash, Instacart, Target and Walmart. 

"We intend to scrutinize the opaque methodology that some companies in these industries may be using to determine how much consumers pay or how much gig workers are paid for the same product or service," said FTC Chairman Andrew Ferguson. "Consumers deserve to know whether companies use their web surfing habits or other personal data to estimate the highest price they can charge each consumer. Workers also deserve to know if their compensation is affected by how companies use their personal data." 

The move comes just months after the agency invited public comment related to a proposed enforcement policy statement on how undisclosed use of personal data to set individual prices could violate Section 5 of the FTC Act. The 19 Aug. policy statement noted that the "extent to which businesses currently use personalized pricing is not well understood, and the effects of personalized pricing on consumers are unclear. As a theoretical matter, perfect personalized pricing without business competition would allow a monopolist to capture the entire consumer surplus by charging each consumer the highest amount he is will to pay for a product or service." The statement also said that personalized pricing without adequate disclosures "likely violates Section 5" and goes through a number of instances where this could apply.

In December 2025, Reuters reported the FTC was investigating Instacart's AI pricing tool. The New York Times reports 29 Oct. that DoorDash has purchased Instacart for USD17 billion.  

Prior to leaving office, the Biden administration's FTC, led by then-Chair Lina Kahn, in January 2025 conducted a study of personalized pricing and found types of sensitive data used to set pricing could include anything "from a person's location and demographics, down to their mouse movements on a webpage." The 2024 Section 6(b) orders went to Mastercard, Revionics, Bloomreach, JPMorgan Chase, Task Software, PROS, Accenture and McKinsey & Co.

In his dissenting statement at the time, Ferguson thanked the FTC staff for the report but said it was "far from a comprehensive report." 

States, attorneys general and Congress in focus

On 22 Oct., U.S. House Energy and Commerce Committee Ranking Member Frank Pallone, D-N.J., expanded his inquiry into what he calls surveillance pricing by sending letters to a number of rideshare, ticketing, travel booking and food delivery industries, including to Booking Holdings, DoorDash, Expedia, Grubhub, Live Nation, SeatGeek, StubHub and others. 

In May, Pallone sent similar inquiries to 25 businesses and then again in August to eight major airlines. 

"We need answers because consumers deserve to know if businesses are using their personal information to manipulate the prices they pay or experiment with algorithms to set the prices they see," Pallone said in his October inquiry expansion. In his letter to the companies, Pallone includes a detailed set of questions, ranging from what data elements are collected, what transparency is provided, whether it uses loyalty or discount membership programs and whether and what types of AI or machine learning algorithms are used. 

During a U.S. Senate hearing in August, Sen. Josh Hawley, R-Mo., described personalized pricing practices as "one of the biggest scams in American history," declaring the tools used as the "unholy trinity of everything Americans hate: spying on people, ripping them off, and taking away jobs." 

Attorneys general are also shining the light on personalized pricing. In January, California Attorney General Rob Bonta announced an investigative sweep focused on the practice, saying "surveillance pricing may undermine consumer trust, unfairly raise prices, and when conducted without proper disclosure or beyond reasonable expectations, may violate California law." 

State legislatures and municipalities have also mulled and passed laws related to personalized pricing practices. Connecticut, Maryland, New Jersey and New York each have personalized pricing regulations and, in September, Seattle approved a citywide measure restricting grocery retailers from using personal data to set individual prices. 

Personalized versus dynamic and other pricing practices

During a session on algorithmic pricing and retail at the IAPP Privacy. Security. Risk. and AI Governance Global 2026 in Seattle earlier this month, panelists highlighted that surveillance pricing sits at the intersection of four legal regimes covering data privacy, consumer protection, AI governance and antitrust.  

Bryan Cave Leighton Paisner Partner Goli Mahdavi, AIGP, CIPP/E, CIPP/US, explained the main difference between dynamic and personalized pricing, noting that the former "refers to real-time pricing adjustments driven by market conditions." She said these are well-known concepts from "supply-and-demand economics ... those prices apply uniformly to all consumers at a given moment in time. The defining characteristic is uniformity. The price is based on the market, not on the identity or personal characteristics of the shopper." 

Mahdavi said, "What has changed is not the existence of variable pricing but the technology behind it." AI changes the calculus from "the price now" to "the price for this person." 

EBay Global Product Counsel Director Neema Ghiasi said that "algorithmic pricing itself is not new." Rather, it's been used appropriately for decades, but now AI "acts as a force multiplier." AI can process larger amounts of data almost instantly and create detailed profiles and theoretically adjust pricing based on those profiles. He said it can be used responsibly, but regulators are concerned about improper use. 

More advocacy and media attention has grabbed the attention of lawmakers and regulators. A December 2025 investigation from Consumer Reports on Instacart's AI-enabled "pricing experiments" found that some grocery prices differed by as much as 23% per item from one customer to the next. Prompted by the report, Instacart ceased offering the technology to grocery retailers. Not long after, California's Bonta opened the state's investigatory sweep. 

Widespread concerns and unintended consequences 

During the PSR session, California Retailers Association President Rachel Michelin said a combination of concerns is driving a growing spotlight on pricing strategies, including a lack of understanding about existing privacy and pricing laws; anxiety about AI and future uses of data; as well as general concerns about consumer protection. 

"One challenge is that lawmakers often focus on what might happen in the future rather than what is happening today," she said. "It's difficult to advocate against hypothetical harms." 

She also believes the issue will continue to grow, noting that Utah is exploring options and that Washington is likely to do something, and that it's become a bipartisan issue. 

"The challenge for industry," Michelin said, "is figuring out how to engage constructively. Ultimately, the discussion should focus on consumers and what consumers actually expect." 

Mahdavi said many of the state bills are "well-intentioned, but lawmakers do not always fully understand how loyalty programs, discounts, and personalized offers operate." 

Michelin said, "One of my concerns is that some legislation assumes consumers don't understand these tradeoffs. If certain bills were enacted broadly, companies might simply eliminate loyalty programs rather than accept litigation risk." This would lead to consumer harm that the legislation was intended to protect. 

EBay's Ghiasi also expressed concern that broadly drafted legislation could affect established business models the legislation was not intended to target — like eBay's, where the seller and buyer set the price through auctions or other means. 

Litigation risk is also a reality. Mahdavi said, "Even when companies are acting in good faith, technical violations of disclosure requirements can result in lawsuits." 

What can businesses do?

Panelists agreed that companies need to understand their own technology. What data is being used? How are pricing systems operating? What vendors are involved? And what contractual rights are in place to obtain information from those vendors?

It's also essential to "say what you do and do what you say." Transparency is critical and it's important to review privacy notices, disclosures and policies. Be sure that they accurately describe any personalization practices and the data being used, and connect with the product team.