The Federal Trade Commission has put the retail industry on notice that personalized pricing, the practice of setting a price from what a company believes an individual shopper is willing to pay, is now an enforcement priority. The agency announced on August 19, 2026 that it is seeking public comment on a proposed enforcement policy statement covering the practice.
The document does not ban anything. It says something narrower and, for retailers, more immediately actionable: where shoppers reasonably expect a price not to vary with their personal data, failing to disclose that it does is likely an unfair or deceptive act under Section 5 of the FTC Act.
The Commission vote authorizing the Federal Register notice was 2-0. Once that notice publishes, the public gets 30 days to comment. As of August 21 the notice had not yet appeared in the Federal Register, which means the clock has not started and the window is still ahead of most compliance teams.
In short
- What happened: The FTC released a proposed enforcement policy statement on personalized pricing on August 19, 2026, matter number P034101, and opened it for public comment.
- The legal theory: The agency concedes it cannot ban personalized pricing outright, but says inadequate disclosure of personalized pricing is likely to violate Section 5 as deception, unfairness, or both.
- The disclosure bar is high: Retailers must disclose not just that a price is personalized, but the basis for the personalization and the types of data used.
- The clock: 30 days of comment begin on Federal Register publication, which had not happened as of August 21, 2026.
- The bigger risk is state law: Maryland, Connecticut and New Jersey have already legislated, and New Jersey gives consumers a private right of action, including class actions.
What did the FTC actually announce?
The Commission published a proposed enforcement policy statement, not a rule and not a complaint. The distinction matters for how retailers should read it.
A policy statement tells the market how an agency intends to apply law that already exists. The FTC document says so explicitly: it does not confer rights on any person and does not bind the Commission or the public. In any enforcement action the agency would still have to prove a violation of an existing statutory or regulatory requirement.
What it does is remove ambiguity about intent. FTC Chairman Andrew Ferguson framed the announcement around consumer expectation rather than around pricing technology.
“When consumers see a listed price, they expect it to be same price that everyone else sees, not the retailer’s estimate of how much they are willing to pay based on their personal data,” Ferguson said in the agency’s statement. He added that the Commission “does not have the legal authority to ban personalized pricing in all circumstances, but businesses that fail to tell consumers how their personal data is being used to set a price may be in violation of the FTC Act and other laws we enforce.”
That is the entire architecture of the policy in two sentences. The agency is not litigating whether personalized pricing is good or bad economics. It is litigating whether the shopper was told.
Where this sits in a longer sequence
The statement is not a standalone initiative. It arrives after a run of FTC pricing-transparency actions that share the same logic, which is that the price a consumer sees should be the price the consumer pays.
Per the agency’s own citations, that sequence includes the Rule Against Unfair or Deceptive Fees taking effect in May 2025, a $24 million settlement with Greystar over rental advertising in December 2025, a $60 million consumer refund settlement with Instacart in December 2025, StubHub refunding $10 million in fees in April 2026, and a request for comment on fee practices in online food and grocery delivery in April 2026.
Read against that record, the personalized pricing statement is the same enforcement theory extended from hidden fees to hidden price construction. Retailers who followed our coverage of all-in checkout pricing rules will recognize the pattern: the FTC keeps choosing disclosure obligations over substantive price regulation, because disclosure is what Section 5 clearly supports.
Why is the disclosure standard the whole story?
Most coverage of the announcement has focused on whether the FTC is being tough or timid. The operationally important detail is buried in the text: the specificity the agency demands.
The statement says that to be effective, personalized pricing disclosures “should be clear and conspicuous and include all relevant information, such as the fact that the price is personalized, the basis of that personalization, and the type of data used.”
That is a three-part test, and it is considerably harder to satisfy than a privacy-policy line item. The FTC then gives a worked example of failure and a worked example of success.
Telling a shopper only that they are seeing a “specially selected” price would likely be misleading, the agency says, because it omits important information. By contrast, a clear and conspicuous disclosure that a price is based on estimated willingness to pay derived from the shopper’s previous purchases from that same retailer under the same login would likely be sufficient, if accurate and complete.
Why “specially selected” fails
The reasoning is worth following because it explains what the agency thinks a disclosure is for. A disclosure is not a legal shield. It is a tool that lets the shopper act.
The FTC argues that a shopper who knows a price is personalized can respond: use a virtual private network, switch to private browsing, shop elsewhere, or abandon the purchase. A shopper told only that they were “specially selected” cannot do any of that, because they do not know what triggered the price.
This is why the agency insists on the basis and the data type. Without those, the shopper cannot identify incorrect data about themselves, cannot change the behavior generating the price, and cannot avoid the collection going forward.
Which practices does the FTC say already violate Section 5?
The statement walks three separate legal routes to liability. Retail counsel should treat them as distinct exposures rather than one theory.
Deception
Retailers may deceive shoppers when they represent, expressly or by implication, that a price is static or widely offered when it is in fact personalized. They may also deceive when the shopper reasonably believes a price is static and the merchant simply fails to say otherwise.
A second deception route concerns the basis of personalization. If a shopper reasonably believes a personalized price is a loyalty discount based on their history with that retailer, when it is actually a higher price derived from inferences about their disposable income or their shopping at other firms, the FTC considers that potentially deceptive.
The materiality argument follows the agency’s 1984 Deception Policy Statement: an omission is material if it is likely to affect the consumer’s conduct. Shoppers who do not know they are being personalized cannot take avoidance steps, so the omission changes behavior.
Unfairness
The unfairness route runs through 15 U.S.C. Section 45(n). The higher price paid because of personalization may itself be a substantial injury. That injury may not be reasonably avoidable where the fact or nature of personalization has been concealed.
The FTC also notes that any benefits to consumers or competition from personalized pricing can be realized without concealing it, which weakens the countervailing-benefits defense.
Notably, the Commission declined to take a position on whether some personalized pricing practices are unfair even when fully disclosed. That reservation leaves the door open for a harder line later.
Data practices
The third route is privacy law dressed as pricing law. Businesses that collect, use or disclose personal data for the purpose of personalized pricing without adequate disclosure or consent may violate Section 5 independently.
The statement goes further: businesses that base personalized prices on consumer data without sufficiently verifying that consumers consented to the collection of that data for that purpose may also violate Section 5. That places a diligence obligation on retailers buying third-party data segments, not just on the firms that collected them.
The FTC anchors this in prior actions including Lenovo, Vizio, Aaron’s and the Gravy Analytics and Mobilewalla location-data matters. It is the same consent-verification theory, applied to pricing inputs.
What are the seven scenarios the FTC put on paper?
The statement includes a non-exhaustive list of illustrative scenarios. The agency stresses they are presented for discussion and are not definitive statements of legality. They are still the clearest signal of what the staff considers actionable.
- A food delivery company quoting a higher price to consumers based on data suggesting they are less likely or unable to leave home to buy food.
- A grocery chain charging a delivery customer more for milk based on data showing several children live in the household.
- A hotel charging more based on data suggesting the traveler is attending a funeral or other can’t-miss personal business.
- A rideshare company charging more because the user has not installed competitors’ apps.
- A rideshare company charging more for transport to a medical facility based on data suggesting a life-threatening condition.
- A retailer charging more for a home-security camera based on court filings showing the customer was recently a crime victim.
- A retailer charging more on its website when data shows the shopper is physically inside that retailer’s store or parking lot.
Four of the seven involve vulnerability signals: immobility, bereavement, medical emergency, recent victimization. The fourth and seventh involve competitive context rather than vulnerability, and those two are the ones most likely to already exist in mainstream retail stacks.
The geofenced in-store scenario deserves particular attention. Charging a different online price to a shopper standing in the aisle is a well-known price-matching countermeasure, and the FTC has now labeled it a Section 5 concern absent disclosure.
What is the FTC explicitly not doing?
The limits are as important as the assertions, and several commentators have argued the limits swallow the announcement.
Congress has not given the Commission authority to prohibit personalized pricing outright, and the statement says so twice. The agency is also candid that the evidence base is thin: the extent to which businesses currently use personalized pricing “is not well understood,” and the effects on consumers “are unclear.”
The economics section is unusually hedged for an enforcement document. Citing academic work including Dubé and Misra and research on auctioned cab rides, the statement concludes that personalized pricing likely increases business profits, that gains to some consumers come with losses to others, and that the more sophisticated the practice becomes, the less likely consumers are to benefit.
That hedging is deliberate and it creates a tension inside the document. The agency asserts that undisclosed personalization causes substantial injury while conceding that the aggregate welfare effect of personalized pricing is an open empirical question.
The statement resolves the tension by locating the harm in the concealment rather than in the price. A shopper who overpays because they were prevented from shopping around has been injured whether or not the practice raises or lowers prices across the market as a whole.
The academic literature the FTC cites supports that narrower framing. Research on personalized pricing and competition has found that when only some firms in a market can personalize, consumers can end up worse off than when either all firms or no firms do so, which is an argument about market structure rather than about disclosure.
The Commission also carves out categories where personalization is expected and lawful. Rideshare pricing that moves with neighborhood supply and demand, insurance and credit pricing that turns on individualized risk, and regional variation driven by taxes, regulation or market conditions all fall outside the concern.
| Pricing behavior | FTC treatment | Disclosure needed? |
|---|---|---|
| Surge pricing from local supply and demand | Expected market variation | No specific duty asserted |
| Insurance or credit priced to individual risk | Inherent to the product | Governed by FCRA and state insurance law |
| Regional price differences from tax or regulation | Expected market variation | No specific duty asserted |
| Loyalty discount from own-account purchase history | Personalization | Yes, if shopper expects a static price |
| Price from inferred willingness to pay | Core concern | Yes, plus basis and data types |
| Price from third-party data on income or vulnerability | Highest risk | Yes, plus consent verification |
The 2-0 vote reflects a Commission operating below full strength. Critics writing in the days after the announcement, including in the American Prospect, argued that a policy statement without a rulemaking or a live case is an announcement of intent rather than a constraint on conduct.
How does this compare with the state laws already on the books?
This is where the practical risk sits. While the FTC was drafting guidance, three states passed binding statutes, and the enforcement asymmetry is significant.
Our earlier analysis argued that US surveillance-pricing rules would come from states rather than Washington. The August 19 statement does not overturn that read. It supplements it, because the federal instrument is guidance while the state instruments are law.
| Jurisdiction | Instrument | Scope | Enforcement | Reported timing |
|---|---|---|---|---|
| FTC (federal) | Proposed enforcement policy statement | All commerce under Section 5 | Agency enforcement, case by case | Comment opens on Federal Register publication |
| Maryland | Protection From Predatory Pricing Act | Food retailers and third-party delivery | State enforcement | Effective October 1, 2026 |
| Connecticut | Dynamic pricing statute | Retail broadly, plus point-of-sale disclosure | State enforcement | 2027, reported dates vary by source |
| New Jersey | Fair Price Protection Act | Food retail focus | Private right of action, including class actions | Reported effective August 1, 2027 |
Two structural differences matter more than the effective dates. First, Maryland targets the use of personal data to charge higher prices, while Connecticut and New Jersey apply regardless of whether the personalized price is higher or lower. A retailer running personalized discounts is out of scope in one state and in scope in two others.
Second, and more consequential, New Jersey’s private right of action removes the regulator as gatekeeper. We covered the mechanics when New Jersey banned surveillance pricing, and the class-action exposure there is a different order of magnitude from an FTC investigation.
The legislative pipeline behind the three
Three enacted laws understate the momentum. Industry trackers and legal summaries report more than 40 surveillance pricing bills introduced across more than two dozen states during 2026 sessions.
That volume is the reason the federal statement matters even though it is non-binding. A national retailer cannot operate a different pricing architecture per state, so the strictest applicable rule tends to set the enterprise standard.
What evidence is driving the concern?
The public case rests on a small number of investigations that produced concrete spreads, plus survey data on consumer attitudes.
An investigation by Consumer Reports and the Groundwork Collaborative, cited in reporting by Grocery Dive, found identical grocery items differing by as much as 23% between customers on Instacart. Instacart subsequently stopped providing technology that enabled simultaneous differential pricing.
Consumer Reports separately examined rideshare pricing and reported a median difference of roughly 42% between the lowest and highest pricing tiers observed on Uber and Lyft.
On attitudes, a 2024 Consumer Reports study found that about two-thirds of US consumers oppose personalized pricing. The FTC’s own citations add Pew Research finding that 67% of Americans say they understand little to nothing about what companies do with their personal data.
That combination, low understanding plus high opposition, is what makes the materiality argument straightforward for the agency. If shoppers do not know a practice exists and object to it when told, an omission about it is likely to affect their conduct.
The regulatory analogy the FTC leans on
The statement borrows its remedy from credit and insurance regulation rather than inventing one. Under the Fair Credit Reporting Act, 15 U.S.C. Section 1681m(a), companies must notify consumers when an adverse action is based on a consumer report and disclose the specific basis for it.
Many state insurance laws impose comparable duties on individualized adverse action. The FTC’s point is that in every market where individualized pricing is well established, disclosure of the basis is already mandatory.
Applied to retail, that framing recasts a personalized price as an adverse action with a notice obligation. It is a demanding analogy, and it is the part of the statement most likely to draw industry comment.
Which retail channels are most exposed?
Exposure is not evenly distributed. It tracks two variables: how much individualized data the channel holds, and how strongly shoppers expect a posted price to be universal.
Delivery and marketplace apps score high on both. They hold logged-in identity, address history, order frequency and device signals, and they display a price as though it were a catalogue price. That combination is exactly the mismatch the FTC describes.
Physical shelf pricing sits at the other end. The statement uses the shelf as its baseline example of reasonable expectation, noting that a shopper walking into a store expects the shelf price to be the same one offered to anyone else in that store at that moment.
Where electronic shelf labels complicate the picture
Electronic shelf labels blur that baseline. They allow prices to change during the day, which is time-based variation rather than person-based variation, and time-based variation affects everyone in the store equally.
On the FTC’s own reasoning that is closer to supply and demand than to personalization. The risk appears only if label changes are tied to an identified shopper, for example through an app session in the aisle, which is the seventh enumerated scenario.
This distinction is worth stating clearly because the public debate frequently merges dynamic pricing with surveillance pricing. The FTC statement does not. It treats variation that applies to the whole market as expected, and variation that keys to the individual as the concern.
Loyalty programs occupy the gray zone
Loyalty pricing is the hardest case for retailers, because it is both ubiquitous and explicitly personalized. Member prices have been normalized for decades, and shoppers arguably do expect them to differ.
The FTC’s example of a compliant disclosure suggests the agency accepts own-account personalization when the basis is stated. What it does not resolve is whether a long-standing, widely understood member-price convention already satisfies the reasonable-expectation test without additional disclosure.
That question is likely to be the single most commented-on issue in the docket, because the answer determines whether a compliance project touches a pricing edge case or the core promotional engine of most grocery and drug retail.
What does the comment clock actually require?
The procedural detail is simple but easy to miss. The 30-day comment period runs from Federal Register publication, not from the August 19 announcement.
A check of the Federal Register on August 21 showed no FTC personalized pricing notice yet published, so the window remained unopened at that point. Retailers monitoring this should watch for the notice rather than counting 30 days from the press release.
Practically, that gives trade associations and individual retailers a short runway. Thirty days is not long for a document that asks firms to disclose the basis of their pricing models, and the comments filed will shape what the final statement says about sufficiency.
Three questions look most likely to dominate the record. Whether “the type of data used” can be satisfied at category level or requires field-level specificity. Whether own-account loyalty personalization needs the same disclosure as third-party-data personalization. And whether the consent-verification duty on purchased data segments is workable at scale.
What should retailers check before the window closes?
The statement is guidance, but the underlying law is not new. A retailer already running willingness-to-pay models is already exposed to Section 5 on the FTC’s reading, comment period or not.
Inventory the inputs, not just the outputs
The consent-verification language makes data provenance the first audit target. Any pricing feature derived from purchased third-party segments now carries a diligence question about whether the original collection consented to pricing use.
This is narrower than it sounds. Own-account behavioral data collected under a disclosed privacy policy sits in a different risk tier from bought income proxies or location histories.
Separate personalization from promotion
Many systems marketed internally as promotion engines are personalization engines in the FTC’s sense. The test is whether the price shown differs between two shoppers viewing the same listing at the same time because of who they are.
If it does, the “specially selected” framing common in promotional copy is the exact language the agency singled out as likely misleading.
Check the geofence
The in-store browsing scenario should trigger a specific review of any logic that varies app or web pricing based on store proximity. That is a discrete, testable behavior, and it is now explicitly enumerated.
Map state exposure separately
Compliance built to the federal disclosure standard will not satisfy Connecticut’s point-of-sale disclosure requirement or New Jersey’s price-direction-neutral prohibition. The federal standard permits disclosed personalization; the state statutes in some cases prohibit it regardless of disclosure.
The same divergence is showing up in adjacent areas, including the deception theory we examined around AI shopping recommendations and undisclosed commercial steering. In both cases the federal hook is non-disclosure rather than the practice itself.
What happens next?
Three sequences are worth tracking, and they run on different timelines.
The near-term one is procedural: Federal Register publication, then 30 days of comment, then a final statement. Nothing in the announcement commits the Commission to a deadline for finalizing.
The medium-term one is enforcement. A policy statement typically precedes a case that tests the theory. The scenarios list functions as a shortlist of fact patterns the staff would find attractive, and the food delivery and grocery examples appear first for a reason.
The long-term one is state law taking effect. Maryland’s October 1, 2026 date arrives before any plausible federal case concludes, and New Jersey’s private right of action follows in 2027. For most national retailers, the binding constraint will be a state statute rather than the FTC statement.
The broader pattern is one we have tracked across pricing transparency for two years, from fees to checkout design to dark-pattern crackdowns. Regulators keep declining to set prices and keep tightening what must be said about them. Personalized pricing is the same move applied to the price itself.
Frequently asked questions
Did the FTC ban personalized pricing?
No. The Commission states twice in the document that Congress has not given it authority to prohibit personalized pricing in all circumstances. The statement addresses disclosure obligations under Section 5, not the legality of the practice itself.
When does the comment period close?
The public gets 30 days from the date the notice publishes in the Federal Register. As of August 21, 2026 that publication had not occurred, so the deadline was not yet fixed. Retailers should track the Federal Register notice rather than counting from the August 19 press release.
What exactly must a disclosure say?
Three things, per the statement: that the price is personalized, the basis for the personalization, and the types of data used. The FTC says a disclosure that only calls a price “specially selected” would likely be misleading because it omits the basis and the data.
Is surge pricing covered?
Generally no. The statement explicitly recognizes that prices vary with supply and demand affecting everyone in a market, including intensely local variation in rideshare. The concern is variation driven by an individual shopper’s personal data.
Does this apply to loyalty discounts?
It can. The FTC’s worked example of an acceptable disclosure involves personalization derived from a shopper’s own prior purchases under the same login, which implies that such personalization still requires disclosure where the shopper would otherwise expect a static price.
How is the state law risk different?
State statutes are binding law rather than guidance. Maryland’s act takes effect October 1, 2026 and covers food retailers and delivery services. Connecticut covers retail more broadly and adds a point-of-sale disclosure duty. New Jersey’s Fair Price Protection Act is the first to give consumers a private right of action, including class actions.
What was the Commission vote?
The vote authorizing the Federal Register notice was 2-0, according to the FTC’s announcement.
Does the policy statement bind the FTC?
No. The document states that it does not confer rights on any person and does not operate to bind the FTC or the public, and that in any enforcement action the Commission must still prove a violation of an existing statutory or regulatory requirement.
What data practices carry the most risk?
Pricing built on purchased third-party data appears highest risk, because the statement says businesses may violate Section 5 if they set personalized prices without sufficiently verifying that consumers consented to that data being collected for that purpose. That places a diligence duty on the retailer, not only on the data broker.