Two US states start enforcing bans on surveillance pricing on October 1, 2026. That date is the first on which American retailers face live obligations rather than pending bills, and it arrives 29 days from now, in the middle of holiday assortment and pricing lock-down.
Connecticut acts through Senate Bill 4, an omnibus privacy law signed on May 27, 2026, which applies across retail selling and third-party delivery. Maryland acts through House Bill 895, the Protection From Predatory Pricing Act, signed on April 28, 2026, which is narrower and targets food retail and grocery delivery.
The two statutes share a target and almost nothing else. Connecticut pairs a prohibition with a mandatory all-caps disclosure that must appear next to an affected price. Maryland has no label requirement at all, but it reaches into protected class data and carries the enforcement machinery of the state consumer protection act.
For any retailer running personalization, dynamic repricing, or a data-fed promotions engine, October 1 is the point at which two different definitions of a prohibited price become enforceable in two different jurisdictions on the same day.
In short
- October 1, 2026 is the first live compliance date for US surveillance pricing bans, in Connecticut and Maryland simultaneously.
- Connecticut SB 4 covers retail sellers and third-party delivery providers statewide, and requires the disclosure “THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA” on affected online prices.
- Maryland HB 895 is sector-specific: grocery-selling establishments of at least 15,000 square feet plus grocery delivery services, with no disclosure label and no private right of action.
- Penalty structures differ sharply: Connecticut runs civil penalties reported at up to $200 per day per consumer, Maryland routes violations through its consumer protection act with a 45-day cure period.
- New Jersey follows in 2027 with the first private right of action and treble damages, which makes the October 1 build the template retailers will reuse.
What actually changes on October 1
Until now the surveillance pricing debate in the United States has been a legislative and rulemaking story. New York’s Algorithmic Pricing Disclosure Act, in force since November 10, 2025, was the only operative state rule, and it requires disclosure rather than prohibition.
October 1 changes the register from disclosure to prohibition. On that date it becomes unlawful in Connecticut for a retail seller or a third-party delivery service provider to set a customized price for a consumer using personal data, subject to a list of exceptions. In Maryland it becomes an unfair, abusive, or deceptive trade practice for a covered food retailer or grocery delivery service to do the equivalent.
The practical consequence is that a pricing decision which was merely disclosable in one state becomes prohibited in two others, with a third disclosure regime layered on top. Retailers operating nationally now have to reconcile at least three distinct legal treatments of the same pricing logic, which is a pattern this site has tracked as surveillance pricing bans spread across US states through 2026.
There is no federal preemption in sight. The Federal Trade Commission has moved on personalized pricing but has not issued a final rule, which leaves the state patchwork as the operative law.
There is no de minimis threshold in either statute. Neither Connecticut nor Maryland conditions liability on the size of the price difference, the number of shoppers affected, or the revenue involved, so a limited test of personalized pricing is treated the same as a full deployment.
Nor is intent an element. Both regimes are structured around what the pricing system did rather than what the retailer meant, which is why counsel are focused on system inventories rather than on policy documents.
Why the date matters commercially, not just legally
October 1 sits directly before the holiday pricing window. Most large US retailers freeze promotional calendars and price architectures in September for November execution.
A prohibition that lands on October 1 therefore hits systems that are already configured, not systems in design. That is why compliance counsel have been treating this as a September problem rather than an October one.
What Connecticut’s price setting device rule actually requires
Connecticut’s approach is built around a defined artifact rather than a defined practice. SB 4 introduces the term “price setting device,” described in the statute as any automated or programmed process that uses a consumer’s personal data to establish a price for a consumer good or service to be sold, leased, exchanged, or provided to the consumer.
That definition is deliberately broad. It does not require artificial intelligence, machine learning, or a third-party vendor. A rules-based script that raises a displayed price because a shopper’s stored profile indicates low price sensitivity sits inside the definition.
The statute separately prohibits surveillance pricing, defined as establishing a customized price for a consumer for a consumer good or service based on personal data collected through any technology and by the person establishing the customized price, directly or indirectly. The words “directly or indirectly” are the operative risk: data acquired through a vendor, an app SDK, or an affiliate does not fall outside the rule.
The label, and where it has to appear
Where a covered business advertises or promotes online a price that a price setting device established, it must provide a readily visible disclosure reading: THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA.
The wording is prescribed, not paraphrasable. It is also an admission against interest in plain English, which is why several law firm advisories have read the provision as a de facto ban rather than a disclosure regime.
There is one meaningful carve-out. The disclosure is not required where the price setting device is used solely to offer a discounted price in an online transaction, which preserves personalized promotions that only move prices down.
That carve-out creates an obvious design incentive: set a high list price, then personalize downward. Whether Connecticut’s Department of Consumer Protection reads that as compliant structuring or as evasion is the first open enforcement question of the regime.
What still counts as a lawful price difference
Connecticut does not outlaw price variation. Per firm summaries of the bill, the exceptions include discounts designed to retain existing customers, and price differences attributable to legitimate business factors such as shipping cost, delivery timing, inventory levels, or market demand.
Broadly available promotional programs also survive. Loyalty programs, rewards programs, senior discounts, student discounts, and veteran discounts remain permitted where the terms are publicly disclosed and available on a non-individualized basis.
Certain regulated financial institutions and insurance entities are carved out entirely, consistent with the way Connecticut has handled sectoral overlap in its privacy statute. The residual category, individualized pricing driven by a shopper’s own behavioral profile, is what the law is aimed at.
How Maryland’s food retail ban is different
Maryland moved first in the nation and moved narrower. Governor Wes Moore signed HB 895 on April 28, 2026, after he and legislative leaders proposed the measure in January 2026 as an anti-surveillance-pricing initiative.
The Act bans dynamic pricing, defined as the practice of using a consumer’s personal data to set a personalized price that results in a higher price for food items. It separately bars using personal data to charge one consumer more than another, and bars using protected class data in offers or advertisements in a way that withholds advantages given to others.
That third limb is the one most often underestimated. It converts a marketing segmentation error into a civil rights adjacent exposure, and it does not require a price increase to be triggered.
The Maryland statute also reaches conduct that never produces a visible price at all. Because the protected class limb attaches to offers and advertisements, a targeted promotion withheld from a cohort can violate the Act even where every shopper sees the same shelf price.
That widens the internal audience for compliance work. Merchandising, CRM, and paid media teams all make targeting decisions that can trigger the provision, and none of them typically sit in a pricing governance process.
The 15,000 square foot line
Coverage attaches to business establishments of at least 15,000 square feet that sell groceries on the premises, plus services that deliver groceries to consumers. The square footage test is the practical boundary of the statute.
Conventional supermarkets and supercenters are inside it. Most convenience formats, small-format urban stores, and specialty grocers sit below the threshold and are outside the Maryland rule, though a Connecticut store of the same size would be captured by SB 4 because Connecticut applies no size test.
Grocery delivery platforms are captured regardless of physical footprint, which is why commentary on the bill has focused on delivery intermediaries. Analysts writing on the Act cited research indicating one delivery platform’s algorithm produced prices up to 23% higher on some products, with an estimated annual variation reported in the region of $1,200 for a household, figures that circulated during the legislative debate rather than findings made by the state.
The carve-outs, and the loopholes lawyers have flagged
Maryland exempts promotional pricing, loyalty and rewards programs, subscription pricing, geography-based or cost-based price differences, consumer-consented data exchanges, pricing-error corrections, and outage-related price resets. The list is long enough that privacy practitioners have publicly described the statute as leaky.
An analysis published by the International Association of Privacy Professionals identified four specific gaps: the Act does not define a baseline price, so a nominal regular price with personalized discounts remains available; the prohibition attaches to individual consumers rather than groups, after language covering group-based pricing was removed during drafting; loyalty and rewards discounts are explicitly excluded; and enforcement rests solely with the Attorney General.
The segment gap is the commercially significant one. A retailer that prices to a cohort of 5,000 similar shoppers rather than to one identified shopper is, on the face of the statute, outside the Maryland prohibition while remaining exposed under Connecticut’s broader “consumer, or group of consumers” framing that firm summaries describe.
How the four state regimes compare
The table below sets out the operative US rules as they stand on September 2, 2026. Dates are effective dates rather than signing dates.
| State | Instrument | Effective | Scope | Core obligation | Private right of action |
|---|---|---|---|---|---|
| New York | Algorithmic Pricing Disclosure Act | Nov 10, 2025 | Personalized algorithmic pricing, general | Disclose: price set by an algorithm using personal data | No |
| Maryland | HB 895, Protection From Predatory Pricing Act | Oct 1, 2026 | Grocery establishments 15,000 sq ft and above, grocery delivery | Prohibition on personalized pricing and protected class targeting | No |
| Connecticut | SB 4 (omnibus privacy law) | Oct 1, 2026 | Retail sellers and third-party delivery providers, statewide | Prohibition plus mandatory all-caps price label | No (agency enforcement) |
| New Jersey | Fair Price Protection Act | Aug 1, 2027 | Groceries and foodstuffs, retailers and delivery platforms | Prohibition plus electronic shelf label moratorium | Yes, including class actions |
| Vermont | H.942 | 2026 session | Electronic shelf labels in retail | Permits labels, bars intraday price increases except documented errors | No |
Two structural points follow from the table. First, the disclosure regime and the prohibition regimes are not alternatives, they stack, so a national retailer must be able to suppress a practice in Hartford while labeling it in Buffalo.
Second, the trajectory runs toward private enforcement. New Jersey’s statute, which this site covered when Governor Mikie Sherrill signed the Fair Price Protection Act on July 23, 2026, is the first to give consumers a direct cause of action, and it takes effect on the first day of the thirteenth month after enactment.
What the penalties actually expose a retailer to
The headline penalty numbers understate the exposure because the multiplier is the unit of violation, not the ceiling. A per-consumer, per-day structure applied to an always-on pricing engine compounds quickly.
| State | Enforcer | Reported penalty structure | Cure period | Multiplier risk |
|---|---|---|---|---|
| Connecticut | Department of Consumer Protection | Up to $200 per day, per consumer, per violation | Not specified in firm summaries | Very high: scales with audience size and elapsed days |
| Maryland | Attorney General, Consumer Protection Division | Consumer protection act treatment, reported at up to $10,000 per violation and up to $25,000 for repeat violations | 45 days after AG notice | Moderate: per violation, no private suits |
| New York | Attorney General | Up to $1,000 per violation | None specified | Moderate: disclosure failures are countable per display |
| New Jersey (2027) | Attorney General plus consumers | AG may seek $50,000 per violation or actual damages, whichever is greater; treble damages for willful conduct | None specified | Highest: class actions available |
Connecticut’s structure deserves particular attention. A per-consumer, per-day penalty measured against an e-commerce audience is arithmetically different from a per-incident fine, and it converts a configuration error left running for a fortnight into a material number.
Maryland’s 45-day cure period is the offsetting feature. It gives a covered retailer a defined window to remediate after notice, which is a meaningfully softer posture than the New Jersey model arriving in 2027.
This is now a familiar shape for US retail compliance. State-by-state divergence on pricing display has already forced national chains into conservative uniform policies, the same dynamic that pushed most large retailers toward skipping card surcharges under state surcharge laws this holiday season rather than operating different checkout rules per state.
Which systems have to change, and who owns the work
The compliance surface is wider than the pricing team. In most retail architectures, the personal data that triggers these statutes is collected by marketing technology and consumed by a pricing or promotions service, with neither team owning the combined risk.
Pricing engines and personalization stacks
The first task is an inventory: which systems can vary a displayed price, and which of them receive any consumer-level identifier. Session identifiers, hashed emails, loyalty numbers, device graphs, and location signals all qualify as personal data under the relevant state definitions.
The second task is separation. Cost-driven and demand-driven variation remains lawful in both states, so retailers need to demonstrate that a price moved because of inventory, delivery cost, or market demand, and not because of who was looking.
That demonstration is an evidence problem rather than a policy problem. Practitioners are advising clients to log the input features behind each price decision so that a lawful basis can be reconstructed months later.
Electronic shelf labels and in-store display
Electronic shelf labels have become the physical proxy for algorithmic pricing in state legislatures. Vermont’s H.942 permits the labels but bars intraday price increases except to correct documented pricing errors, and New Jersey’s Act freezes new deployments for a year after enactment.
Neither Connecticut nor Maryland imposes a shelf label moratorium on October 1. Retailers deploying the hardware in those states should nonetheless assume the equipment attracts regulatory attention disproportionate to its actual role in personalization.
Advertising, email, and app surfaces
Connecticut’s disclosure obligation attaches where a covered business advertises or promotes a price online. That reaches beyond the product detail page into email, push notification, retargeting creative, and in-app offers.
Any surface capable of rendering a personalized price needs either the prescribed label or a guarantee that the price shown was not produced by a price setting device. Most retail marketing stacks cannot currently make that guarantee at the creative level.
Why grocery and delivery are the first targets
Three of the four state statutes point at food. That is a political choice rather than a technical one: groceries are a repeat, non-discretionary purchase where individualized pricing reads as extraction rather than merchandising.
Delivery intermediaries sit at the center because they hold the richest behavioral data and control the price surface. They also lack the physical shelf that historically anchored a single public price for all shoppers.
The commercial context is that grocery margins are already thin and under scrutiny. Investor attention on grocery pricing discipline is intense, and the sector heads into a run of results that includes Kroger’s second quarter report on September 11, where identical sales performance and price investment are the questions in focus.
Any grocer that answers a margin question with an explanation involving personalized pricing now has a regulatory problem in three states. That constraint arrives before the tools have delivered most of their promised benefit.
Contractual exposure is the second-order problem. Where a delivery intermediary sets the consumer-facing price on a grocer’s catalog, the grocer is frequently the covered retail seller in the eyes of the statute while the intermediary controls the logic that creates the violation.
Most existing marketplace and delivery agreements were written before any of these statutes existed. Retailers renegotiating for 2027 are adding representations that the partner will not apply individualized pricing to their goods, plus audit rights and indemnities tied to state consumer protection claims.
What Washington is doing while the states move
Federal activity has been steady without producing a binding national rule. The Federal Trade Commission issued 6(b) study orders to eight companies in July 2024, and has since moved toward rulemaking, with an advance notice of proposed rulemaking on pricing issued on April 14, 2026 according to law firm tracking.
The agency has also settled. Reported outcomes include a $60 million settlement with a major grocery delivery platform in December 2025 and a $25 million settlement with GrubHub in December 2024, both involving pricing and fee disclosure conduct.
Congress has held hearings without passing legislation. A Senate Judiciary subcommittee convened a hearing titled “Your Data, Their Profit: The Consumer Cost of AI Surveillance Pricing” on August 4, 2026, and bills including a federal One Fair Price Act and the Stop Price Gouging in Grocery Stores Act remain pending.
For retailers, the enforcement-posture question at federal level is separate from the compliance question. We covered the agency’s direction when the FTC opened a comment window on its personalized pricing policy statement, and the practical read has not changed: federal action shapes exposure, state statutes set the deadline.
The antitrust track is separate
Algorithmic pricing also runs through antitrust doctrine, where the questions are collusion and information exchange rather than consumer data. The Ninth Circuit held in Gibson v. Cendyn Group in August 2025 that shared use of a common pricing vendor does not by itself establish an agreement.
That ruling narrowed one theory of liability without touching the state consumer protection statutes now taking effect. A retailer can be entirely clear of an antitrust claim and squarely inside Connecticut’s prohibition.
What comes next after October 1
The near-term calendar is legislative rather than judicial. New York’s One Fair Price Act passed the state legislature on June 10, 2026 and awaits signature, and would convert New York from a disclosure state to a prohibition state with penalties reported at up to $5,000 and up to $20,000 for subsequent violations.
Advocacy trackers counted bills in more than twenty states during the 2026 sessions, and analysts have suggested that California and Illinois could enact stricter versions without Maryland’s carve-outs before the end of 2026. Whether that happens depends on session calendars rather than on any pending federal action.
The likelier operational outcome is convergence toward the strictest applicable rule. National retailers rarely maintain state-specific pricing logic for a product category, because the engineering cost and the reputational risk of a misfire both exceed the incremental revenue.
If that pattern holds, October 1 functions as a national deadline in practice even though only two states are binding on the day. The first enforcement action, wherever it lands, will set the reference point everyone else prices against.
Enforcement posture in the first year is the open variable. Connecticut’s Department of Consumer Protection and Maryland’s Attorney General both have discretion over whether to open with education or with an action, and the 45-day Maryland cure period suggests a remediation-first design.
Retailers should not read that as a grace period in Connecticut. The per-day penalty structure there rewards early suppression regardless of how the regulator chooses to open, because exposure accrues from the effective date rather than from the date of notice.
What retailers should do in the next 29 days
The work divides into discovery, suppression, and evidence. None of it requires waiting for regulatory guidance that is unlikely to arrive before the effective date.
- Inventory every system that can vary a displayed price, including third-party personalization vendors and delivery partners operating your catalog.
- Identify which of those systems receive a consumer-level identifier of any kind, including hashed identifiers and device graphs.
- Geofence or disable individualized upward price adjustment for Connecticut and Maryland traffic, and confirm the suppression applies to app and email surfaces, not just the website.
- Confirm your Maryland footprint against the 15,000 square foot test and document the determination for each store.
- Verify that loyalty, rewards, senior, student, and veteran discount programs are publicly disclosed and uniformly available, which is what places them inside the exemptions.
- Instrument logging so that each price decision records its inputs, which is the only practical way to prove a lawful basis after the fact.
- Prepare the Connecticut disclosure as a deployable component even if you intend never to use it, so that a discovered edge case is a configuration change rather than a development project.
- Brief merchandising and marketing on the protected class limb of the Maryland statute, which can be triggered by targeting choices that never touch a price.
The statutory text for the Maryland Act is available through the Maryland General Assembly bill page for HB 895 for teams that need the operative language rather than a summary.
Frequently asked questions
What exactly is surveillance pricing?
It is the practice of using a specific consumer’s personal data, such as browsing history, purchase history, location, or device signals, to set an individualized price for that consumer. It is distinct from dynamic pricing based on supply and demand, which changes the price for everyone at once and remains lawful under all four state statutes.
Does the Connecticut law ban personalized pricing outright?
It prohibits surveillance pricing by retail sellers and third-party delivery providers, subject to exceptions for retention discounts, legitimate business factors such as shipping cost and demand, and broadly available discount programs. Where a covered price is advertised online, a prescribed all-caps disclosure is required unless the device was used solely to offer a discount.
Does Maryland’s law apply to my convenience store?
Probably not on the size test. HB 895 attaches to establishments of at least 15,000 square feet selling groceries on the premises, plus grocery delivery services, so smaller formats fall outside it. A Connecticut location of the same size would still be covered, because SB 4 applies no square footage threshold.
Are loyalty programs still allowed?
Yes in both states, subject to conditions. Maryland explicitly excludes loyalty and rewards programs, and Connecticut permits broadly available promotional programs with publicly disclosed terms, which covers loyalty, senior, student, and veteran discounts.
Can consumers sue under these laws?
Not in Connecticut or Maryland. Connecticut enforcement runs through the Department of Consumer Protection and Maryland’s through the Attorney General’s Consumer Protection Division, with a 45-day cure period. New Jersey’s Act, effective August 1, 2027, is the first to create a private right of action, with class actions and treble damages for willful violations.
What happens to electronic shelf labels?
Neither Connecticut nor Maryland restricts them on October 1. Vermont’s H.942 permits the labels but bans intraday price increases other than documented error corrections, and New Jersey’s Act imposes a one-year freeze on new deployments following its July 23, 2026 enactment.
Is there a federal rule coming?
Nothing binding has been finalized. The FTC issued 6(b) study orders in July 2024 and, per law firm tracking, an advance notice of proposed rulemaking on pricing on April 14, 2026, while bills remain pending in Congress. Until a final rule exists, state statutes set the compliance deadline.
Does using a shared third-party pricing vendor create antitrust risk?
Not on its own, following the Ninth Circuit’s August 2025 decision in Gibson v. Cendyn Group, which held that shared vendor use alone does not establish an agreement. That is a separate question from the state consumer protection statutes, and clearing the antitrust test does not clear the Connecticut prohibition.
What is the single highest-risk gap for a national retailer?
Marketing surfaces. Suppression is usually implemented at the pricing service and on the website, while email, push, and retargeting creative can still render a personalized price without the Connecticut disclosure attached.