Personalized Pricing: State Legislative Activity and Enforcement Risk

Key points

• The FTC’s October 28, 2026 pricing inquiry includes Walmart, Target and Instacart. Recipients must coordinate order-specific responses within 45 days of receipt; other retailers should consider a voluntary, proportionate review over the next 90 days.
• The inquiry is an information-gathering study, not a finding of wrongdoing or a general ban on personalized or algorithmic pricing. It does not itself establish a new disclosure rule.
• Personalized pricing, sometimes called surveillance pricing, uses data about an individual shopper to set or adjust the price that shopper sees. It is now a legislative and enforcement priority.
• New York already requires a conspicuous disclosure when a price is set by an algorithm using personal data, and other states have introduced bills that would disclose, restrict or ban the practice.
• Existing law reaches the practice without any new statute. Unfair and deceptive practices laws, state privacy laws, anti-discrimination law and, in some settings, antitrust law all apply.
• Retailers should map pricing and loyalty inputs, tools, decision records and vendors, then compare customer-facing disclosures with actual practices.
• Published member discounts and time-, demand- or inventory-based price changes are not necessarily personalized pricing. These approaches can overlap; the inputs that determine the customer’s price matter more than the label.

The FTC inquiry: recipient responses and retail preparedness

According to the supplied signal’s account of the FTC announcement, the October 28, 2026 inquiry directly includes Walmart, Target and Instacart and examines whether personal data or loyalty participation influences individual prices. The inquiry details here come from that supplied account; the announcement was not independently reopened for this update.

Named recipients should confirm receipt and coordinate responses to their specific orders. The 45-day response period runs from receipt, not from the announcement date. Company-specific receipt dates are not established here, so no recipient-specific deadline can be calculated.

Other retailers should consider a proportionate review over the next 90 days. That is a preparedness recommendation, not an FTC-mandated deadline or a requirement that all retailers respond. If a business receives an order, its order-specific obligations and confirmed receipt date should guide the response.

The inquiry is an information-gathering study. It does not establish wrongdoing, a general pricing ban, a new disclosure requirement or new GB or EU obligations. The practical question is what actually determines a customer’s price: does membership unlock a common discount, or does customer information alter that individual’s price?

Why lawmakers are focused on pricing

Retailers have long varied prices by location, channel, time of day and inventory. What has changed is the volume and granularity of the data now available. When a retailer can combine purchase history, device signals, location and inferred income or urgency, a price can in principle be tailored to what a particular shopper is likely to accept. Legislators and regulators describe this as surveillance pricing, and the label alone signals how the issue is being framed.

The Federal Trade Commission opened a study of the practice in 2024 and published preliminary observations about the data and tools vendors offer. This article’s earlier reference to that study did not cover the October 28, 2026 inquiry, its named retail recipients or its receipt-based response period. The related article, Loyalty Programs Under Scrutiny: Data Use, Dark Patterns and Point Devaluations, provides supporting context on data mapping, profiling, notices, consent, opt-outs and program changes, but likewise did not cover those inquiry-specific details. Federal policy since the earlier study has been less settled, which has left states to move first. For retailers operating nationally, the result is a patchwork that is still forming.

What states have done so far

New York's algorithmic pricing disclosure law is the clearest example. It requires a business that sets prices using an algorithm that relies on a consumer's personal data to display a prescribed statement next to the price. A trade association challenged the law, and a federal court declined to block it, so businesses serving New York consumers have needed to assess whether the law reaches their pricing.

Other states, including California, have seen bills that would go further, for example by restricting the use of certain categories of personal data in pricing, or by prohibiting individualized price increases. Several bills have addressed grocery and food retail in particular, reflecting political concern about household costs. Most proposals have been narrowed, delayed or amended as they moved, and the text a retailer reads in September may not be the text that passes. We recommend tracking bills by their operative definitions, because the scope of terms such as personal data, algorithm and price determines who is covered.

Existing law already applies

No dedicated statute is needed for a regulator to ask whether a pricing practice is unfair or deceptive. State attorneys general have broad authority under their consumer protection statutes, and the FTC Act prohibits unfair or deceptive acts or practices. Three fact patterns draw the most attention: prices that differ materially between shoppers without any disclosure, claims such as lowest price or member price that are not accurate for the individual, and pricing that appears to track a shopper's inferred vulnerability or urgency.

Privacy law adds a second layer. Many comprehensive state privacy laws give residents the right to opt out of profiling used for decisions with significant effects, and they limit the processing of sensitive data. Where sensitive inferences feed a pricing model, the processing may require consent. Notices must also describe the purposes accurately. A privacy notice that says data is used to improve services may not be enough if the data is used to set individual prices.

Anti-discrimination law matters as well. If a pricing model produces systematically different outcomes by reference to a protected characteristic, even through proxies such as geography, the retailer may face questions under civil rights and fair lending style theories, depending on the sector and state.

Antitrust and algorithmic pricing

Personalized pricing is a distinct issue from algorithmic pricing coordination, but the two are often discussed together. When several competitors use the same pricing vendor, regulators and private plaintiffs have asked whether shared tools and data amount to an agreement or an unlawful exchange of information. Retailers should keep the two questions separate in their analysis and read our related note on algorithmic pricing and information exchange.

A practical approach

First, build an inventory. Identify every place where price, discount or offer varies by shopper. Map the loyalty and pricing data inputs, tools, decision records and third-party vendors involved, and establish which inputs actually affect the price. Many retailers discover that the pricing engine, the loyalty program and the marketing platform each make individualized decisions that were never reviewed together. Assess whether vendor documentation and contractual rights provide enough visibility to explain those decisions and answer regulatory questions.

Second, classify by mechanics rather than labels. Published member discounts, promotions open to everyone and time-, demand- or inventory-based price changes differ from prices individualized using customer information, including predicted willingness to pay. These approaches can overlap. Confirm whether membership simply unlocks a common discount or whether purchase history, profiling or other customer information changes the individual’s price.

Third, compare disclosures with practice. Have privacy, pricing, loyalty and commercial teams review whether customer-facing explanations accurately describe the inputs and decisions identified in the inventory. Where a state requires a notice, check that it appears where the price appears, in the required wording, on every channel including apps and kiosks. Where no notice is required, consider whether the retailer would be comfortable explaining the practice publicly. The FTC inquiry itself does not create a new notice requirement.

Fourth, put governance around changes. Data science teams can alter a model quickly. A lightweight review by legal and compliance before new inputs are added, with a record of the decision, is a modest cost against the reputational and enforcement risk. Review supporting privacy and loyalty practices, including notices, consent, opt-outs and program changes, alongside pricing mechanics.

For retailers that have not received an order, use the recommended 90-day review to identify gaps in visibility, records and disclosures and prioritize proportionate follow-up. For recipients, organize the work around the specific order and its receipt-based response period rather than this voluntary review timetable.

Corvane Ryle's Privacy & Cyber, Consumer Protection and Antitrust & Competition teams work together on pricing questions for retailers, marketplaces and technology providers.