The Federal Trade Commission (FTC) is putting businesses on notice that using personal data to set individualized prices without clear disclosure may violate Section 5 of the FTC Act. The proposed policy statement does not ban personalized pricing, but it draws a line for transparency and, importantly, signals aggressive enforcement ahead.
Background
In August, the FTC issued a proposed enforcement policy statement addressing personalized pricing — the practice of using personal data to set a price based on what a business believes a particular consumer is willing to pay. The proposal does not create new legal authority or bind courts, but it puts businesses on notice that the FTC views undisclosed personalized pricing as a probable violation of Section 5 of the FTC Act and intends to enforce this provision “aggressively.” The public has until September 18 to submit comments.
This is the latest in a series of FTC actions focused on pricing transparency under the Trump administration, including enforcement actions targeting hidden fees and surprise charges.
Personalized pricing is not the same as dynamic pricing
Not every price change triggers the FTC’s concern. Dynamic pricing—the practice of adjusting prices based on market-wide conditions such as supply and demand, time of day, or inventory levels—is not the target of this proposal, nor are products like insurance or credit where individualized pricing reflects projected risk.
Personalized pricing, by contrast, estimates a consumer’s willingness to pay by using information about them, such as browsing history, purchase patterns, location, device information, household characteristics, or inferred income. The core concern is not that two consumers may pay different prices, but that a business may silently use personal data to decide how much a specific consumer will be charged. That distinction should be central to any compliance analysis.
The FTC’s legal theory under Section 5
The FTC relies on its existing authority over unfair or deceptive acts or practices.
Deception: Consumers generally expect a listed price to be the same for everyone shopping at the same place and time. A retailer may mislead consumers by representing (expressly or by implication) that a price is broadly available when it has been personalized. The omission is material because informed consumers could comparison shop, use a VPN, choose a different retailer, or walk away. Misleading consumers about the basis for personalization—e.g., setting a higher price based on disposable income data, but framing it as a loyalty discount—is a separate deception risk.
Unfairness: A higher price resulting from concealed personalization may cause substantial injury that consumers cannot reasonably avoid, and the FTC reasons that any benefits of personalization could be achieved without concealing it. The FTC has not taken a position about whether personalized pricing could be unfair even when fully disclosed.
Data privacy: The FTC also connects personalized pricing to data privacy obligations. Collecting, using, or disclosing personal data for personalized pricing without adequate notice or consent, or without verifying that the consumer consented to the data’s collection for that purpose, may present a separate Section 5 risk.
What the FTC expects businesses to disclose
Where consumers reasonably expect a generally available price, the FTC says disclosures should be clear and conspicuous, and explain three things:
- The fact of personalization—that the displayed price is personalized
- The basis for the personalization—why or how the price was personalized
- The types of data used—what categories of personal information influenced the price
Vague language will not suffice; a “specifically selected” price label would probably be misleading. By contrast, disclosing that a price reflects the consumer’s estimated willingness to pay, derived from prior purchase data through the same account, would probably suffice if accurate and complete. The proposal does not prescribe specific language, placement, or formatting, but businesses should ensure disclosures reach consumers before personalization affects their purchasing decisions and not only at checkout.
FTC’s examples signal where it sees the greatest risk
The proposed statement identifies several scenarios the FTC believes could raise Section 5 concerns without adequate disclosure, including:
- A food delivery company charging more to consumers whose data suggests they cannot leave their homes
- A grocery chain charging more for milk because data shows children live in the household
- A hotel charging more because data indicates the consumer is traveling for a funeral
- A rideshare company charging more because the consumer lacks a competitor’s app or needs emergency medical transport
- A retailer charging more because the consumer is currently in the store or parking lot
The common thread: Using sensitive or situational data to exploit a consumer’s perceived lack of alternatives is more likely to draw scrutiny than a market-wide price adjustment.
State landscape is moving faster
The FTC’s proposal arrives against a rapidly changing state backdrop. Four states have already enacted personalized pricing laws, with approaches ranging from disclosure mandates to outright prohibitions.
Connecticut
- Law: HB 5563
- Core requirement: Must display notice when a price-setting device uses personal data to increase a price
- Effective date: July 1, 2027
Maryland
- Law: Protection from Predatory Pricing Act, HB 895
- Core requirement: Prohibits food retailers and delivery services from using personal data to set prices (carve-outs for promotions and loyalty programs)
- Effective date: October 1, 2026
New Jersey
- Law: A4523
- Core requirement: Prohibits surveillance pricing for groceries based on personal data (exceptions for cost differences and loyalty programs)
- Effective date: August 1, 2027
New York
- Law: Algorithmic Pricing Disclosure Act (2025; One Fair Price Act pending)
- Core requirement: Disclosure mandate in effect; legislature passed a bill replacing it with a prohibition (awaiting governor’s action)
- Effective date: In effect/pending
Additional bills are pending in other states, and state attorneys general can investigate pricing practices under existing consumer-protection statutes. For businesses, this creates layered exposure: FTC enforcement, state statutory requirements, state AG investigations, and follow-on private litigation.
What businesses should do now
The final form of the policy statement may change after the comment period, but businesses should not wait to understand their own pricing practices.
Inventory pricing practices and map data inputs: Identify every point (both online and in-store) where prices, fees, or recommendations can vary by user, account, device, location, or segment. For each, determine whether the underlying data is individual-level (browsing history, inferred income, third-party data) or aggregate (supply and demand, regional costs). The line between regulated personalized pricing and permissible dynamic pricing turns on that distinction.
Audit pricing vendors: Regulators and plaintiffs are unlikely to accept “the vendor did it” as a defense. Review vendor documentation, data rights, audit rights, indemnification, and restrictions on cross-client data use.
Pressure-test disclosures Evaluate whether existing notices explain the fact, basis, and data inputs of personalization clearly and conspicuously, and before the consumer commits to a purchase, not only at checkout. Vague references to “specially selected” pricing will not suffice.
Align data practices with privacy commitments: Confirm that actual uses of data match privacy notices, consumer consents, and loyalty-program terms. Using data collected for a different purpose to set personalized prices without disclosure or consent creates independent Section 5 risk.
Test for unintended outcomes: Assess whether algorithms rely on proxies for protected characteristics or disproportionately raise prices for vulnerable consumers—the scenarios most likely to attract enforcement attention.
Submit comments and prepare for multi-state compliance: Businesses with a stake in the FTC’s framework should consider commenting before the September 18 deadline. Given the pace of state legislative activity, companies should also evaluate their exposure under applicable state laws, several of which go beyond disclosure to outright prohibition.
The bottom line: Personalized pricing is not off limits, but undisclosed personalization is becoming harder to defend at both the federal and state levels. Businesses that understand how their pricing tools work, disclose personalization clearly, and align pricing practices with privacy promises will be better positioned as regulators, lawmakers, and plaintiffs’ lawyers continue to focus on this issue.