Why surveillance pricing has become an AI governance issue

"Surveillance pricing" is the term regulators now use for a specific application of AI and data analytics: adjusting the price a given consumer sees for the same good or service based on that consumer's own data, rather than on cost, inventory or general market conditions. That data can include location, browsing and purchase history, device type, demographics, inferred willingness to pay and even in-session behaviour such as mouse movements or items abandoned in a cart. For a retail or consumer-facing business, this sits squarely inside AI governance because the exposure is not theoretical. In 2025 and 2026, US federal and state regulators moved from studying the practice to actively investigating and, in some states, banning it.

The FTC's surveillance pricing study: what it actually found

In July 2024, the Federal Trade Commission voted 5-0 to use its Section 6(b) authority, which lets it compel information from companies without a specific law enforcement purpose, to study the "surveillance pricing ecosystem." It issued orders to eight companies seeking information on how they build and sell pricing and targeting tools, as described in the FTC's July 2024 press release.

On 17 January 2025, the FTC published its preliminary findings in a press release titled "FTC Surveillance Pricing Study Indicates Wide Range of Personal Data Used to Set Individualized Consumer Prices", alongside a staff report titled "Issue Spotlight: The Rise of Surveillance Pricing" and a companion, partially redacted "Surveillance Pricing 6(b) Study: Research Summaries, A Staff Perspective". Based on an initial review of documents from Mastercard, Accenture, PROS, Bloomreach, Revionics and McKinsey and Co, FTC staff found that the intermediary firms studied worked with at least 250 clients selling goods and services ranging from grocery stores to apparel retailers. Staff described a spectrum of tools, from generalised store or group-level pricing built on aggregated transaction data, through to individually targeted pricing and promotions built on a specific consumer's real-time browsing and transaction history, for example a cosmetics company targeting promotions by skin type or skin tone. The report concluded that widespread adoption of these tools could fundamentally change how consumers buy and how companies compete, while flagging that more research was needed on actual consumer impact.

FTC Act Section 5 as the operative legal hook

There is no dedicated federal statute for algorithmic or surveillance pricing. The FTC's authority instead runs through Section 5 of the FTC Act, which prohibits "unfair or deceptive acts or practices" in commerce. Applied to AI-driven pricing, this means two separate theories of liability are live: a practice can be "deceptive" if a retailer misrepresents that everyone sees the same price, or omits that a price was personalised using the consumer's own data, and a practice can be "unfair" if it causes substantial, non-reasonably-avoidable consumer injury without offsetting benefit, even absent any misrepresentation. In April 2026 Senate Commerce Committee testimony, FTC Chairman Andrew Ferguson said the agency's preliminary economic analysis of a prior administration's proposed AI and algorithmic pricing rulemaking would have imposed "staggering" compliance costs, and confirmed the FTC's current approach is to enforce existing statutes against fraud, misrepresentation and consumer harm rather than to act as a general AI regulator absent new congressional authority, as reported by Kelley Drye's summary of the hearing. That is the practical takeaway for retailers: Section 5 enforcement risk on pricing AI depends on disclosure and injury, and it is being tested case by case rather than through a bright-line pricing rule.

Related FTC actions, orders and workshops in 2025 to 2026

  • On 17 December 2024 the FTC finalised its "Junk Fees Rule" on unfair or deceptive fees, which took effect on 10 May 2025 and requires upfront disclosure of total price, including mandatory fees, in live-event ticketing and short-term lodging, per the FTC's announcement. It is narrower than originally proposed and does not itself reach personalised pricing, but it sets the template regulators are now extending to pricing transparency generally.
  • On 8 January 2026 the FTC announced a workshop, held 26 February 2026, on "Consumer Injuries and Benefits in the Data-Driven Economy", whose agenda included a panel on the impact of personalised and dynamic pricing on consumers, alongside sessions on data breaches and behavioural advertising.
  • In the same April 2026 testimony, Ferguson indicated FTC staff are examining whether additional disclosure could be required once pricing becomes highly personalised or data-driven, without committing to a specific rule or order.

State-level laws now in force or in motion

State attorneys general and legislatures have moved faster than Congress. New York's Algorithmic Pricing Disclosure Act took effect on 10 November 2025 and requires many businesses that use personal data to set individualised prices to disclose that fact to consumers; Attorney General Letitia James has since issued a consumer alert and opened an inquiry demanding information from Instacart about its pricing practices and compliance, per her office's press release. New York went further on 10 June 2026 when its legislature passed the One Fair Price Act, which Governor Kathy Hochul signed on 17 June 2026, banning the use of personal data such as browsing history, device type, income or location to individually tailor or inflate prices, while preserving legitimate loyalty programmes, coupons and senior discounts, as summarised by Regulatory Oversight. That makes New York the third state with a surveillance pricing ban, after Maryland and Connecticut.

California has taken a related but distinct route. AB 325, signed on 6 October 2025 and effective 1 January 2026, makes it unlawful to use or distribute AI pricing technology as part of an agreement in restraint of trade, an antitrust-flavoured approach targeted at coordinated pricing rather than personalisation, according to Arnold and Porter's analysis. Separately, on 28 January 2026 California Attorney General Rob Bonta announced an investigative sweep sending inquiry letters to retail, grocery and hotel businesses, testing whether using shopping, browsing, location and inferential data to set individualised prices breaches the CCPA's purpose limitation requirement, per the California DOJ press release. Colorado's legislature passed a surveillance pricing and wage-setting ban, House Bill 26-1210, which Governor Jared Polis vetoed on 2 June 2026 as too broad, so no Colorado ban of that kind is currently in force, per FindLaw's coverage. On the antitrust side, the Department of Justice's proposed settlement with RealPage, filed 24 November 2025 over algorithmic rental pricing software, is instructive by analogy for any retailer using shared or vendor-provided pricing algorithms: it bars use of real-time non-public competitor data, requires that training data be at least twelve months old, and imposes a three-year court-appointed monitor, per Wilson Sonsini's summary.

Practical governance controls for retailers

Because pricing AI is not on any federal list of "high-risk" AI use cases, the burden falls on ordinary consumer protection, privacy and competition law, plus a retailer's own governance discipline. Controls worth standing up now include:

  • Documented data lineage for every input feeding a pricing model, including which behavioural, location or third-party data sources are used, so counsel can assess Section 5 and state disclosure exposure before regulators ask.
  • Fairness testing across protected classes and proxies for them, such as zip code or device type, even though no federal rule mandates it, given that several of the FTC's own examples (skin tone-targeted promotions) came from ordinary commercial pricing tools, not exotic AI.
  • Audit logging of price-determination logic, sufficient to reconstruct why a given consumer received a given price on a given date, since several state laws now carry per-violation penalties and Section 5 cases turn on what the company knew and disclosed.
  • Consumer-facing disclosure that matches emerging state requirements, following New York's Algorithmic Pricing Disclosure Act and One Fair Price Act as the current high-water mark, rather than waiting for a federal rule that may not arrive.
  • Vendor due diligence for third-party pricing and revenue management tools, given that the FTC's own study centred on intermediary vendors (Mastercard, Accenture, PROS, Bloomreach, Revionics, McKinsey) rather than retailers building tools in-house, and that the RealPage settlement shows vendor-side data-sharing practices can create direct legal exposure for the retailer using the tool.

Primary sources: FTC Surveillance Pricing Study press release · FTC Issue Spotlight: The Rise of Surveillance Pricing · FTC 6(b) Study Research Summaries · FTC July 2024 6(b) Orders · FTC Junk Fees Rule · FTC Workshop Announcement, January 2026 · Kelley Drye on Ferguson's April 2026 testimony · NY AG James, Instacart inquiry · New York One Fair Price Act summary · Arnold and Porter, Algorithmic Pricing Bans Go Coast to Coast · California AG Bonta investigative sweep · Colorado veto coverage · Wilson Sonsini on DOJ v RealPage settlement