Cybersecurity Policy Report, FTC Intends to Police Retailers’ Use of ‘Surveillance Pricing’, (Aug 20, 2026)

By Tom Leithauser

Retailers that set prices based on data collected from customers—a practice known as “surveillance pricing”—may run afoul of the FTC Act if they fail to disclose their price-setting practices, according to the Federal Trade Commission.

“The public, Congress, and state legislatures are increasingly concerned that the massive amount of data collected and generated when consumers use modern technology is making it possible for merchants to personalize prices for goods and services that traditionally did not vary from person to person and which American consumers therefore reasonably expect will not be any different for them than they will be for their friends or neighbors,” the FTC said yesterday in an enforcement policy statement.

“The rise of data-driven ‘personalized pricing’ has the potential to transform our history of relatively limited variation in pricing from one consumer to the next. The significant amount of data collected and generated when consumers use modern technology may give merchants the tools to personalize prices for goods and services that traditionally have not varied from person to person,” it said.

“Many Americans do not understand just how much data they generate every second of their lives. Nor do they necessarily understand how those data are collected and stored, to whom they may be sold, or how they may be used—including, potentially, to price products and services uniquely for them on the basis of their intimate details,” the statement noted.

The FTC acknowledged that it lacked authority “to prohibit personalized pricing in all circumstances” but said it would “enforce the law aggressively against any deceptive or unfair personalized pricing practices that violate Section 5 of the FTC Act or any other law enforced by the Commission.”

“Retailers may deceive consumers in violation of Section 5 when they represent, expressly or by implication, that a price is static or widely offered when in fact it is personalized,” it said.

“They may similarly deceive consumers when a consumer reasonably believes that a price for a good or service is static or widely offered, and the merchant fails to disclose that the price is in fact personalized,” it added.

“Such misrepresentations or omissions are likely to be material: consumers who are unaware of personalized pricing cannot take steps to avoid the higher prices that may result from it, such as using a virtual private network or private browsing functionality, choosing a different retailer whose prices are static or widely offered, rather than personalized, or simply declining to complete the transaction,” according to the policy statement.

“Data practices associated with personalized pricing may also implicate Section 5. The Commission has long applied Section 5 to protect consumers’ data privacy. Businesses that collect, use, or disclose consumers’ personal data for the purpose of personalized pricing without adequate disclosures or without obtaining consent may violate Section 5,” it said.

Retailers in sectors where customers might not expect to encounter surveillance pricing should provide disclosures when surveillance pricing is used and should also ensure that customers understand their data-collection practices, the FTC recommended.

“To be effective, personalized pricing disclosures should be clear and conspicuous and include all relevant information, such as the fact that the price is personalized, the basis of that personalization, and the type of data used,” it advised.

“When consumers see a listed price, they expect it to be same price that everyone else sees, not the retailer’s estimate of how much they are willing to pay based on their personal data,” FTC Chairman Andrew Ferguson said in a news release. “The FTC does not have the legal authority to ban personalized pricing in all circumstances, but businesses that fail to tell consumers how their personal data is being used to set a price may be in violation of the FTC Act and other laws we enforce.”

The FTC approved the policy statement by a vote of 2-0. Comments on the statement will be due 30 days after its publication in the Federal Register.

MainStory: TopStory FederalLegislation DataPrivacy LitigationEnforcement