Few areas of privacy and technology policy have attracted as much legislative attention this year as data-driven pricing or “surveillance pricing.” On August 4, the Senate Judiciary Committee held a hearing—“Your Data, Their Profit: The Consumer Cost of AI Surveillance Pricing”—highlighting the intense scrutiny on these practices by policymakers. In 2026 alone, FPF tracked the introduction of over 100 bills seeking to regulate some form of data-driven pricing at the state and federal levels. Despite the shared interest, these bills vary significantly in terms of both the entities who would be in scope and the technologies and data uses that would be regulated. 

Three states have enacted broad data-driven pricing laws so far this year: Maryland, Connecticut, and New Jersey. These states join New York, which passed the Algorithmic Pricing Disclosure Act last year. This blog post provides an overview of each of these three new laws, covering their key definitions, scope, obligations, and enforcement: 

• Scope: Maryland’s law applies only to qualifying food retailers and third-party delivery service providers. Connecticut’s prohibition extends more broadly to cover all retail sellers and third-party delivery services, with disclosure requirements for any person doing business in the state. New Jersey’s law sits in-between—prohibiting surveillance pricing by any person but only with respect to “groceries and other foodstuffs.”
• Obligations: Maryland prohibits using personal data or dynamic pricing to set higher prices for covered food. Connecticut prohibits surveillance pricing, subject to exceptions, and requires disclosures when personal data is used to increase a price. New Jersey prohibits using surveillance pricing to determine or vary prices and places a one-year moratorium on the new use of electronic shelf labels.
• Enforcement: Maryland and Connecticut rely on AG enforcement, while New Jersey permits broader enforcement mechanisms, including a private right of action.
• Effective Dates: Maryland (October 1, 2026); Connecticut (February 1, 2027); New Jersey (August 1, 2027)

Maryland

The “Protection from Predatory Pricing Act” (HB 895) was enacted in April and regulates the use of dynamic pricing by food retailers and third-party service providers. The law takes effect on October 1, 2026. The law defines several key terms that establish its scope:

• “Food retailer” means a merchant operating a business establishment with a minimum of 15,000 square feet and selling food that is exempt from Maryland’s sales and use tax [§ 11-206(c) of the Maryland tax code].
• “Third-party delivery service provider” means a merchant that facilitates, as a consumer service, the delivery of food that is exempt from Maryland’s sales and use tax [§ 11-206(c) of the Maryland tax code]. This does not include a food retailer.
• “Dynamic pricing” means “the discriminatory practice of offering or setting a personalized price for a good or service that is specific to a consumer based on the consumer’s personal data [as defined in MODPA], regardless of whether the seller collected or purchased the personal data.”
• “Protected class data” means “information about an individual or group of individuals that, alone or in combination, directly or by implication identifies a characteristic that is legally protected from discrimination under the laws of the State or under federal law.” 

Under the law, a food retailer or third-party delivery service provider may not:

• Engage in dynamic pricing to set a higher price for food that is exempt from Maryland’s sales and use tax (§ 11-206(c) of the Maryland tax code);
• Use personal data to set a higher price for food that is exempt from Maryland’s sales and use tax (§ 11-206(c) of the Maryland tax code) for a single consumer;
• Use protected class data to “offer, advertise, or sell a consumer good or service to a consumer for whom the protected class data pertains if the use of the protected class data has the effect of withholding or denying from the consumer an accommodation, an advantage, or a privilege accorded to others.”

The law includes a number of tailored exceptions for common pricing practices. Businesses are allowed to use promotional pricing offers, loyalty program benefits, or other temporary discounts or changes to pricing related to retention of existing customers. They are also allowed to set a different price based on objective costs attributable to providing goods or services (e.g., price differences based on shipping or taxes due to the consumer’s physical location); costs or differences in supply or demand associated with providing goods or services in different locations or geographies; or costs associated with the availability or supply of the goods or services. Businesses are also allowed to offer a price to a consumer through a loyalty, membership, or rewards program in which any consumer may voluntarily enroll or consent to participate, offer prices in connection with a subscription-based contract or agreement, and offer prices to a consumer who consents (as defined in Maryland’s comprehensive privacy law) to providing personal data or other information in exchange for obtaining the price. The law also exempts correcting a price resulting from a pricing error or resetting a price following a system or network outage. 

The law will be enforced by the Division of Consumer Protection of the Office of the Attorney General, who must give notice of an alleged violation prior to initiating an enforcement action and allow 45 days to cure the violation. The law includes a specific disclaimer providing that nothing should be construed to authorize a private right of action under this law or any other law. 

Connecticut

Connecticut passed an omnibus privacy bill (SB 4) earlier this year that included data-driven pricing regulations. These provisions take effect on February 1, 2027.

Connecticut’s law is notably broader in scope than Maryland’s, as it applies to retail beyond food. Connecticut’s pricing law has two key provisions: it bans surveillance pricing by a retail seller or third-party delivery service, subject to exceptions; and it subjects any other person engaged in surveillance pricing to mandatory disclosures. 

• The law defines “surveillance pricing” as establishing a customized price for a consumer good or service that is specific to a consumer (or group of consumers) based in whole or in part on the consumer’s personal data collected (A) through any technology or technological method, system, or tool [examples given include biometric monitoring, camera, device tracking, or sensor] and (B) by the person establishing the customized price, directly or indirectly. The prohibition on surveillance pricing is narrowly targeted to retail sellers and third-party delivery services.
• A “retail seller” is defined as a retailer engaged in making sales, at retail, of “tangible personal property,” which includes “digital goods.” This includes retail food establishments.
• A “third-party delivery service” is defined as an entity, outside of the operation of a retail food establishment’s business, that facilitates delivery or online ordering services to customers of a retail food establishment. 

The following activities do not constitute “surveillance pricing,” provided that the retail seller or third-party delivery service prominently posts the discount, discounted price, and terms and conditions in language readily understandable by the average consumer:

• Establishing a discounted price for purposes such as retaining a customer, reestablishing a customer, attracting a new customer, cross-selling an item, or reengaging a lapsed customer; 
• Establishing different prices due to justifiable differences in costs incurred in providing the good or service (e.g., due to physical location or delivery distance) or justifiable temporal differences; 
• Establishing a discounted price based on publicly disclosed uniform terms and conditions available to any consumer, available to all consumers in a broadly defined group (e.g., veterans) based on publicly disclosed discounts and uniform terms and conditions, or through a loyalty, membership, or rewards program that a consumer affirmatively enrolls in; and 
• Correcting an erroneous price.

The law also imposes a separate disclosure requirement that applies more broadly to “any person” doing business in Connecticut who (1) engages in surveillance pricing for any reason other than to establish a discounted price for a consumer good or service as part of an online transaction, and (2) advertises or promotes online the price, labels a consumer good with the price, or publishes a statement, image, or announcement disclosing the price. Similar to what’s required under New York’s Algorithmic Pricing Disclosure Act, any such person must provide a “readily visible” disclosure: “THIS PRICE WAS INCREASED USING YOUR PERSONAL DATA.” The person must also inform consumers of their rights under Connecticut’s comprehensive privacy law. The disclosure is not required if the price is the “bona fide market price.” 

Violations constitute unfair or deceptive trade practices and are enforced exclusively by the Attorney General. The law does not create a private right of action.

New Jersey 

New Jersey Governor Mikie Sherrill (D) signed the “Fair Price Protection Act” (FPPA) (A4085/4523) on July 23, making New Jersey the sixth state to pass legislation regulating data-driven pricing, and the third this year. The law generally prohibits the use of “surveillance pricing” in food retail and takes effect on August 1, 2027, with certain provisions taking effect earlier.

The FPPA defines “surveillance pricing” as “an action, including a pricing strategy in which the price of groceries and other foodstuffs is, in whole or in part, determined, adjusted, optimized, or recommended by an algorithm or automated system, based, in whole or in part, on using personal data, including data derived, or inferred from other data, and that results in price variation for individual consumers or groups of consumers.” The law prohibits any “person” (as defined in state’s Consumer Fraud Act) from engaging in surveillance pricing when determining or varying the sale price of “groceries and other foodstuffs,” which includes not only food but also items such as paper products, household cleaning items, health and beauty products, and pet foods and supplies. Maryland’s law, in contrast, applies more narrowly to food exempt from sales tax. As a result, New Jersey’s FPPA likely applies more broadly than Maryland’s PPPA, to more entities, more types of products, and more pricing practices. 

The FPPA prohibits surveillance pricing from being used to “determine or var[y] the sale price” of groceries or other foodstuffs. This language is broader than Maryland’s prohibition on using personal data or dynamic pricing to set higher prices, as New Jersey’s prohibition is not limited to price increases.

The FPPA also contains a narrower list of exceptions than Maryland’s law, including:

• Price differences resulting from reasonable costs associated with providing groceries and other foodstuffs, as long as the price is not changed more than once in a 24-hour period;
• Bona fide discounts for which eligibility conditions are public, conspicuous, and uniformly offered based on criteria, and to which members of a broadly defined group are eligible; and
• Bona fide discounts offered as part of a loyalty program provided that consumers voluntarily opt in, members receive benefits pursuant to uniform terms, and the program clearly discloses its benefits, discounts, and data practices.

Any person using personal data to offer different prices on groceries or other foodstuffs pursuant to the exceptions above are prohibited from using this personal data for any other purpose without the consumer’s consent.

In addition to the prohibition on surveillance pricing, the FPPA also places a one year moratorium, beginning February 1, 2027, on the new use of electronic shelf labels in food retail stores. Before and during the moratorium, the Treasury Department’s New Jersey Innovation Authority, in consultation with the Division of Consumer Affairs, is directed to conduct a study on the use of electronic shelf labels, including legislative or regulatory recommendations, which is directed to begin immediately.

The law provides the Division of Consumer Affairs with the authority to adopt rules or regulations to effectuate any provisions, including taking any “anticipatory administrative action” as necessary to carry out their duties. For violations of the law, the state Attorney General may bring civil action on behalf of residents to enjoin violative practices, enforce compliance with the law, obtain actual monetary damages for each negligent or greater violation, or obtain any other restitution or relief deemed appropriate for each violation. Additionally, because violations of the FPPA are considered “unlawful practices” under New Jersey’s Consumer Fraud Act, the law is subject to a private right of action (“PRA”) that includes treble damages. This is the first data-driven pricing law to contain a PRA, and it is unclear how a customer’s “loss” resulting from surveillance pricing would be calculated for the purposes of assessing damages.

Conclusion

The three laws enacted this year suggest that, while regulating data-driven pricing practices remains a priority for lawmakers, they have not settled on a consistent framework. Maryland, Connecticut, and New Jersey each prohibit some form of data-driven pricing, but they have not coalesced around common scope or definitions. These laws differ in the businesses they cover, the specific practices they proscribe, and their enforcement mechanisms. For example, Maryland and New Jersey primarily regulate pricing in food retail, while Connecticut’s prohibition extends across retail more broadly. Maryland targets the use of personal data or dynamic pricing to charge higher prices, whereas Connecticut’s and New Jersey’s laws apply regardless of whether the resulting price is higher or lower. 

Lawmakers will continue to debate the most effective approach to data-driven pricing through the remainder of 2026, as several bills remain pending in still-active state legislatures. For example, California’s AB 2564, which has passed the Assembly, would prohibit retailers (broadly defined) from engaging in surveillance pricing, while preserving several common pricing exceptions. Meanwhile, Michigan’s HB 6098 and HB 6099 have passed the House, and Pennsylvania lawmakers are still considering several competing approaches (HB 1779, HB 2384, and SB 1205).

The recent Senate hearing, which comes after multiple congressional investigations into companies’ surveillance pricing practices, further elevated data-driven pricing as an issue of concern for federal lawmakers, and testimony emphasized how difficult these practices can be for consumers and regulators to identify. As lawmakers look toward 2027, the growing attention to this issue may keep data-driven pricing high on legislative agendas, even as states continue to take different approaches to defining and regulating the practice.

* * * 

Looking for a more in-depth look at the technologies and business practices that comprise data-driven pricing and potential best practices? Check out Jameson Spivack’s report, The Price is Right: Responsible Uses of Personal Data in Pricing.

If you are interested in an informational briefing on data-driven pricing laws and legislation, please reach out to us at [email protected].