States Probe Firms Using Personal Data, Location to Set Prices

States are looking at how grocery stores, hotel chains, and retailers are using personal consumer information—from browsing history to location data—to dictate prices.

In a first-of-its-kind use of a state privacy law, California Attorney General Rob Bonta announced an investigative sweep on Jan. 27 into businesses’ use of consumers’ personal data to set individualized prices. He warned that the behind-the-scenes practice known as surveillance pricing may run afoul of the California Consumer Privacy Act.

California is just the tip of the trend. New York in November started requiring companies to clearly disclose when their algorithms use consumers’ personal information to set prices. Legislative proposals are popping up across the country to ban or restrict companies’ use of sensitive personal information, like biometric data, for personalized prices. And amid the pressure, companies in targeted industries are reviewing how they’ve been using personal data in pricing strategies—like loyalty or discount programs aimed at certain customers—and whether it exposes them to regulatory risk.

“That is just another indication that this issue of dynamic pricing, personalized pricing, surveillance pricing—whatever term you want to use—is for regulators going to be the issue du jour,” said Janis Kestenbaum, partner at Perkins Coie LLP. “It looks like it’s going to be a very big issue in 2026. And probably the California announcement is going to add fuel to that.”

The role that the Federal Trade Commission will play is unclear after the agency pulled back on a Biden-era surveillance pricing probe. In 2024, the FTC sought information from eight companies, including MasterCard Inc. and McKinsey & Co. Inc., that had offered surveillance pricing products to businesses. The study found a wide range of personal data could be “frequently used” to set individualized consumer prices, including their behaviors, demographics, and browsing patterns.

Lina Khan, then-chair of the FTC, had called on the agency to keep investigating, but public comment on the market practice was shut down when Trump’s pick for FTC chairman, Andrew Ferguson, took office.

Bonta called out the FTC’s withdrawal as “another example of the Trump Administration’s abandonment of critical consumer protection work.”

The FTC couldn’t be reached for comment Monday due to the government shutdown.

The Privacy Angle

Regulators have investigated companies’ pricing practices in recent years on anti-discrimination or antitrust grounds.

California’s use of its comprehensive privacy law in its investigative sweep, however, is a novel approach, Kestenbaum said.

“What caught people’s attention was that they were really thinking about it so much as a privacy issue, as a comprehensive consumer privacy law issue, because I don’t think that that was the way that probably most attorneys had been necessarily thinking about the issue,” she said. Bonta’s investigation shows that “states like California are looking for theories that they can use under their state laws.”

California’s attorney general said he sent letters to companies in the retail, grocery, and hotel sectors seeking more information about how they use consumers’ shopping and internet browsing history, location, demographics, and other data to set prices for goods or services.

Bonta is also asking businesses about their policies and disclosures regarding personalized pricing, pricing experiments they’re undertaking, and measures they’re taking to comply with algorithmic pricing, competition, and civil rights laws.

“Consumers have the right to understand how their personal information is being used, including whether companies are using their data to set the prices that Californians pay, whether that be for groceries, travel, or household goods,” Bonta said in a press release about the investigation. “We need to know whether businesses are charging people different prices for the same good or service—and if they’re complying with the law.”

California’s privacy law includes a “purpose limitation principle,” which limits businesses’ use of personal information to purposes that a consumer could reasonably expect. The question for businesses operating in the state will be whether a consumer could reasonably expect that their personal data could be used to set prices, Kestenbaum said.

Pushing Back

While some companies are taking steps to fend off regulatory concerns, several industry groups are pushing back.

The National Retail Federation, a leading retail trade association, sued New York Attorney General Letitia James over the state’s algorithmic pricing disclosure law in July 2025, claiming it violated the First Amendment. It appealed the case to the US Court of Appeals for the Second Circuit last fall after failing to convince a New York federal court judge.

“The impact of a law like the New York law is that even if we’re just doing something that our consumers, frankly, know we’re doing, they want us to do, they’re signed up for loyalty programs. We’re complying with applicable privacy laws. We still have to put that disclosure on there saying your personal data has been used to set this price based on an algorithm,” said Stephanie Martz, chief administrative officer and general counsel at the National Retail Federation.

Whether other states follow New York’s lead or leverage existing laws like comprehensive privacy and consumer protection statutes will shape how companies approach compliance.

“Companies are looking closely at their pricing practices. The New York disclosure law and the announcement of this investigation are a big indication that resources are being directed at this practice,” said Ian Barlow, of counsel at Wiley Rein LLP and former FTC official. “It’s now gaining a level of scrutiny where it’s worth investing additional compliance resources.”