States restrict personalized pricing and require all-in prices as new laws take effect

Key takeaways

• Regulation of pricing practices continues to expand, as new state laws regulating personalized pricing, the sharing of pricing algorithms, and requiring “all-in” pricing go into effect.
• On the personalized pricing front, recent state and local laws go beyond disclosure requirements to prohibit pricing based on a consumer’s personal data. Maryland’s grocery pricing ban took effect October 1, 2026, with bans in Connecticut, New Jersey, and Seattle following in 2027. The New Jersey and Seattle laws focus on grocery sellers while Connecticut’s prohibition applies to all retail sellers.
• The prohibitions generally preserve loyalty programs and discounts for broad groups, such as veterans or seniors, and each permits some price differences based on cost. Separately, California restricts shared pricing algorithms that use competitor data in any industry.
• As to so-called “drip” pricing, eight jurisdictions now require advertised prices to include mandatory fees across industries, and Illinois joins them on July 1, 2027. The FTC’s rule, by contrast, covers only live-event tickets and short-term lodging.
• Businesses may want to review the data they or their algorithmic pricing tools use, their vendor contracts, how prices are displayed, and the terms of their discount and loyalty programs.

As affordability and inflation have grown as consumer concerns, federal, state, and local legislators and regulators are paying greater attention to how prices are set and displayed. They are also focused on the idea that AI may allow businesses to set different prices for different consumers based on the personal information businesses hold regarding consumers. This focus is reflected in new state laws regulating personalized pricing—often called “surveillance pricing”—which generally refers to the use of personal data to set prices that vary by consumer. These laws began by requiring disclosure of algorithmic pricing practices that utilize personal data but have quickly moved to banning the practice in specified situations. Maryland’s ban on using personal data to set higher prices by larger food retailers and certain third-party food delivery services, which took effect on October 1, 2026, is the first such ban in force. At the same time, states continue to enact laws requiring the display of “all-in” pricing and prohibiting so-called “drip pricing” or “junk fees.” The District of Columbia, for example, began requiring advertised prices to include all mandatory fees in September. More such laws will take effect over the next year, and others are under consideration.

In this Legal Development, we review (1) the move beyond disclosure requirements to bans on personalized pricing, (2) the sector coverage and exemptions that shape those laws’ reach, and (3) the spread of all-in pricing laws.

Personalized pricing: The move from disclosure to bans

Disclosure: New York’s Algorithmic Pricing Disclosure Act: New York’s Algorithmic Pricing Disclosure Act, in effect since November 10, 2025, requires a business using an algorithm that draws on a consumer’s personal data to set a price to include “a clear and conspicuous disclosure” stating: “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA.” Only the attorney general may enforce the law, with civil penalties of up to $1,000 per violation (see our prior Legal Development). A federal district court dismissed a First Amendment challenge in October 2025, and an appeal is currently before the U.S. Court of Appeals for the Second Circuit.

The new bans: New laws regarding personalized pricing enacted since New York’s disclosure requirement have all included prohibitions on the practice, not just disclosure requirements. Most target groceries and delivery, though Connecticut’s is notably broader:

• Maryland (enforced since October 1, 2026): Under the Protection From Predatory Pricing Act, food retailers with stores of at least 15,000 square feet that sell tax-exempt food, and in-scope third-party delivery services for that food, may not use dynamic pricing or personal data to charge a specific consumer a higher price for the food.
• Connecticut (effective July 1, 2027): Under Public Act 26-130, retailers of goods (including retail food establishments) and in-scope third-party delivery services may not engage in so-called “surveillance pricing.” In addition, any business that uses software to set online prices based on a consumer’s personal data must display “THIS PRICE WAS INCREASED USING YOUR PERSONAL DATA” or a substantially similar disclosure unless certain exceptions related to qualifying discounts apply.
• New Jersey (effective August 1, 2027): The Fair Price Protection Act bars any pricing strategy that sets or varies the price of “groceries and other foodstuffs,” a defined list of goods running from produce to household cleaning items and pet supplies, based on personal data. Unlike Maryland’s law, it reaches pricing aimed at groups of consumers as well as individuals, and its definition of “price” covers targeted discounts, so discounts personalized using consumer data, not just shelf prices, may fall within the ban.
• Seattle (effective September 1, 2027): Ordinance 127515 covers three types of businesses: grocers with 20 or more locations worldwide, including a Seattle store that is more than 10,000 square feet; other stores with at least 10,000 square feet of grocery sales floor; and in-scope delivery services with 100 or more employees worldwide. Covered grocers may not use so-called “algorithmic-based price discrimination” to set prices or mandatory fees for a consumer or “a segment of consumers,” including through random price variations. For other covered Seattle retailers, the ban covers only groceries, diapers, grooming and hygiene products, and over-the-counter drugs.

The state and local bans share several common exceptions:

• Loyalty and membership programs: Connecticut, Maryland, New Jersey, and Seattle permit discounts offered through programs that a consumer joins. Some of these jurisdictions, however, attach conditions, such as opt-in enrollment, uniform and publicly available terms, posting of the discount and its terms on the business’s website, or limiting purchase-history-based discounts to disclosed tiers rather than individualized prices.
• Group discounts: Connecticut, New Jersey, and Seattle permit discounts offered to broadly defined groups, such as veterans, seniors, or students.
• Cost and market differences: Maryland and Connecticut permit price differences that reflect differences in cost or in supply and demand. New Jersey permits only cost-based differences, and a price may change no more than once in 24 hours. Seattle is narrower, permitting only differences in delivery costs (using location as the only personal information) and uniform in-store prices available to all shoppers at a given store.

Because these exceptions vary in scope and conditions, a pricing or discount practice permitted in one jurisdiction may still be prohibited in another.

Pending state proposal, FTC, and state attorney general activity: The fate of other proposed state bans remains uncertain. New York’s One Fair Price Act, which would replace the disclosure law with a ban, passed the Legislature in June 2026 but has not yet been delivered to Governor Kathy Hochul (see our prior Legal Development). An Illinois bill (HB 4248) has passed both chambers in different versions and could receive a final House vote in the legislature’s November and December veto session.

At the federal level, the Federal Trade Commission has sought public comment on a proposed Enforcement Policy Statement Regarding Personalized Pricing that favors disclosure. It takes the position that, where consumers expect prices not to vary with their personal data, failing to clearly and conspicuously disclose that a price is personalized, the basis for the personalization, and the types of data used is likely an unfair or deceptive practice under the FTC Act (see our prior Legal Development). The FTC acknowledges that it does not have authority to ban personalized pricing outright, but it asserts that a higher personalized price may be unfair in particular circumstances. On October 28, 2026, it announced an industry study, which is distinct from a law enforcement investigation, seeking information about how businesses in the airline, ridesharing, online food delivery, and retail sectors may make use of personal data to set individualized prices or compensation. Separately, in an Advance Notice of Proposed Rulemaking on Unfair or Deceptive Fees in Online Food Delivery Services announced in April, the FTC sought comment on personalized pricing by delivery platforms.

State attorneys general are similarly scrutinizing the use of personal data to set individualized prices. For example, in January, the California attorney general announced an investigative sweep targeting businesses in the retail, hotel, and grocery sectors, seeking information on their use of consumer data to set prices and whether such practices violate the California Consumer Privacy Act’s purpose limitation requirements.

Shared pricing algorithms: Restrictions on tools that use competitor data

A separate set of laws addresses pricing tools that draw on competitors’ data. Since January 1, 2026, California has restricted such pricing tools across all industries. The law makes it unlawful to use or distribute a “common pricing algorithm” as part of an agreement in restraint of trade or while coercing others to adopt its recommended price. A “common pricing algorithm” is “any methodology, including a computer, software, or other technology, used by two or more persons, that uses competitor data to recommend, align, stabilize, set, or otherwise influence a price or commercial term.”

The other state laws in this area, in New York, Connecticut, and New Jersey, are limited to residential rentals (see our prior Legal Development comparing the California, New York, and Connecticut laws). They differ on whether the competitor data must be nonpublic. Connecticut’s law reaches only software that uses nonpublic competitor data, so tools relying only on public data are permitted. New Jersey’s FAIR Act, effective July 1, 2027, largely draws the same line, but it also reaches shared algorithms that facilitate parallel pricing.

New York’s law draws no such line, and that has mattered in court. The law makes it unlawful for a software provider to facilitate an agreement among landlords not to compete, and it treats a landlord’s setting of rents on the software’s recommendations as itself an unlawful agreement. On September 29, 2026, the U.S. District Court for the Southern District of New York preliminarily enjoined the provision aimed at landlords. It found that provision likely invalid under the First Amendment because it applies to software using only public data, as well as software using nonpublic data. The provision aimed at software providers was not enjoined.

All-in pricing laws continue to spread

At the federal level, the FTC’s Rule on Unfair or Deceptive Fees, in effect since May 12, 2025, covers only live-event tickets and short-term lodging. The FTC is considering a similar rule for online food delivery services and, outside those sectors, it continues to pursue enforcement against allegedly hidden fees under Section 5 of the FTC Act.

States have gone further. Eight jurisdictions now have all-in pricing laws in force that apply across industries: California, Minnesota, Virginia, Massachusetts (by regulation), Colorado, Oregon (for online sellers), Connecticut, and the District of Columbia. Each requires the advertised or displayed price to include mandatory fees, subject to exceptions that vary by jurisdiction, and generally allows government taxes and fees and actual shipping costs to be shown separately. They differ at the margins. For example, Colorado requires the total price as a single number, and both Colorado and Massachusetts require it to be more prominent than any other component of the price. Massachusetts also generally requires the total price to be displayed before a consumer must provide personal information.

Two jurisdictions have recently enacted new all-in pricing laws:

• District of Columbia: The District’s law (D.C. Code 28-3904(a)(12)) took effect September 26, 2026, making it an unfair or deceptive trade practice for a merchant to advertise, display, or offer a price that does not include all mandatory fees or charges.
• Illinois: Illinois’s hidden and misleading fees law (House Bill 228) takes effect July 1, 2027. It creates no private right of action and is enforced by the attorney general and state’s attorneys under the Consumer Fraud Act, with civil penalties of up to $50,000.

Implications for businesses: What to do now

With some of these laws already in force and others taking effect over the next year, businesses should review both how their prices are calculated and how they are displayed.

• Price calculation: Understand what data your pricing and pricing tools—including those licensed from vendors—rely on, whether personal data about consumers or competitors’ data. Confirm that any discount or loyalty programs fit within the applicable exceptions and are properly documented.
• Price display: Ensure that advertised prices include all mandatory fees wherever a price is first shown, not just at checkout.

This review should not be a one-time exercise. Personalized-pricing legislation has already been prefiled in Virginia for 2027, and we expect additional states and cities to take up these issues in their next sessions. Businesses may want to revisit their pricing practices as new laws are enacted.