On 19 August the Federal Trade Commission voted 2-0 to publish a proposed enforcement policy statement on personalized pricing. Once it lands in the Federal Register the public gets 30 days to comment. The plain reading, and the one every trade headline took, is that businesses will have to disclose when a price has been set from personal data.

Read as a retail story that is mildly interesting. Read as a marketing story it is something else, because the operative sentence is not about pricing engines at all.

The statement says a business may violate Section 5 if it collects, uses or discloses personal data for the purpose of personalized pricing without adequate disclosure or consent. Purpose is doing the work in that sentence. Consent gathered so you could target an ad is consent for a different purpose than setting a price, and almost nobody has been keeping those two records apart.

What the Commission actually proposed

The vote was 2-0 on 19 August 2026, authorizing a Federal Register notice with a 30 day comment window. The statement defines personalized pricing as the use of personal data to set a price according to what a company believes an individual consumer is willing to spend, and says that doing it without a clear and conspicuous disclosure is likely an unfair or deceptive act or practice under Section 5 of the FTC Act.

Three things have to be disclosed: that the price is personalized, the basis for the personalization, and the types of data it relies on. Not one of the three. All three.

Chairman Andrew Ferguson framed it in a sentence that will get quoted for the next two years: "When consumers see a listed price, they expect it to be same price that everyone else sees, not the retailer's estimate of how much they are willing to pay based on their personal data."

The statement carries seven illustrative scenarios, and the industries in them are worth reading as a map of where the Commission expects to look first: delivery services, grocers, hotels and rideshare. Nobody in that list is an outlier. They are all ordinary businesses running ordinary personalization.

The consent you already have is for the wrong purpose

Here is the part that costs money. The consent language in the proposal is purpose-specific. It is not enough that a consumer accepted a cookie banner, agreed to a privacy policy, or opted into marketing. The question is whether they agreed to that data being used to set the price they are shown.

For thirty years the audience pipeline has been built for one job. Collect behavior, resolve it to an identity, enrich it, target against it, measure it. Purpose limitation was a compliance idea that mostly lived in the privacy policy and almost never lived in the plumbing. The identity resolution layer does not know why it was asked. The clean room does not know what the answer will be used for. That was fine while every answer ended in an ad.

It no longer all ends in an ad. Personalization engines, offer engines and dynamic merchandising all read from the same graph, and some of what they emit is a number with a currency symbol in front of it. The moment that happens, a data flow assembled under advertising consent has been used for pricing, and the proposed statement treats that as a Section 5 problem rather than a documentation problem.

Which means the exposure runs through your vendors. Data brokers, measurement firms, identity providers and advertising platforms are all in a chain that can now terminate in a price. None of those contracts were written with that ending in mind.

This did not start on Tuesday

The FTC has been building toward this since 2024. In July of that year it ordered eight intermediary firms to hand over information on their surveillance pricing products, and on 17 January 2025 staff published preliminary findings from that 6(b) study. The initial analysis drew on documents from Mastercard, Accenture, PROS, Bloomreach, Revionics and McKinsey and Company.

The findings are worth stating plainly, because they are more granular than most people assume. Precise location and browser history were being used to show different people different prices for the same thing. So were behaviors as small as mouse movements on a page, and the specific products a shopper left sitting in an abandoned cart.

Notice who the FTC ordered. Not the retailers. The intermediaries. The capability was not something a handful of large sellers built for themselves, it was a product being sold into the middle of the market as a service, which is why the Commission is now writing a rule of general application rather than filing four complaints.

The definition is the entire fight

Delta is the clearest available demonstration of why a disclosure standard needed to exist, and we would encourage reading the whole exchange rather than the headlines about it.

On the second-quarter earnings call, Delta President Glen Hauenstein described the airline's work with the AI pricing firm Fetcherr in terms of processing millions of data points to set the right price. In late July 2025 Senators Ruben Gallego, Richard Blumenthal and Mark Warner wrote to CEO Ed Bastian objecting to "prices that are tailored to an individual consumer's willingness to pay," and warning that fares would be pushed toward each customer's personal pain point.

Delta's answer was categorical: there is no fare product it has used, is testing, or plans to use that targets customers with individualized prices based on personal data, and the Fetcherr work is a recommendation tool that helps analysts price faster.

Both statements can be defended at once, and that is the point. It depends entirely on where you draw the line around "individualized" and around "personal data." A model trained on aggregate demand that outputs a fare for a route at a moment is not the same thing as a model that reads a passenger and quotes them personally, but the distance between those two is a configuration choice, not a wall. The proposed statement is an attempt to move that from a matter of interpretation to a matter of disclosure.

The states already went further

A federal disclosure standard and a state prohibition are different animals, and the state map is currently the more aggressive of the two.

Connecticut has moved to prohibit surveillance pricing by retail sellers and food delivery services, with carve-outs for ordinary discounts. Maryland's Protection From Predatory Pricing Act restricts personalized pricing in food retail above 15,000 square feet and in delivery, and exempts financial institutions. New Jersey's Fair Price Protection Act bars personalized algorithmic pricing for grocery and food stores and for delivery platforms. Eleven more states introduced surveillance pricing bills during 2026.

Read the difference carefully. Disclosure lets you keep doing the thing as long as you say you are doing it. Prohibition does not. A national brand that solves for the FTC statement alone has solved the easier of its two problems.

Congress is circling the same ground. The Senate Judiciary Committee held a hearing on 4 August 2026 titled "Your Data, Their Profit: The Consumer Cost of AI Surveillance Pricing." Senators Josh Hawley and Richard Blumenthal both signaled intent to legislate, and Blumenthal said there is a legislative framework under discussion. Nothing has passed. Something is being drafted.

What this looks like inside an ordinary marketing department

Most of the exposure we would expect to find is not in a pricing system. It is in things marketing built and never classified as pricing.

A payment calculator that renders a different monthly figure depending on what the site already knows about the visitor. Offer tiers that key off a lead score. A returning visitor who sees an incentive that a first-time visitor does not. A retargeting creative carrying a better number than the one on the page. Personalized merchandising that surfaces the cheaper trim to some sessions and the loaded one to others, which changes the price the shopper sees even when no price was calculated for them.

None of that was built as a pricing practice. It was built as conversion work, signed off by marketing, measured on lift, and never once written down as a decision about what a specific person should be charged. That is precisely why it is a risk. An obligation you have not named is an obligation you cannot evidence.

The playbook

Six moves, in the order we would run them.

1. Inventory where price varies by person, not where you meant it to. Walk the live site as three different identities and record every number that differs. Do this before anyone drafts a policy, because the policy has to describe what is actually happening.

2. Split the two consent records. Advertising targeting and price setting are separate purposes in this statement. If your consent management platform stores one flag for both, you cannot evidence either.

3. Ask every vendor, in writing, whether their output can reach a price. The CDP, the DMP, the clean room, the personalization engine, the bidding stack, the measurement partner. You want the answer on paper before a regulator asks you for it, and you want it from them rather than from your own assumption.

4. Write the disclosure now, while it is cheap. Three elements: that the price is personalized, the basis, the data types. Drafting it will tell you very quickly which of your practices you are not willing to describe out loud, and that is useful information on its own.

5. Track the states separately from the FTC. One is a disclosure obligation and the others are prohibitions with square footage thresholds and industry carve-outs. A single national posture will be wrong somewhere.

6. Put the earnings-call language and the compliance language in the same room. The Delta lesson is not about airline pricing. It is that the sentence your executives use to describe a capability to investors is discoverable, quotable, and will be read next to the sentence your counsel wrote for a regulator.

Our position

We do not think personalization is the problem, and we would not tell a client to rip it out on the strength of a proposed statement that has not finished its comment period. Showing a returning customer a better offer is older than the internet.

What has changed is that the machinery got good enough to do it individually, quietly, and at a scale where nobody in the building can describe the rule being applied. The FTC is not asking anyone to stop. It is asking them to be able to say what they are doing and to show that the person agreed to it. Those are both reasonable things to be able to do, and the number of organizations that can do either one today is small.

If you cannot currently produce a list of every place your price moves because of who is looking, that is the work. It is not a legal project. It is an inventory, and it belongs to whoever owns the stack.

Sources

Every claim above is carried from the material below and credited in the body. Where something reaches us second-hand we have said so, and we have not represented a summary as a reading of the underlying document.

Related Reading