Most companies think "surveillance pricing law" is one problem. It's actually two — and you can be perfectly clean on one while badly exposed on the other. Here's the distinction that decides which risk is yours.
⚖️ Two different laws hiding under one name
The new state laws are converging from two very different directions:
→ "Are you copying competitors?" California and Connecticut restrict pricing tools that use competitors' data to set prices. The worry is quiet coordination — think of landlords all feeding data into the same rent algorithm and landing on the same number. This is an antitrust concern.
→ "Are you profiling customers?" Maryland, New Jersey, New York, and Connecticut restrict using a customer's own data — browsing history, location, inferred income — to set a price aimed at that one person. This is a consumer-protection concern.
Most coverage lumps these together as "surveillance pricing," but they have different triggers, different states, and different penalties. A company can be clean on the competitor-data question and exposed on the customer-data one — or the reverse. Step one is knowing which bucket your pricing falls into.
🏛️ The federal layer is filling in
The FTC opened a formal rulemaking process (an Advance Notice of Proposed Rulemaking) in April 2026 on personalized-pricing disclosure — the first move toward a federal rule, not just a state patchwork.
It also settled with a ticket exchange over hidden mandatory fees — a sign that how you show a price is now enforced alongside how you set it.
And the Robinson-Patman Act, a long-dormant price-discrimination law, has resurfaced with active cases.
🔒 The next frontier: whose data, and whose protection
A newer wave of bills pushes past pricing mechanics into civil-rights territory — barring the use of protected-class data (race, or ZIP code as a proxy) in pricing, and forbidding any personalized pricing aimed at minors. Where these pass, "we only used standard data" won't be a defense if that data correlates with a protected class.
📋 Where things stand (enacted)
Maryland — effective Oct 1, 2026. Food retailers & delivery platforms.
New Jersey — effective Aug 1, 2027. Groceries; the first state with a consumer private right of action; penalties up to $50K per violation; also freezes new electronic shelf labels for one year.
Connecticut — effective July 1, 2027. Covers both the competitor-data and the customer-data concerns.
California — restricts competitor-data pricing tools; a broader consumer-data ban (AB 2564) is still moving.
New York — disclosure law in effect since 2025; the fuller One Fair Price Act has passed the legislature but is not yet law.
The takeaway this week
Before asking "am I compliant," ask "which kind of pricing am I actually doing — competitor-driven or customer-driven?" The answer points to a different set of states, laws, and penalties. Most teams are managing one risk while missing the other.
Statelex is an information service, not legal advice. This dispatch summarizes public legislative and regulatory text; it does not evaluate whether your specific pricing practices comply with any law. Confirm any action with your legal or compliance team.