Maryland’s surveillance-pricing law has been in force for three weeks now. No enforcement actions, no headlines, no cease-and-desist letters we’ve seen. If you run pricing at a covered retailer, that silence can feel like permission. It isn’t — it’s the setup.
Most retailers are misreading two timelines at once this month: treating “live” as the finish line, and “2027” as far away. Both readings are dangerous.
🔴 “Quiet” is not “safe” — Maryland
Maryland’s law (effective Oct 1) is enforced by the Attorney General, with a 45-day window to cure a violation after notice. Read that structure carefully: the AG doesn’t have to announce a sweep. The first sign you’re on the radar is a notice — and then a 45-day clock starts, during which you’re scrambling to fix something you should have documented months ago.
The retailers handling this well aren’t waiting to see who gets hit first. They’ve already written down why their loyalty program qualifies for the exemption, mapped which data inputs touch their pricing engine, and confirmed no individualized price is set from personal data. The quiet period is when that paperwork gets done — not after a notice arrives.
🗓️ The real deadline is 2027 — New Jersey & Connecticut
Both states have enacted their laws; neither is in force yet.
New Jersey — effective Aug 1, 2027. The reason to move it up your list: it’s the first state to give consumers a private right to sue. That changes the math. Maryland risk is an AG with limited bandwidth; New Jersey risk is every shopper with a lawyer.
Connecticut — effective Jul 1, 2027. Broader than Maryland — it reaches all retailers of tangible goods, not just large food sellers — and writes loyalty and group discounts explicitly into the exemption.
Fourteen months sounds comfortable. It isn’t, if your pricing architecture has to change — vendor contracts, data flows, and disclosure language don’t turn on a dime. The window is the work.
🟡 The wildcard that could compress everything — New York
New York’s One Fair Price Act passed both chambers in June and is still on Governor Hochul’s desk; she has until year-end to act. Two things make it the one to watch:
It would ban personalized, data-based pricing outright — and carries the broadest definition of “personal data” of any of these laws, which makes it the strictest.
If signed, a 180-day clock starts. A single signature could pull a major market’s deadline forward fast.
Don’t build your 2027 plan assuming New York stays quiet.
📋 The Statelex Watchlist
Maryland — 🟢 LIVE (Oct 1, 2026). AG-only; 45-day cure; loyalty exempt, conditionally.
New Jersey — 🔴 Enacted; effective Aug 1, 2027. First consumer right to sue.
Connecticut — 🔴 Enacted; effective Jul 1, 2027. Broadest scope; loyalty + group discounts protected.
New York — 🟡 Passed; awaiting the Governor’s signature. Strictest data definition.
California — 🟡 AB 2564 advancing; AG actively investigating retail pricing.
The takeaway this week
The danger isn’t the law you can see coming — it’s the two timelines everyone’s misreading. Maryland is live, and quiet is not safe. New Jersey and Connecticut are 14 months out — exactly enough time to fix things, or exactly enough to run out of it. Do the documentation now; it’s the cheapest it will ever be.
Statelex is an information service, not legal advice. This dispatch summarizes public legislative and regulatory text; it does not evaluate whether your specific pricing practices comply with any law. Confirm any action with your legal or compliance team.