Surveillance Pricing Just Became the FTC's Fine-Print Problem

The vote that is not a ban#

The fox does not need to see the trap to smell where it has been set. On 19 August 2026 the Federal Trade Commission voted 2-0 to seek public comment on an enforcement policy statement aimed at a practice most shoppers have felt long before they had a name for it: surveillance pricing, the trick of pricing one customer differently from the next using the personal data that customer never agreed to hand over for that purpose.

The commission's own announcement is refreshingly plain about what it found and what it plans to do about it. Once the draft statement is published in the Federal Register, the public gets thirty days to comment, and the underlying document itself, the Proposed Enforcement Policy Statement, sets out exactly which disclosures the FTC now expects a business running surveillance pricing to make.

The surveillance pricing FTC timeline, so far#

Ferguson's own statement goes further, and it rewards a careful read. The commission has been candid that it lacks the legal authority to ban personalised pricing outright, in every circumstance, but it has put every business on notice that failing to disclose how personal data sets a price can itself breach the FTC Act and the other consumer-protection laws the agency enforces. The release even names a workaround: shoppers who suspect a personalised price can try a private browsing window or a virtual private network, a small self-defence for a problem that should not require self-defence at all.

Read the fine print here and a pattern for fintech emerges fast. Section 5 of the FTC Act bars unfair or deceptive practices, and the Future of Privacy Forum's legal-landscape review is blunt that this existing UDAP authority, not a brand-new pricing statute, is the lever the commission is actually pulling. That distinction matters more to a bank or a lender than to a grocer: a hidden delivery fee is embarrassing, but a hidden, data-driven credit price can trip fair-lending law that has quietly sat on the books for decades.

Why fintech reads the fine print first#

folkfox works with lenders, neobanks and payments brands, and the brief for a fintech marketing agency has just changed shape. The FTC's Issue Spotlight on surveillance pricing, published by staff in January 2025 as a synthesis of public research rather than the commission's own non-public study, names credit history as one of the data types that sellers already fold into a personalised price. That is not a grocery-store problem borrowed for a scary headline, it is a description of risk-based pricing wearing a different coat.

BNPL, subscriptions and a price nobody can compare#

Buy-now-pay-later checkouts, tiered subscription pricing and dynamic loan offers all share the same structural feature the FTC is now circling: the price a shopper sees is a function of what the platform already knows about them, not a fixed number on a shelf. folkfox covered how buy-now-pay-later became credit and then quietly grew a membership tier, and a membership tier priced by behaviour is precisely the kind of personalised offer this policy statement is built to catch.

Algorithmic underwriting sharpens the exposure further. A credit offer that varies by a browsing trail or a device fingerprint is a pricing decision and an underwriting decision at once, and folkfox has already tracked how a retreating disparate-impact theory reshaped fintech's targeting risk earlier this year. Surveillance pricing is the companion story: even where the FTC cannot reach the underwriting model itself, it can reach the silence around it.

None of this is theoretical for the pricing page itself. If a credit card's advertised APR, a loan quote or a subscription tier varies by customer, the honest move is a plain sentence stating so, at the point the price appears, not buried three clicks deep in a privacy policy nobody reads. That single sentence is a content and copy problem before it is ever a legal one, and it is exactly the kind of quiet detail a fintech marketing agency now has to own.

The states are not waiting for Washington#

Washington is not the only den worth watching. State lawmakers introduced more than forty bills across at least twenty-four states on personalised and algorithmic pricing in 2026, already outpacing everything filed in 2025, per Covington's tracking of the wave. Three states have already moved past bills into law.

New York's disclosure statute requires a plain notice when an algorithm sets a price from personal data. Connecticut's SB 4, signed 27 May 2026 and effective from 1 October 2026, bans the practice outright for retailers and delivery services. Maryland's Protection From Predatory Pricing Act, signed 28 April 2026 and also effective 1 October 2026, treats a violation as a deceptive trade practice, and its financial-services carve-out is, in the words of Ballard Spahr's Consumer Finance Monitor, a warning shot at APRs, loan pricing and fee waivers dressed up as risk-based pricing.

California is prowling too, from two directions at once. Attorney General Rob Bonta has already opened an investigation into personal-data-based pricing, sending inquiry letters to grocers, hotels and large online retailers, according to Freshfields' enforcement briefing. Separately, the state's proposed AB 2564 would ban surveillance pricing outright, with civil penalties running to real money.

New York has not stopped at disclosure either. Attorney General Letitia James has issued a consumer alert on the practice and opened her own investigation into one company's surveillance pricing disclosures, and Albany's own “One Fair Price” package would go further still, banning personalised algorithmic pricing and electronic shelf labels together, per Faegre Drinker's litigation outlook and reporting from the state attorneys general beat. For a business used to a single federal rulebook, that is a thicket of separate state trails to track, each with its own deadline and its own definition of what counts as personal data.

This is not a purely American reflex. folkfox has already tracked how the FCA read the minutes on high-growth marketing and found the promotion had outrun the meeting; regulators on both sides of the Atlantic are converging on the same complaint, that financial marketing is moving faster than the disclosure meant to keep pace with it.

Disclosure is not decoration, it is a defence#

A disclosure regime and a ban are not the same animal, and Ferguson's statement is explicit that the FTC only has the stomach, and the legal authority, for the first. That distinction is the whole story for a compliance team deciding how hard to push back. A ban would mean ripping out a pricing engine. A disclosure requirement means writing one honest sentence and keeping it true, which is a smaller job and a far cheaper one, provided it starts now rather than after a Federal Register notice makes it urgent.

The second version is duller to write and far safer to publish, because it survives exactly the kind of scrutiny a state attorney general's inquiry letter brings. Not every reader agrees the FTC has gone far enough, and the reaction landed within hours of the vote.

Whatever the final policy statement says, a disclosure-first regime already has a head start in more of the country than most marketing teams assume.

Fintech brands that already comply with those state privacy statutes are closer to compliant than they think. The gap is rarely the underlying data practice, it is the sentence that admits to it, and folkfox has watched the same gap open on the lending side in open banking's free front door growing a price tag and on the charter side in a digital bank's marketing plan meeting its own regulator.

What to change on the pricing page this quarter#

There is a quarter's worth of unglamorous work here, and it starts on the pricing page, not in the legal department's inbox. A compliance memo nobody reads changes nothing; a sentence a customer actually sees changes everything, and it is cheaper to write now than to retrofit under a Federal Register deadline.

Treat each row as a small, ownable task rather than one large audit. A pricing surface with a named owner gets fixed inside a sprint; a pricing surface that belongs to everyone gets fixed after an inquiry letter arrives, which is the expensive order to do things in. folkfox has traced the same lesson in a fintech AML fine that started as a single overlooked control, and a pricing disclosure gap fails the same way: quietly, then all at once.

This is also, bluntly, a brand-strategy question and not only a legal one. A pricing page that says plainly how it sets its price reads as confident rather than cautious, and that tone is worth more to a challenger brand than the marginal revenue a hidden variation protects. It is the kind of positioning work folkfox's brand strategy practice does for regulated clients, and it is worth briefing the paid media team too, since a headline price quoted in an ad now has to match the price the algorithm actually shows once the click lands.

The fox that survives the season is not the boldest one in the hedgerow, it is the one that reads the wind early and moves before the thicket closes. The FTC has given fintech thirty days after the Federal Register notice to comment, and considerably longer than that to get the pricing page right. Both windows are open now.

Frequently asked questions#