All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
The Federal Trade Commission (FTC) has proposed cracking down on personalized pricing, a practice in which businesses use your personal data to determine how much you might be willing to pay for a product or service.[1] This could involve sensitive information such as your income, location, interests, credit history, shopping habits, and even medical conditions.
This surveillance pricing puts consumers at risk of paying more than they otherwise would, but the bigger long-term concern is what happens to all that personal data and how it could be used against you.
The FTC cannot outright ban personalized pricing, but it can take action against companies that use it deceptively. Under its proposed policy, businesses would need to clearly disclose when a price is personalized, what the personalization is based on, and what types of data were used to determine the price.
In other words, the move could give consumers more visibility into how their personal data is being used to set prices, and potentially give them a chance to dispute incorrect data or avoid its collection.
Here's what the FTC says would cross the line, why its own proposal names VPNs and private browsing as consumer defenses, and why some critics warn the policy could kill the discounts you rely on.
Under the FTC's new proposed enforcement policy, released August 19, 2026, businesses that engage in personalized pricing should disclose not only that the price is personalized, but also the basis for the personalization and the data the company relied on to determine that personalized price.
That obligation applies specifically in markets where consumers reasonably expect prices won't vary based on their personal data, like the price on a store shelf or the price on a product listing anyone else would see. Any failure to make these disclosures could violate Section 5 of the FTC Act and constitute an unfair or deceptive trade practice.
The Commission approved the proposal on a 2-0 vote, and the public gets 30 days to weigh in once the statement is published in the Federal Register. The public can submit comments through the FTC's public docket.
The policy statement builds on a warning FTC Chair Andrew Ferguson issued in a 2024 concurring statement, written when he was still a minority commissioner. Modern data collection, he wrote, can reveal some of consumers' most intimate details:
The new policy statement makes the same point about how little consumers know: “Many Americans do not understand just how much data they generate every second of their lives. Nor do they necessarily understand how those data are collected and stored, to whom they may be sold, or how they may be used.”
The same FTC policy statement acknowledges that several industries, such as insurance and credit, have pricing that naturally varies from customer to customer based on the nature of the product.
Other industries also have prices that may vary based on supply and demand. For instance, ride-share prices could differ from one neighborhood to another based on market conditions and demand. The FTC acknowledges that such variations can be legitimate and within its provisions.
However, the FTC also notes that some industries expect consumers to be offered the same price, regardless of personal preferences or circumstances. The agency listed seven scenarios that could cross the line.
A food delivery app charging more because it knows you might not be able to leave home. A grocery chain charging more for milk because data shows several children in your household. A hotel charging more after learning you're traveling for a funeral. A ride-share charging more to reach a medical facility, or charging more simply because your phone shows no competing apps installed, and therefore no easy way to price-shop.
A retailer could also cross the line by charging more for a home security camera after court filings show you were recently the victim of a crime, or by raising a price on its website because your location data puts you inside its store.
Of the dozens of people who submitted comments to the docket, most welcomed stronger action, calling the practice “abhorrent” and “atrocious,” Ars Technica reported. Commenters said low-income households would be hit hardest, and argued that race, religion, gender, and sexual preferences should never factor into what someone pays.
But some supporters of tougher rules worry this particular proposal could backfire. Commenter Jessie Shettleroe pointed out that the FTC never actually defines personalized pricing. “The operative phrase is prices that ‘vary based on their personal data.’ That covers my grocery loyalty card, emailed coupons, and app-only prices. Those save me money,” Shettleroe told the FTC. If businesses can’t tell which practices are covered, he argued, “the first thing to disappear will be the discounts, not the surcharges.”
A full ban would take an act of Congress. A bill introduced in July 2025, the Stop AI Price Gouging and Wage Fixing Act, would do that by prohibiting companies from using automated systems to set individualized prices and wages. It has not advanced out of committee.
Companies rely on several sources to get their hands on personally identifiable information about you.
First and foremost, companies use their own apps, websites, and analytics to understand a user’s behavior. Retailers could track what you click, how long you hover over a product, and which items you abandon in your cart to gauge your preferences. They could also determine price sensitivity by looking at your sorting and filtering patterns.
Next, there are cookies and tracking pixels. Every website you visit may include cookies and tracking pixels embedded by third-party ad networks. Even a single site visit could quietly set cookies from dozens of different companies at once.
Similarly, mobile apps may include software development kits (SDKs) that send data to the companies that provide them. Data brokers can then pull it together, enrich it, and resell it to other third parties and advertisers. This stitches together a profile of you that spans far more than any one company could gather alone.
Another source of personal data is your geolocation from phones and apps. This could potentially pinpoint your location, including whether you are inside a store or in a parking lot while browsing a website or using an app. Location could also be inferred from your IP address.
Loyalty and rewards programs are another major source of sensitive data. Many retailers require demographic information, such as age, income bracket, and address, to sign up.
This data could then be correlated with your browsing behavior and information from third-party sources to build a more complete personal profile, enough to determine not only what you’re willing to buy, but also how much you’re willing to pay.
The bigger concern is that the more personal information companies collect and combine about you, the more damaging it could be if that data falls into the wrong hands.
Cybercriminals could use details such as your email address, phone number, location, shopping habits, or other personal information to launch highly personalized phishing and social engineering attacks. Those attacks can lead to identity theft and financial fraud.
While it’s virtually impossible to outright eliminate the collection of your personal information, there are a few steps you can take to limit the amount of data companies might collect.
The first two are the FTC's own suggestions. Its policy statement argues that undisclosed personalized pricing harms shoppers precisely because it denies them the chance to use a virtual private network or a private browsing session to avoid a higher price.
Although this is only a proposed policy statement right now, the FTC is keen to make brands and companies rethink their personalized pricing strategies and be more transparent about the data they use to set prices.
While the matter is yet to be decided, you can take several measures right now to limit how much personal data companies collect and use about you. This includes using a VPN, a secure browser, and an identity theft protection service.
Budget-friendly VPN that lets you connect unlimited devices at once, which most VPNs cap at 10 or fewer
4,500+ servers across 100 countries with proven fast speeds, even on distant connections
Includes a built-in ad and tracker blocker, so you get cleaner browsing without a separate tool
[1] Federal Trade Commission’s Proposed Enforcement Policy Statement Regarding Personalized Pricing
/images/2026/06/04/best_lifelock_alternatives.jpg)
/images/2023/10/11/best-data-removal-service.png)
/images/2026/08/24/closeup_of_the_ftc_logo_on_a_building.jpg){kind=logo}
/images/2026/08/24/aliexpress_was_making_your_computer_play_sounds_you_couldnt_hear_to_tr_OpRrCVA.png)
/images/2026/08/21/million_face_photos_cottonbro.png)
/images/2026/08/21/ice-poised-to-get-easy-access.png)
/images/2026/08/20/meta-collected-kids-data-allegedly.jpeg)
/images/2026/08/20/flock-driving-habits-surveillance.jpeg)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/kate-quinlan-new.jpg){kind=small}
/images/2022/09/02/logo-surfshark-vpn.png){kind=logo}
/authors/krishi_chowdhary_headshot.jpg)