Podcast - The FTC's Personalized Pricing Policy Statement

Anthony DiResta: Welcome to another podcast of Clearly Conspicuous. As we've noted in previous sessions, our goal in these podcasts is to make you succeed in this current regulatory and governmental environment that's frankly more aggressive than we ever thought, make you aware of what's going on with the federal and state consumer protection agencies and give you practical tips for success. As always, it's a privilege to be with you today.

Today, we discuss the Federal Trade Commission's (FTC) personalized pricing policy statement. What does it mean and what should you do now? Today, we have a major breaking development to cover. On August 19, the FTC voted 2-0 to issue a proposed enforcement policy statement on personalized pricing. This is arguably the most significant federal action we've seen yet at the intersection of consumer data and pricing practices. If you've listened to our last episode on surveillance pricing and dynamic pricing, consider this the next chapter. And folks, it's a big one. Rejoining me in my conversation today is my colleague Benjamin Genn from Holland & Knight's Consumer Protection Defense and Compliance Team. Ben has been tracking this issue closely and intensively, and he's authored three published client alerts on surveillance pricing this year alone and presented at the FMI Legal, Regulatory & Compliance Conference. Ben, again, welcome back buddy, it's good to see you.

Benjamin Genn: Thanks, Tony. It's great to be back, especially with news this significant. When the FTC issues a policy statement on a 2-0 bipartisan basis, as you mentioned, during a period of general regulatory rollback, as we've seen, you know this is big news and I think companies need to understand what this means for them right now.

Anthony DiResta: Let's just jump right into it. Ben, what does this proposed enforcement policy statement actually say? And what doesn't it say?

Benjamin Genn: It's a good question, Tony. So let's be clear. It's not a ban on personalized pricing. The FTC expressly acknowledged that it does not have the legal authority to ban personalized pricing outright, but instead it established a disclosure framework. So, in other words, the commission's saying if you use consumers' personal data to set individualized prices, you must clearly and conspicuously disclose that fact to consumers. Otherwise, that likely violates Section 5 of the FTC Act.

Anthony DiResta: Interesting. Ben, what are the FTC’s legal theories here?

Benjamin Genn: Tony, I don't think you'll be surprised, but they're deploying two distinct legal theories. First, a deception theory. Their view is that retailers deceive consumers when the retailers represent that a price is static or widely offered, when in fact it's actually personalized towards a consumer, or when consumers reasonably believe a price is the same for everyone and the merchant fails to disclose otherwise. Their second theory is under the unfairness prong. The higher price from concealed personalized pricing is a substantial injury that consumers cannot reasonably avoid because the personalization is hidden and they lack information or tools to change their behavior, dispute inaccurate data or avoid the data collection. And Chairman Ferguson put it plainly, and I'm paraphrasing here, Tony, but when consumers see a listed price, they expect it to be the same price everyone else sees, and not the retailer's estimate of how much that consumer is willing to pay. That's a pretty powerful framing. But Tony, before we dive deeper into the legal analysis, I'd love to give your general counsel listeners the practical bottom line up front.

Anthony DiResta: Ben, that's a great idea. Thank you. Well, give us the playbook first, and then we'll unpack the details.

Benjamin Genn: Thanks, Tony. Here's what I recommend companies should be doing right now.

First, they should audit their pricing algorithms and data practices across all channels. This includes third-party vendors, because if a vendor's tool personalizes prices on that company's behalf, that's still the company's liability.

Second, they should implement clear disclosures that satisfy all three elements the FTC requires, and that is the fact of personalization, the basis for personalization and the data types used. The FTC expressly states in their proposed policy statement that companies should not be euphemistic and use phrases like "specially selected." The FTC specifically flagged that phrase, for example, as inadequate.

Third, companies will want to review the consent mechanisms and privacy policies in place, asking whether consumers have specifically consented to the pricing uses of their data and not just data collection generally.

Fourth, the company should assess any vulnerability-based pricing risks. Interestingly, Tony, in the proposed policy statement, the FTC lists out illustrative examples and scenarios like medical distress, bereavement, geographic immobility and the lack of competitive alternatives. So one note here to flag for any companies is that if the pricing system can detect and exploit any of these conditions, that's a very high-risk category.

Fifth, companies should monitor state developments. And just remember, because the FTC requires disclosure, many other states that we discussed on our previous podcasts still require no personalized pricing at all. So a company's compliance programs need to address both the federal and state track.

And a deadline to note, Tony, the comment period for this proposed policy closes on September 18, 2026, and companies should seriously consider submitting comments, particularly if they believe certain aspects of the proposed statement is overbroad or unclear. It's a proposed statement, it's not final yet, and the FTC is actively soliciting industry input.

Anthony DiResta: Ben, thank you so much, this is incredibly helpful. There's a lot here, not only for considering comments, but considering the compelling need for audits. So let's now dig into the details. So there are specific disclosure requirements. Walk us through what companies actually need to tell consumers.

Benjamin Genn: That's right, Tony. So the statement identifies three required disclosures. First, is the fact that the price is personalized. That is, that the consumer is seeing a price that may differ from what other consumers see. Second, the basis for that personalization, meaning why is this particular consumer getting this particular price. And third, the types of data used to personalize that price. All three elements must be present, and they must be clear and conspicuous, not, for example, buried in privacy disclosures or terms of service. And one piece to note on this, Tony, the disclosure should also be at or near the point of purchase, when the consumer is making their buying decision.

Anthony DiResta: Ben, let me ask you this. The statement includes examples of what counts as adequate versus inadequate disclosure. Can you walk us through those?

Benjamin Genn: Yes, so Tony, this is actually one of the most practically useful parts of the statement. The FTC gives a specific example of an inadequate disclosure: telling a consumer they've been shown a "specially selected" price. That language is misleading according to the FTC because it omits the critical information. It sounds like the consumer is getting a deal, but when, in reality, the price may have been increased based on their data. So vague, euphemistic or promotional language surrounding personalized pricing will likely be treated as deceptive rather than as adequate disclosure. "Specially selected," "personalized for you," "your price" — these may sound consumer-friendly, but they fail the FTC's standard because they don't convey that the price may be higher than what others pay, or why. And on the adequate side, the FTC gives an example of a disclosure that the personalized price is based on a consumer's estimated willingness to pay, derived from data about their previous purchases from the same retailer through the same login account. That's specific. It tells the consumer what's happening, why and what data is being used. And that's the standard that companies need to aim for here.

Anthony DiResta: Ben, the statement also includes several illustrative examples of problematic practices, and they're pretty vivid, aren't they?

Benjamin Genn: They are. And they're clearly designed to put companies on notice about vulnerability-based pricing, as we touched on earlier. That carries the highest enforcement risk. And Tony, the examples include a food delivery company quoting a higher price based on data suggesting consumers can't easily leave home, a grocery chain charging a delivery customer more for milk because the data shows several children living in the household, a hotel charging more based on data indicating the traveler is attending a funeral, a ride-share company charging more because the user has not installed competitor apps, a ride-share company charging more for a transport to a medical facility during an apparent emergency, you get the idea. The common thread in these examples is that the personalization exploits consumer vulnerability or urgency, situations where the consumer has a diminished ability to shop around or walk away. So companies here really should audit any pricing algorithms, specifically for these vulnerability-based scenarios, because they represent the highest-risk category for any sort of enforcement action.

Anthony DiResta: Ben, how does this proposed statement connect to the broader landscape we discussed in our last episode, the state legislation, the Senate hearing and the congressional inquiries?

Benjamin Genn: It's a great question, Tony. This is the federal piece of an increasingly comprehensive regulatory framework. As our listeners may recall, we're tracking tens of state bills, with enacted bans in New Jersey, Maryland and Connecticut, and New York's One Fair Price Act awaiting the governor's signature. As we discussed, Tony, in our last episode, the Senate Judiciary Committee held its hearing on August 4, and multiple House committees have launched various investigations. So the FTC's proposed policy statement fills a critical gap here. The states are generally banning personalized pricing outright, while the FTC is taking a disclosure-based approach at the federal level. One thing is clear: Companies are now facing a two-track compliance challenge. They need disclosures robust enough to satisfy the FTC, while simultaneously ensuring they're not engaging in practices that any state laws prohibit outright.

Anthony DiResta: Ben, one distinction that keeps popping up is between dynamic pricing and personalized pricing. Does the FTC address that?

Benjamin Genn: It does, and this is important. The FTC's statement expressly acknowledges that supply-and-demand-based price variation is different from data-driven personalization. Adjusting prices based on aggregate market conditions like time of day, demand levels, inventory or any seasonal patterns, that's dynamic pricing and it's generally outside the scope of their statement. But the FTC is drawing the same line we've been advising clients to draw. Prices that vary based on who the consumer is, using their personal data, is personalized pricing subject to the FTC's stated disclosure framework. Prices that vary based on market conditions and apply equally to all consumers in that market are dynamic pricing and are not the target. The term "surveillance pricing," which you'll hear more at the state level, generally maps to what the FTC calls "personalized pricing." And companies that can document that they're engaging in lawful dynamic pricing rather than personalized pricing remain in a strong position here.

Anthony DiResta: Well, doesn't the statement also discuss artificial intelligence (AI) and machine learning? How does that AI factor in?

Benjamin Genn: It does, Tony. And as you can tell from some of these responses, the FTC statement is quite comprehensive and covers a lot of ground. In their statement, they specifically note that machine learning and automated experimentation enable this granular consumer segmentation and rapid A/B price testing that's largely invisible to consumers. Their concern is that the AI makes personalized pricing easier to deploy, harder for consumers to detect and potentially more exploitative because algorithms can identify and target vulnerability signals that a human pricing manager might never think to use. So companies that deploy any AI pricing tools really should treat those tools as heightening, not reducing, their disclosure and governance obligations. The FTC's statement signals that this algorithmic opacity is not a defense. So if your AI identifies that a consumer is price-insensitive based on any behavioral patterns and charges that consumer more, that's still personalized pricing requiring disclosure, regardless of whether a human set the rule or a machine learned it. The takeaway here is clear: Automated decision-making amplifies both the capability and company's compliance obligations.

Anthony DiResta: Well, Ben, let me ask you this, there's a huge data privacy angle here, isn't there?

Benjamin Genn: Absolutely, Tony. The statement makes clear that businesses collecting, using or disclosing consumer data for personalized pricing without adequate disclosures or consent may independently violate Section 5 of the FTC Act. And here's a nuance that's very easy to miss: Businesses that base prices on consumer data without verifying that the consumer actually consented to that specific use of their data may violate Section 5. And that's a critical piece here, Tony. So even if you obtained consent for data collection generally, say through a loyalty program signup, that consent may not extend to using that data for pricing purposes if the company's disclosures did not specifically cover that pricing use case.

Anthony DiResta: Ben, you gave us the practical playbook up front. Now that we've gone through the details, is there anything else you'd add or emphasize for general counsel or consumer compliance officers listening here?

Benjamin Genn: I think just to reinforce the key points. The September 18 comment deadline is real, and if your company has concerns about the scope of the statement, particularly around loyalty programs, the specificity of any required disclosures or the line between dynamic and personalized pricing, don't be afraid to file comments. The final statement could look very different depending on what the commission hears. And companies shouldn't wait for finalization to begin compliance work. Start auditing now, start building your disclosure framework now and start documenting your pricing logic now.

Anthony DiResta: So, what’s the early reaction been from industry and consumer advocates?

Benjamin Genn: As you can imagine, it's been a split reaction, which tells you maybe the FTC may have found a middle ground here. Consumer advocacy groups are arguing that the statement doesn't go far enough, that disclosure alone is insufficient and that personalized pricing should be banned outright, similar to what the states are doing. They point out that companies can still engage in the practice as long as they disclose it, and they generally worry that disclosures will become yet another piece of fine print that most consumers inevitably ignore. But on the industry side, Tony, retail trade associations have expressed concern about protecting their loyalty and rewards programs and about being required to reveal certain proprietary pricing and decision-making processes. They want clarity that traditional loyalty discounts and promotions are not swept in. A key piece, though, is that the comment period is where these battles will play out, and companies that want to shape the final statement, particularly around these safe harbors for loyalty programs, for example, need to file comments by the September 18 deadline.

Anthony DiResta: Ben, this has been enormously valuable. I'm just struck by it all because potentially this impacts all companies, because all companies provide prices to consumers. And the speed of developments here is striking. From the Senate hearing just a couple of weeks ago on August 4, to this proposed statement on August 19, we're seeing the regulatory framework take shape in real time. So folks, not only fasten your seatbelt, think about compliance audits and think about commenting. So, folks, please stay tuned for further developments and programs as we identify and address the key issues in developments, and provide strategies for success. If you're a general counsel or compliance officer, particularly in retail, food delivery, travel or any data-intensive consumer business, mark September 18 on your calendar. That's your deadline to weigh in on this proposed statement. In the meantime, audit your pricing practices, review your disclosures and assess your vulnerability-based pricing risk. I wish you all continued success and stay tuned, folks. Take care.