Maryland recently enacted HB 895, the "Protection From Predatory Pricing Act," making it one of the first states to restrict certain uses of consumer data in pricing decisions for consumer retail goods. The law, which takes effect October 1, 2026, targets certain types of food retailers and third-party delivery service providers and prohibits them from using dynamic pricing or personal data to set a higher price for a specific consumer.
Maryland moved first, but in the weeks following Maryland's enactment, Colorado and Connecticut passed their own surveillance pricing measures and are awaiting their governors' signatures, reflecting a rapidly developing state-law trend focused on how businesses use personal data, algorithms, and other tools to set or adjust prices. While these laws share a common thread, they differ significantly in scope and enforcement mechanisms. Those differences may spark a new data privacy patchwork across the country and even push federal action on the topic.
Maryland's Protection From Predatory Pricing Act and "Surveillance Pricing" Restrictions
Below is a summary of key provisions from Maryland's law:
- Covered Entities. Food retailers and third-party delivery providers.
- Prohibition. Bans food retailers and third-party delivery providers from using personal data to set a higher price for a single consumer or from setting a higher personalized price ("dynamic pricing") based on personal data about a consumer. Additionally, it bans the use of "protected class data" to deny members of that legally protected group a privilege other groups may receive.
- Exceptions. Does not apply to promotional pricing offers, loyalty program benefits, and other temporary discounts or changes to pricing related to retention of existing customers, rewards programs, and cost-based differences, among other exceptions.
- Enforcement. Attorney general enforcement; no private right of action.
- Cure Period. Includes a 45-day cure period.
Colorado and Connecticut Expand on State Surveillance Pricing Laws
Maryland's enactment was followed quickly by surveillance pricing legislation in Colorado and Connecticut moving to the governors' desks. These measures address similar concerns but take different approaches to data-driven pricing.
Colorado
Rather than following Maryland's focus solely on food retailers and third-party delivery providers, Colorado HB 26-1210 addresses the use of data-driven individual pricing practices more broadly. In addition, Colorado's law extends beyond consumer pricing to include prohibitions on certain wage-setting practices.
Colorado offers similar but somewhat broader exceptions. For example, there is an exception for using data when setting prices within need-based financial assistance programs. Colorado's law provides the Colorado attorney general with enforcement power, in addition to rulemaking authority to implement and enforce the law. The law also includes a private right of action.
Connecticut
Connecticut's SB 4 focuses on all retailers of tangible personal property (including but not limited to retail food establishments) and third-party food delivery services. SB 4 bans retail sellers and third-party deliver services from engaging in "surveillance pricing," which is the practice of establishing customized prices for a specific consumer based on personal data collected about that consumer.
Additionally, SB 4 requires any person setting prices in the state (except for establishing discounts) in an online transaction to place a disclosure stating "THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA" if the online price was set using personal data about the consumer. Connecticut limits enforcement to the Connecticut attorney general, barring private enforcement.
Emerging Patchwork of State Requirements and Potential Federal Action
Maryland may have been the first to act, but clearly other states will enact their own take on data-driven pricing regulation. As we've seen emerge in the broader consumer data privacy landscape, states may work with a common baseline but will continue to evolve, tweak, and legislate in different ways year over year. While Congress works this year to preempt and harmonize consumer privacy at a federal level, data-driven pricing may be the next item on the list for federal action.
What Companies Can Do About Emerging "Surveillance Pricing" Legislation Today
Companies covered by the Maryland, Colorado, and Connecticut laws should assess their pricing practices and how personal data about consumers may be used in setting those prices. If a company is not working in those states, it should continue to track surveillance pricing proposals across the states, given the wide range of companies, practices, services, and states that could enact similar laws in the coming months.
If you have questions about surveillance or data-driven pricing, please reach out to Venable's Privacy and Data Security Group for assistance.