The FTC Just Put Personalized Pricing on Public Notice

The FTC put personalized pricing on notice on August 19, 2026 — but not the way the coverage we reviewed framed it. The Commission voted 2-0 to seek public comment on a proposed enforcement policy statement covering the practice it defines as “the use of personal data to set prices according to the amount that a company believes an individual consumer is willing to spend.”

Two things are true at once, and both matter. First: this is not a rule, not final, and not in force — Chairman Andrew Ferguson said plainly that the agency lacks the authority to ban the practice outright. Second: the statement describes, in unusual detail, how the FTC believes undisclosed personalized pricing can already violate Section 5 of the FTC Act — the existing prohibition on unfair or deceptive practices. The legal theory does not wait for a rulemaking.

This guide covers what the FTC actually did and what instrument it used, the two Section 5 theories in the statement, all seven risk scenarios the agency named — the coverage we reviewed quoted two or three — the carve-outs that protect ordinary dynamic pricing, and the disclosure audit worth running before any of this finalizes. For the strategy side of when personalized and dynamic pricing make commercial sense, see our dynamic-pricing decision matrix; this post is about the regulatory layer now forming on top of it.

At 09:43 ET on August 19, 2026, the FTC published a press release announcing that it is seeking public comment on a proposed enforcement policy statement regarding personalized pricing. The Commission voted 2-0 to authorize publication of the notice. Comments will be filed on the public docket, FTC-2026-1057 at regulations.gov. The statement is also indexed on the FTC’s legal library, which is the durable landing page if the PDF path moves.

One procedural detail is doing a lot of work in this story, so it is worth stating precisely: the public will have 30 days to comment once the statement is published in the Federal Register — and as of the August 19 announcement, that publication had not yet happened and no date for it had been announced. The clock starts on publication, not on the press release. Any coverage quoting a specific comment deadline as of that date was guessing.

The statement is also candid about how little is publicly known here. In its own words, “The extent to which businesses currently use personalized pricing is not well understood, and the effects of personalized pricing on consumers are unclear.” It cites limited economic literature suggesting the practice likely increases business profits, that gains for some consumers come with losses for others — and that the more sophisticated personalization becomes, the less likely consumers are to benefit. The comment period exists partly to fill that evidence gap, which is one reason operators with real data have an unusual opening to shape the final text.

Two framings circulated on August 19, and both overstate what happened: “FTC warns retailers” — the shape of Quartz’s day-one headline — and anything implying a new rule. An enforcement policy statement is a distinct legal instrument: it signals how the agency interprets existing law and where it intends to focus enforcement. It creates no new obligations, and this one says so itself.

The clearest way to see the difference is to set each instrument beside a live example — two of the three below are August 19 items, the third a rule the statement itself cites. The table is our comparison, built from the FTC’s own documents.

The most load-bearing line in the entire announcement is the Chairman’s own disclaimer of authority — the sentence that marks the outer limit of what this action can do. Ferguson opened by framing the consumer expectation: when people see a listed price, they expect it to be the price everyone else sees, not a retailer’s estimate of what they personally would pay based on their data. Then came the two clauses that define the whole posture:

Ferguson closed by saying the agency is seeking public input on a draft that “would put businesses engaged in or considering personalized pricing on notice” that the current FTC “will not hesitate to enforce the law in this space.” Read the two halves together and the position is coherent: personalization itself is not banned and cannot be banned by this agency — but concealed personalization is where the FTC believes existing law already applies. Every practical implication in the rest of this post flows from that asymmetry.

The statement itself repeats the point in its operative section: Congress has not given the Commission authority to prohibit personalized pricing outright, but the Commission intends to enforce aggressively against practices associated with it that violate Section 5 of the FTC Act — the prohibition on unfair or deceptive acts or practices — or any other law the Commission enforces.

The statement lays out two independent routes to liability under existing law. A pricing program can trip either one — and the second does not require any misleading representation at all, which is the part most operators have not internalized.

The unfairness theory explains an otherwise odd passage in the statement: the FTC itself lists the self-protection steps an informed consumer might take — using a VPN, browsing in a private window, or simply choosing a retailer whose prices are static. Those options are exactly why non-disclosure is the harm theory. A consumer who does not know a price is personalized cannot take any of them, which is what converts a quiet data practice into an unavoidable injury in the agency’s framing.

The statement also grounds the theory in the agency’s data-privacy track record, citing the location-data consent cases of late 2024 for the proposition that using personal data for pricing without verifying the consumer consented to that data’s collection can independently violate Section 5. If your pricing engine consumes third-party data signals, the consent provenance of those signals is now part of the pricing compliance question — the same first-party-data discipline we cover in our data privacy and cookieless strategy guide. It also draws an analogy to regimes operators already know: the Fair Credit Reporting Act’s adverse-action notices and state insurance laws both require disclosing not just that an individualized price moved, but the basis for it.

The statement’s most concrete content is a set of seven non-exhaustive illustrative scenarios in which personalized pricing without adequate disclosure would raise Section 5 concerns. The coverage we reviewed quoted two or three of them; the full list is more instructive, because a pattern shows up across it: prices raised on inferred vulnerability, inferred urgency, or inferred lack of alternatives. That grouping is our reading rather than a taxonomy the FTC supplies — the statement presents the seven as an unordered, non-exhaustive set. The scenario and data-signal columns below summarize the FTC’s own examples; the two band headings and the disclosure column are ours, read against the statement’s three-element disclosure standard.

Read as a set, the scenarios are a map of the agency’s instincts. None of them describes garden-variety personalization — a loyalty discount, a first-order coupon. Every one describes a price raised because data suggested the consumer could not or would not walk away. That is the pattern a compliance review should be screening for, and it is also the pattern most likely to survive into whatever final statement emerges from the comment process.

The part of the statement least visible in the coverage we reviewed: it explicitly carves out legitimate price variation. This is not a blanket attack on dynamic or algorithmic pricing. The statement’s background section distinguishes personalized pricing from supply-and-demand pricing — rideshare surge pricing is cited by name — from regional differences driven by taxes and regulation, and from products where individualized pricing is inherent, such as insurance and credit, where the price must reflect assessed risk.

For ecommerce operators, this scoping is the difference between a compliance project and a strategy crisis. Inventory-driven markdowns, time-based promotions, and demand-responsive pricing — the mechanics in our dynamic-pricing decision matrix — sit outside the statement’s target. The question it forces is narrower and sharper: does any price on your storefront move because of who the individual shopper is, and if so, does the shopper know?

The statement is specific about what adequate disclosure looks like: clear and conspicuous, covering three elements. It even calls out a common shortcut — a “specially selected” price label — as likely insufficient and potentially misleading on its own, because it omits the information that matters. The phrase itself is not new: the FTC’s .com Disclosures staff guidance has applied a clear-and-conspicuous test to digital advertising for years, and the mechanics it describes — placement, prominence, proximity to the claim — are a reasonable starting point for judging a pricing disclosure. Those three elements convert directly into an audit checklist:

Two honest boundaries on this playbook. First, the reader takeaway is a disclosure audit, not compliance certainty — the statement is a proposal, the final text can change, and nothing here is legal advice; any team that finds a gap between what its pricing engine does and what its storefront discloses should take that finding to counsel. Second, the audit is worth running even if the statement never finalizes, because the same three questions are what a journalist, a state attorney general, or an angry customer thread will ask. We run this kind of personalization-and-disclosure review inside our ecommerce engagements, and the data-provenance half of it inside CRM and automation work — in both cases the map of what data feeds which decision is the deliverable that makes every later conversation easier.

This statement did not arrive in a vacuum. Its own background section places it in a running series of pricing-transparency actions: the Rule on Unfair or Deceptive Fees effective May 12, 2025, a $24M deceptive rent-advertising settlement with Greystar in December 2025, $60M in consumer refunds from Instacart the same month, a joint auto-dealer action with the Maryland AG in April 2026, $10M in fee refunds from StubHub that April, and a comment-seeking on food and grocery delivery fee practices in the same period. The same-day $4M Manchester City Nissan settlement — a dealer-fees case, unrelated to personalized pricing — fits the same posture: hidden charges, in any form, are where this FTC is spending its enforcement budget.

Two further threads are worth watching without overstating them. States are moving on their own, broader track — several, including Connecticut and Maryland, have advanced surveillance-pricing statutes that go beyond disclosure. Treat that as directional only: it is the least firmly sourced claim in this post, we have not checked the current text or status of any of those laws here, and the specifics are outside this post’s scope. And this is US federal action only: nothing in the statement or press release reaches EU or UK operations, so multinational teams should treat it as one jurisdiction’s signal, not a global standard. For the FTC’s other live compliance track relevant to this audience, see our guide to the FTC’s AI policy compliance deadline.

Our projection, labeled as such: whether or not this statement finalizes in its current form, the direction of travel is set. Disclosure-first regulation is cheaper for agencies than rulemaking, politically durable across administrations, and easy for states to copy — the same pattern visible in ad-disclosure requirements spreading across platforms. Teams that build the disclosure muscle now — knowing what is personalized, on what basis, from what data — will find each successive requirement a formatting exercise rather than an engineering project.