The FTC's proposed enforcement policy statement on personalized pricing is a pressing concern for data privacy officers managing compliance with GDPR, CCPA, and other frameworks. The comment period closes September 25, 2026, and privacy teams are asking whether personalized pricing is legally defensible, not just technically possible.
These questions come from those running pricing engines, data science teams, and customer analytics platforms. They're reaching out in Slack channels, on compliance calls, and during audit prep sessions. Here's what they need to know.
What Counts as "Personalized Pricing"?
Personalized pricing involves using personal data to set prices based on an individual's perceived willingness to pay. It's distinct from dynamic pricing, which adjusts based on time, inventory, or demand, and segmented pricing, which groups customers by categories like geography.
The distinction is crucial. Charging more for concert tickets on a Friday night than a Tuesday afternoon is dynamic pricing. Charging New York customers more than Ohio customers due to logistics costs is segmented pricing. However, analyzing Sarah's browsing history, purchase patterns, device type, and inferred income to show her a $47 price while showing John $39 for the same product is personalized pricing.
The FTC's concern is about using personal data to infer willingness to pay at an individual level. If your pricing model uses consumer-specific data to output consumer-specific prices, it's personalized pricing.
Does GDPR and CCPA Compliance Cover Us?
Not entirely. Data privacy laws govern data collection, processing, and protection but don't directly address whether using that data for individualized pricing is fair or deceptive under consumer protection statutes.
Under GDPR, you'd need a lawful basis, likely legitimate interests, since consent for pricing decisions is rarely freely given. Transparency about processing and compliance with Data Minimisation principles are required. Article 22 restricts Automated Individual Decision-Making and Profiling that produces legal or similarly significant effects, though pricing decisions occupy a gray zone.
Under CCPA, you'd need to disclose the categories of personal information used and honor opt-out requests. But neither framework explicitly prohibits personalized pricing. The FTC's policy statement operates under Section 5 of the FTC Act, which prohibits unfair or deceptive practices, focusing on consumer harm, not just data handling procedures.
You can comply with privacy law and still face FTC scrutiny if your pricing practices are deemed unfair or deceptive. They're parallel obligations, not substitutes.
What Personal Data Creates the Most Risk?
Protected class data and proxy variables pose the highest risk. Using race, gender, age, disability status, or other protected characteristics in pricing algorithms is prohibited under fair lending laws, fair housing laws, and equal credit opportunity regulations, depending on your sector.
The bigger risk is proxy variables that correlate with protected classes. ZIP code correlates with race. Device type correlates with income. Time spent on site might correlate with desperation or cognitive ability. Even if you don't intentionally collect protected class data, your model can produce discriminatory outcomes if it relies on proxies.
From a GDPR perspective, special category data (Article 9) requires explicit consent or another specific lawful basis. But the FTC's concern extends beyond special categories to any data that enables price discrimination harming consumers or undermining fair competition.
Financial data, health information, location history, and behavioral patterns all amplify risk. The more sensitive the input data, the harder it becomes to argue your pricing practice is transparent and non-deceptive.
How Do We Document Non-Discriminatory Pricing?
Start with a disparate impact analysis. Test whether your pricing algorithm produces systematically different prices for protected groups, even if those characteristics aren't explicit inputs. Run the model against demographic data to identify correlations between prices and protected classes.
Document your data inputs, model logic, and price outputs. If the FTC or a state attorney general investigates, you'll need to explain why your model produces the prices it does. "The algorithm decided" isn't a defense. You're accountable for the outcomes, not just the intent.
Implement fairness constraints in your model. Set boundaries that prevent price variations beyond a defined range for similar products or services. Test regularly for drift, as models trained on historical data can amplify existing biases over time.
Keep records of your Data Subject Access Requests. Under GDPR and CCPA, consumers can ask what data you hold and how you use it. If you can't explain how their data influenced their price, you can't demonstrate compliance with transparency obligations.
Can We Offer Personalized Discounts and Promotions?
Discounts, while framed positively, raise similar concerns as price increases. If you're offering targeted discounts based on personal data, you're still engaging in personalized pricing.
The legal risk depends on how you select discount recipients. Offering a discount to students (verifiable status) or loyalty program members (opt-in relationship) is generally defensible. Offering discounts only to users browsing from expensive devices or living in wealthy neighborhoods creates fairness concerns.
Transparency helps. If you're upfront that prices vary and consumers can see why they received a particular offer, you reduce deception risk. Hidden personalization, where consumers believe they're seeing standard prices but aren't, is where the FTC's unfairness analysis is most critical.
Consider whether your discount strategy would survive public scrutiny. If a journalist wrote "Company X charges lower prices to affluent customers while raising prices for price-sensitive consumers," would you be comfortable defending that practice?
What Should We Do Before September 25?
Read the proposed policy statement when it's published and submit comments if your organization has relevant data or concerns. The comment period informs the FTC's final policy, and industry input matters.
Audit your current pricing practices. Map where you use personal data in pricing decisions, what data sources feed those decisions, and whether you've tested for discriminatory outcomes. If you don't know how your pricing works, you can't defend it.
Update your privacy notices. If you're using personal data for pricing, your GDPR Article 13/14 notices and CCPA disclosures should explicitly state that. Vague language about "improving customer experience" won't satisfy transparency requirements.
Train your data science and pricing teams on the legal constraints. Engineers building pricing models need to understand that technical capability doesn't equal legal permission. Build compliance checkpoints into your model development lifecycle.
Where to Go for More
The FTC's proposed policy statement will be available for public comment through September 25, 2026. Monitor the docket for industry comments and legal analysis as the comment period progresses.
Review the FTC's existing guidance on algorithmic fairness and automated decision-making. While not binding, these documents signal enforcement priorities.
Consult with counsel experienced in both data privacy and consumer protection law. Personalized pricing sits at the intersection of multiple regulatory regimes, and you need advisors who understand how they interact.
Consider whether your pricing strategy is worth the regulatory risk. Sometimes the most defensible approach is the simplest one: transparent, consistent pricing that doesn't require defending your use of personal data to charge different consumers different amounts for the same product.
