New Jersey Just Banned Surveillance Pricing: The Line Your Pricing Engine Has to Stay Behind

If a customer's own data is an input to the price they see, three US states have now written that practice into statute, and one of them signed last Thursday. New Jersey's Fair Price Protection Act became law on 23 July 2026. Maryland's version has been law since April and takes effect on 1 October 2026. New York's One Fair Price Act passed both chambers in June and is waiting on the Governor. For most small sellers the practical answer is reassuring: loyalty discounts, coupons, flash sales, bulk pricing and veteran or senior discounts are all explicitly preserved in the New York text. What is prohibited is narrow and specific, and it is the thing a modern pricing tool does by default: setting one named shopper's price using data about that shopper. The work this week is knowing which fields feed your price.

Three laws, three very different scopes

The scope differences matter more than the headlines. Two of the three laws are food-retail statutes. Only New York's reaches a general online seller. The table below is built from state legislature and governor sources only; where a state's own bill page could not be opened, that state is left out rather than summarised from news coverage.

New York's penalties are the ones to price in: up to $5,000 for a first violation and up to $20,000 for each subsequent one, with additional penalties tied to profits earned from the violation, plus restitution and damages. The private right of action is the part that changes the risk profile, because it does not depend on an Attorney General deciding your shop is worth the case.

New Jersey's law also carries a detail that has nothing to do with algorithms. It imposes a one-year moratorium on new electronic shelf label installations while the New Jersey Innovation Authority studies the impact. Stores already running digital price tags may keep using, repairing and replacing them.

The definition is broader than "AI pricing"

New York's bill defines surveillance pricing as "pricing set completely or in part by an algorithm that uses personal data to offer different prices to different customers for the same goods or services." Two phrases do the damage. "In part" means a human-set base price adjusted by an automated rule still counts. "Algorithm" is defined as "a computational process or system that applies one or more sets of rules to generate outputs based on inputs," which describes a spreadsheet formula as comfortably as it describes a model.

Personal data is defined equally widely: "any data that identifies or could reasonably be linked, directly or indirectly, with a specific consumer or device." A device identifier qualifies. Senator Rachel May, one of the sponsors, named the inputs the bill is aimed at in the Attorney General's announcement of the vote: "browsing history, device type, and even device battery level."

That is not a hypothetical list. The FTC's January 2025 staff perspective, drawn from 6(b) orders to Mastercard, Accenture, PROS, Bloomreach, Revionics and McKinsey & Co, found that behaviours "ranging from mouse movements on a webpage to the type of products that consumers leave unpurchased in an online shopping cart" were being tracked and used to tailor prices. The intermediaries selling that capability are named. If you bought a personalisation product in the last three years, you may already be running one of them.

Five common tactics, sorted against the exemptions

The New York bill lists what stays legal, and that list is the most useful compliance document published so far. It preserves loyalty programmes offering uniform discounts to members with clearly disclosed eligibility, class-based discounts for veterans, seniors, teachers and active-duty personnel, general promotions such as flash sales and posted promotional periods, volume and subscription pricing not based on personal data, creditworthiness assessments made by financial institutions using credit reports, and rates required by law. Sorting real tactics against that list:

• A 10% member discount applied to every logged-in member. Fine. Uniform, disclosed eligibility, no per-shopper variation.
• A discount code emailed after cart abandonment. This is the uncomfortable one. The trigger is behavioural data tied to an individual, and the outcome is that one shopper pays less than another for the same item. It is not a posted promotional period and it is not uniform across members. Treat it as exposed and get advice before assuming otherwise.
• Different prices by country or currency zone. Generally outside the definition when the input is the storefront, not the person. It moves inside the definition the moment you refine it to postcode-level inference about a specific visitor.
• Prices that vary by device type. Squarely inside. Device type is named by a bill sponsor as the paradigm case, and device data is inside the personal data definition.
• A/B price testing across randomly assigned visitors. Random assignment is not personal data, so the test itself sits outside the definition. Personalising the assignment by segment puts it back inside.

None of this is legal advice, and two of the three statutes only reach food retail today. The reason to act anyway is that the New York definition is the one being copied, and rebuilding a pricing pipeline after a demand letter costs more than documenting one now.

The inventory that takes an afternoon

Open whatever actually computes your prices, which for most small sellers is a Shopify pricing app, a discount rules engine, or a few lines in a checkout service. Then produce one table with a row per input:

1. Name every field that reaches the price calculation. Include the ones you inherited from a plugin. If a personalisation vendor sits in the path, ask them for the input list in writing.
2. Mark each field as person-linked or not. The test is the statutory one: could this identify or be reasonably linked to a specific consumer or device, directly or indirectly? Session ID, IP address, device fingerprint, past order history and email address are all yes. SKU, quantity, storefront currency and posted promotion dates are no.
3. For every person-linked input, find the exemption it lives under. If you can name one from the New York list, write it in the row. If you cannot, that input is your exposure.
4. Rewrite the exposed rules as posted offers. Most abandoned-cart economics survive the translation into a published, time-bounded promotion available to anyone who sees it. The revenue is in the discount, not in the targeting.

Two things worth keeping in view while you do this. Personalised pricing was never as profitable as the tooling implied, and it competes directly with the trust that makes people buy again, which is the same argument we made about setting a price you can defend rather than a price you can extract. And the compliance surface here is another instance of a familiar pattern: a rule written elsewhere lands inside your checkout with no warning, which is exactly what a dependency audit is for.

The decision rule that survives all three statutes and most of the bills behind them: if you cannot show the same price to a stranger and a regular customer standing side by side and explain the difference from a published rule, do not ship it. Usage-based and metered structures pass that test easily, which is one more reason they keep winning the pricing arguments that AI features started.