The FTC drew a line around personalised pricing. Which CRO tactics cross it?

Most conversion teams do not think of themselves as running personalised pricing. They think of themselves as running a personalisation engine, a loyalty tier, a geo rule and an abandoned-cart offer. The FTC's proposed enforcement policy statement, issued on 19 August 2026, does not care what you call it. It cares whether a consumer's own data set the price they were shown, and whether they could tell.

What the FTC actually proposed

On 19 August 2026 the Commission issued a proposed enforcement policy statement on personalised pricing, also referred to as surveillance pricing. It is not a rule. It is a statement of how the FTC intends to apply existing law, which makes it both weaker and faster-acting than rulemaking: nothing new becomes illegal, but the agency has told you which existing theory it will use.

The theory is Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices. The Commission has acknowledged that Congress has not granted it authority to prohibit personalised pricing outright. So the enforcement hook is concealment rather than the practice itself, plus a second, independent hook: collecting, using or disclosing consumers' personal data for pricing purposes without adequate disclosure or consent can create Section 5 exposure on its own, separate from the price shown.

That second hook is the one CRO teams underrate. It means the data pipeline that feeds your pricing logic is in scope even in cases where the price outcome looks benign.

The statement is the culmination of several years of work — a Section 6(b) study in 2024 and advance notices of proposed rulemaking in April 2026 — and it lands on top of active state enforcement in New Jersey, Maryland, Connecticut and New York. The federal position may stay proposed for a while. The state exposure is already live.

The disclosure test, in three parts

The FTC's standard for an adequate disclosure has three elements, and partial compliance is explicitly called out as a failure mode.

1. That the price is personalised. The consumer must know individualisation happened at all.
2. The basis of the personalisation. What the price was varied according to — for example, an estimate of willingness to pay.
3. The types of data used. Which categories of their information fed that estimate.

All three must be clear and conspicuous, meaning prominent and understandable, at or before the point of purchase. The Commission's illustration of what falls short is instructive: telling a consumer they have been shown a "specially selected" price would likely be misleading, because it omits the nature and basis of the personalisation while implying something favourable. Its illustration of what suffices is a disclosure stating that a personalised price is based on the consumer's estimated willingness to pay derived from their previous purchases from the same retailer through the same login account — provided that is accurate and complete.

Read those two examples together and a useful working rule falls out. If the honest version of your disclosure would embarrass you, the tactic is the problem, not the wording. "This price is higher because our model estimates you will pay it" is an accurate disclosure that no team wants to write. That reluctance is the signal.

A risk matrix for common tactics

Most of what conversion teams run is not personalised pricing in the FTC's sense, and the value of the policy statement is that it makes the boundary legible. This is our reading of where twelve common tactics sit — a prioritisation aid for your own legal review, not a substitute for one.

The pattern across the rows is a single axis: how far the price moved from a published number, and how far the basis sits from something the consumer can see. Broad, visible, rule-based variation sits at the safe end. Individual, inferred, invisible variation sits at the other.

How to keep testing prices without individualising them

Price testing is legitimate and, done properly, sits outside the definition. The design rules are straightforward.

• Assign randomly. Allocation must be by chance, not by a model of what this person will pay. That is the single distinction that keeps a test out of the definition.
• Hold price constant per user. Sticky assignment for the test's duration, across devices and sessions where you can identify the user. A shopper who sees two different prices for the same item will not read your methodology; they will screenshot it.
• Honour the lower price. If a consumer is exposed to two prices, charge the lower one. Cheap insurance, and it removes the most common complaint pattern.
• Test at cohort level for anything sensitive. Test by product, market or channel rather than by person, and you sidestep the question entirely.
• Keep an audit trail. Record which users saw which price and why. If assignment was random, your logs are the proof.
• Test offers before you test prices. Shipping thresholds, bundles, guarantees and payment terms usually move conversion as much as a price change and carry none of this exposure. Most teams have not exhausted them.

Most price tests fail for statistical reasons rather than legal ones, so it is worth re-reading why most A/B tests fail before designing one that also has a regulator's attention.

A disclosure template that meets the three elements

If you personalise price and intend to keep doing it, the disclosure has to carry all three elements in language a shopper understands. The structure:

This price is personalised. We set it using [BASIS, e.g. an estimate
of what you are likely to pay], based on [DATA TYPES, e.g. your
previous purchases in your account with us]. [WHERE TO LEARN MORE
OR OPT OUT].

Three practical notes. Place it at or before the point of purchase, not in a privacy policy footnote. Make it accurate — an incomplete description of the basis is a worse position than none, because it converts a pricing question into a deception question. And write it in the same register as the rest of your checkout; a legalistic block at the payment step is its own conversion problem.

Why this is a conversion issue, not just a legal one

The compliance framing understates what is at stake. Personalised pricing has a trust cost that shows up in your funnel whether or not a regulator ever calls.

Shoppers compare. They compare between devices, between logged-in and logged-out sessions, between themselves and a friend. Price inconsistency discovered by a customer is not a compliance event, it is a cancellation and a screenshot on social media, and it lands on the product where your margin is thinnest. The mechanism is the same one that makes hidden fees so destructive at the payment step: the customer's model of what your price means stops being reliable.

That connects this directly to the work already under way on all-in pricing laws and on checkout dark patterns. All three are the same regulatory instinct applied at different points of the funnel: the price a consumer sees should mean what they think it means. A checkout that satisfies all three tends to convert better for the ordinary reason that people finish purchases they trust.

What to do in the next two weeks

1. Inventory your price surfaces as described above, and get the list in writing. You cannot assess what you have not enumerated.
2. Classify each one against the matrix. Anything in the high-risk rows goes to counsel with a description of the data it uses, not a description of what marketing calls it.
3. Kill the badges. "Special price just for you" language on a price that actually is personalised is the cheapest thing to fix and the closest to the FTC's stated example of misleading disclosure. If the price is not personalised, the badge is inaccurate anyway.
4. Check your vendors. Ask your personalisation and pricing vendors, in writing, what inputs drive price variation. Several products marketed as recommendation engines can vary price, and the fact that a vendor's model made the decision does not move your liability.
5. Decide whether to comment. The comment period closes 25 September 2026, and it is open to businesses, not only trade bodies. If the practical effect on a mid-sized retailer differs from what the statement assumes, that is exactly the input a comment period is for.

None of this requires waiting for a final policy statement. Every item is worth doing on trust grounds alone, and each one is cheaper now than it is in response to a state attorney general's letter.

Frequently asked questions

What is personalised pricing under the FTC's proposed policy statement?

Using a consumer's personal data — such as browsing history, location, demographics or purchasing patterns — to set an individualised price based on that person's estimated willingness to pay or likelihood of comparison shopping. The practice is also called surveillance pricing. The FTC issued its proposed enforcement policy statement on 19 August 2026 and extended the comment period to 25 September 2026.

Is personalised pricing illegal in the United States?

No. The FTC has said Congress has not given it authority to ban personalised pricing outright. Its proposed position is that concealed personalised pricing can be an unfair or deceptive practice under Section 5 of the FTC Act. The trigger for enforcement is inadequate disclosure and the data practices behind the pricing, not the existence of individualised prices.

What disclosure does the FTC say is adequate for personalised pricing?

A clear and conspicuous disclosure containing three elements: that the price is personalised, the basis of the personalisation, and the types of data used. The FTC's example of an adequate disclosure is one stating that a personalised price is based on the consumer's estimated willingness to pay derived from their previous purchases from the same retailer through the same login account — if accurate and complete. Telling a consumer only that they have received a "specially selected" price would likely be misleading, because it omits the nature and basis of the personalisation.

Does A/B testing prices count as personalised pricing?

Not if assignment is random. A randomised price test allocates visitors to a variant by chance, not by what their data suggests they will pay, so it does not fit the definition of setting an individualised price based on estimated willingness to pay. It carries separate risks — inconsistent prices between sessions, devices and channels, and state-level exposure — so hold price constant per user for the duration of the test and honour the lower price if a consumer sees two.

Do loyalty discounts and coupons count as personalised pricing?

A discount against a clearly published price with stated rules is a much weaker case than an individualised price a consumer cannot see the basis of. The risk rises as the rules become invisible and the basis becomes inference: a member rate anyone can qualify for and read about sits at one end, an algorithmically raised price derived from inferred desperation sits at the other. The FTC's own example of concern is a food delivery company quoting a higher price to consumers whose data suggests they are less able to leave home.

What should an e-commerce business do before the FTC finalises this?

Inventory every system that can change a displayed price per visitor — personalisation engines, CDP-triggered offers, geo rules, dynamic pricing vendors, loyalty tiers and testing tools — and document what data each uses. Then decide for each whether the basis could be disclosed plainly without embarrassing you. Anything that fails that test is the part to change, regardless of how the final policy statement is worded.

The takeaway

The FTC has not banned anything, and this statement may sit in proposed form for months. What it has done is publish the test it will apply, and the test is unusually easy to self-administer: write the honest disclosure for each way your site varies a price, and see which sentences you would rather not publish. Those are the tactics to change. Everything else — published sales, stated member rates, randomised tests, market pricing with a real cost basis — survives the test comfortably, which is worth knowing before someone in a compliance meeting proposes switching all of it off.

This article is general information about a proposed FTC enforcement policy statement and is not legal advice. Pricing practices should be reviewed with qualified counsel in your jurisdictions.