Personalised prices now carry a warning label in some US states. What that does to conversion

On 1 October 2026, two more US states start regulating prices set with a shopper's personal data. Connecticut will require a specific sentence next to the price. Maryland will ban the practice outright in food retail. New York has already been enforcing a disclosure requirement since November 2025. If your store personalises anything about price — and a surprising number do without describing it that way — this is now a conversion problem with a legal deadline attached.

What the laws actually say

These are four separate statutes with four different scopes, which is the main reason the compliance conversation goes badly. They are not a trend you can meet with one policy. Two require a disclosure, two ban the practice in a defined sector, and only one is in force today.

More than 40 further bills are reported pending across two dozen states, including California's AB 2564, which has been proposed rather than enacted and would carry penalties up to $12,500 per violation per consumer, trebled for intentional violations. Assume the map gets more complicated, not less.

One legal point worth knowing before someone in your organisation suggests fighting it: New York's Act survived a First Amendment challenge in the Southern District of New York, with the court holding the compelled disclosure "plainly factual" and not rendered controversial merely because the regulated business would prefer not to make it. Enforcement had been stayed pending that ruling and is now live, with the state Attorney General signalling intent to enforce.

The rule the Connecticut carve-out gives you

Connecticut's exception is the most useful sentence in any of these statutes. The disclosure requirement does not bite where the price setting device is used solely to offer a discounted price in an online transaction. Read alongside the required wording — the label announces that the price was increased — the design principle is unambiguous.

This will not clear every obligation in every state — New York's disclosure trigger is written around a price being set by algorithm using personal data, and is broader than Connecticut's markup framing — but it collapses most of the exposure and it points at an implementation your merchandising team can actually operate: a stable anchor price, plus a documented discount ladder, plus a rule that nothing in the ladder is ever negative.

Which of your tactics are actually in scope

The reason this catches teams out is that very little of it is called "pricing" internally. It is called personalisation, or retention, or a growth experiment, and it is frequently owned by a tool rather than a person. Run every price-affecting mechanism on your site through one question: does the individual shopper's personal data change the number they see?

What the label does to conversion

Nobody has published a controlled measurement of the effect of these specific labels on conversion, and you should be sceptical of anyone quoting one. What we can reason from is well established: cost information that appears late and unexpectedly is the largest single driver of checkout abandonment, and pricing clarity improves conversion. A sentence announcing that this shopper's price was raised using their personal data is the worst version of that: unexpected, adjacent to the price, at the exact moment of evaluation, and framed as something done to them.

Which means the useful conclusion is not "how do we word the label to soften it". It is that the label has no good version, and avoiding the trigger is worth more than any test you could run on the wording. That is unusual in CRO. Most compliance disclosures — consent banners, all-in pricing, subscription terms — have a design space where a careful implementation costs you little. This one does not, because the required text is fixed by statute and says the quiet part.

It is worth separating this from the all-in pricing rules, which point the other way. Those require showing the true total earlier, and implementations that comply generally convert better than the drip-pricing they replaced. Personalised-pricing disclosure has no equivalent upside. Do not let the two get merged into one "pricing compliance" workstream, because the right response to each is different.

An audit you can run this month

Deadlines on 1 October give you three weeks. This is the order we would work in.

1. Inventory every system that can change a displayed price or total. The commerce platform, any pricing or repricing app, on-site personalisation vendors, the CRO and A/B testing tool, the email and SMS platform if it issues unique codes, and any marketplace repricer. Most teams find between four and nine.
2. For each one, list the inputs to the price rule. Not what the vendor says it does — the actual configured rules. You are looking for any input tied to an identified or identifiable individual: session history, past orders, loyalty status, location beyond market level, device, or a third-party segment.
3. Classify each rule as up or down. Anything that can raise a price above the published one for a specific shopper is your priority list. Everything downward is far lower risk and should be documented as a discount, in the interface as well as in the code.
4. Check your A/B testing tool's assignment method. Randomised traffic split is fine. Assignment by stored user attribute is not the same thing, and price experiments are the one case where that distinction has legal consequences.
5. Decide your geography strategy. Either comply to the strictest applicable standard nationally, which is simpler to operate and easier to explain, or restrict personalisation by state. Geofencing is technically feasible and operationally fragile; if you choose it, test what a Connecticut shopper actually sees, from Connecticut.
6. Write down the model inputs and keep the record. The defence against a claim that you set prices with personal data is documentary: the rule set, the inputs, and the date it was configured. Build the artefact now, while someone still remembers why each rule exists.
7. Rebuild upward personalisation as downward. Where a rule genuinely earns its keep, raise the published price to the top of the range and express the personalisation as a discount from it. Same economics, different regulatory object, better frame for the shopper.

The wider point

This is the third area in eighteen months where a legal requirement has landed directly on top of a conversion tactic: fee disclosure, dark patterns in checkout, and now personalised pricing. The pattern is consistent enough to plan around. Tactics that work by making the shopper's understanding of the transaction worse are being regulated one by one, and the ones that work by making it better are not.

The practical version for anyone running a testing programme: when a test wins because the shopper knows less, treat the win as temporary and price in the cost of unwinding it. When it wins because the shopper knows more, it will still be legal next year. That is not a compliance heuristic so much as a decent filter on what is worth building, and it is how we approach conversion work generally.

Frequently asked questions

What is surveillance pricing or personalised pricing?

It is setting the price an individual shopper sees using that shopper's personal data, such as their location, income, device, purchase history or browsing behaviour. It is distinct from dynamic pricing, which varies prices by market signals like demand, inventory or time of day and does not use the individual's personal data. The distinction is what the new state laws turn on.

What does New York's Algorithmic Pricing Disclosure Act require?

Where a price is set by an algorithm using a consumer's personal data, including location, income or prior shopping habits, the seller must display a clear and conspicuous statement at or near the price reading: THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA. The law has been in effect since 10 November 2025, carries a penalty of $1,000 per violation, and survived a First Amendment challenge in the Southern District of New York, where the court held the compelled disclosure was plainly factual.

What changes on 1 October 2026?

Two things. Connecticut's disclosure requirement takes effect, requiring the statement THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA, unless the price setting device is used solely to offer a discounted price in an online transaction. Separately, Maryland's ban on surveillance pricing by food retailers and third-party delivery platforms takes effect, enforced by the Attorney General's Consumer Protection Division with penalties up to $10,000 per violation and $25,000 for repeat violations.

Are personalised discounts and cart abandonment offers affected?

Largely not, and this is the most useful distinction in the statutes. Connecticut's disclosure requirement carves out a price setting device used solely to offer a discounted price in an online transaction, and its required label announces that a price was increased. A personalised discount from a stable published price is therefore a different regulatory object from a personalised markup. The practical design rule is to set one public price and let personal data move it downward only.

Do A/B price tests trigger these laws?

A genuinely randomised price test does not set the price using the individual's personal data, so it generally falls outside these requirements. The caveat is technical: many testing and personalisation tools assign variants using stored user attributes rather than random assignment, which is not the same thing. Check how your tool actually assigns traffic before relying on this, and keep the assignment logic auditable.

Which other states are regulating this?

New Jersey enacted a grocery surveillance pricing ban on 23 July 2026, effective 1 August 2027, with penalties up to $50,000 per violation, treble damages and a private right of action. Connecticut's broader ban on surveillance pricing by retail sellers and third-party delivery services follows on 1 July 2027. More than 40 further bills are reported pending across roughly two dozen states, including California's proposed AB 2564.

How should we audit our site before the deadline?

Inventory every system that can change a displayed price or total, including the commerce platform, pricing apps, personalisation vendors, the A/B testing tool, email and SMS platforms issuing unique codes, and any marketplace repricer. For each, list the actual configured inputs to the price rule and flag any tied to an identifiable individual. Classify every rule as raising or lowering the price relative to the published one, and rebuild the upward ones as discounts from a higher anchor price.