Have you noticed a message on your food delivery app that reads: “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA”?

If so, the reason may be New York’s new personalized algorithmic pricing law (General Business Law § 349-a). Enacted in May 2025 and effective as of November 2025,[1] the law requires businesses to disclose when they use consumer-specific personal data to set prices for New York consumers.

New York’s disclosure requirement is one of the first state laws in the country to directly regulate personalized algorithmic pricing practices. For ecommerce platforms, app-based services, loyalty programs and retailers experimenting with data-driven pricing, the law raises immediate compliance, user interface and enforcement considerations.

What Is Personalized Algorithmic Pricing?

Businesses have long used “ordinary” algorithmic pricing — technology that sets or adjusts prices in near real time based on market conditions such as demand, supply, competitors’ prices, seasonality and inventory levels. Airline tickets, hotel rooms and ride-hailing surge pricing are classic examples. These systems primarily respond to broader market factors.

Personalized algorithmic pricing, sometimes referred to by the FTC as “surveillance pricing,” is different. It occurs when a seller uses consumer- or device-level data to set individualized prices or discounts. Prices may vary across individuals or granular audience segments based on inferred willingness to pay, location, urgency, purchasing behavior, or other personal or behavioral traits, rather than (or in addition to) market-wide conditions.

The distinction is critical: traditional dynamic pricing responds to the market; personalized algorithmic pricing responds to the individual consumer’s personal data.

New York General Business Law § 349-a

New York’s General Business Law § 349-a applies to any entity that sets prices using “personalized algorithmic pricing” and that “advertises, promotes, labels or publishes a statement, display, image, offer or announcement” of such pricing to a consumer in New York using personal data specific to that consumer.

The statute defines:

• “Personalized algorithmic pricing” as “dynamic pricing set by an algorithm that uses personal data.”
• “Personal data” as “data that identifies or could reasonably be linked, directly or indirectly, with a specific consumer or device.”

While these definitions are concise, they are potentially broad. Much of the compliance risk may lie in how expansively the New York Attorney General interprets “uses personal data” and “advertises, promotes, labels or publishes.”

Covered entities using personalized algorithmic pricing to set the price for a specific good or service must include a “clear and conspicuous disclosure”[2] stating:

“THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA.”

The disclosure must accompany the price display.

Exceptions

The law does not apply to:

• Location data used by for-hire vehicles or transportation network companies solely to calculate fares based on mileage and trip duration.
• Entities subject to certain state insurance or financial laws.
• Financial institutions subject to Title V of the Gramm-Leach-Bliley Act.
• Certain subscription-based relationships where a consumer with an existing subscription agreement is offered a price lower than the price set forth in the subscription contract.

Enforcement

Enforcement authority rests with the New York Attorney General. When the Attorney General believes a violation has occurred, the office must first issue a cease-and-desist letter outlining the alleged violations and providing a cure period.

If the violation is not resolved within the designated timeline, the Attorney General may seek injunctive relief and civil penalties of up to $1,000 per violation.

The statute does not specify how “per violation” will be calculated — whether per consumer, per transaction, per display, or per day — leaving open the possibility of significant exposure depending on how enforcement authorities interpret the provision.

Early Enforcement Signals: Instacart

New York Attorney General Letitia James has already signaled enforcement interest.[3] On January 8, 2026, her office sent a letter to grocery delivery platform Instacart expressing concerns about reported price variations among shoppers for identical products from the same stores and about Instacart’s compliance with § 349-a.

The Attorney General stated that when an algorithm uses a consumer’s behavior and other personal data to inform the prices paid at checkout, the practice constitutes “personalized algorithmic pricing” requiring disclosure under New York law.

The letter further suggested that Instacart’s disclosures at the time may not have been “clear and conspicuous,” and that certain product and category pages may have lacked required disclosures entirely. The Attorney General also requested documents related to pricing experiments and compliance efforts.

The letter indicates that regulators may interpret both the scope of “personalized algorithmic pricing” and the disclosure-placement requirement broadly.

Key Compliance Considerations

1. Threshold Question: Are You Using Personalized Algorithmic Pricing?

Companies should carefully assess whether their pricing models rely on personal data linked to individual consumers or devices. This analysis may include evaluating the use of:

• Mobile advertising identifiers (MAIDs)
• First-party behavioral data
• App engagement data
• Device fingerprints
• Account-level purchase history
• A/B testing or pricing experiments based on consumer-level signals

Even pricing experiments or targeted discount strategies may fall within the statute’s scope if they rely on identifiable personal data.

Some businesses may consider structural adjustments, such as shifting from individualized pricing to larger cohort-based offers or loyalty-tier pricing, to reduce regulatory risk.

2. Promotions and Marketing Channels

The statute applies to prices that a seller “advertises, promotes, labels or publishes.” The inclusion of “advertises” and “promotes” suggests that the law may extend beyond checkout pages to other channels, including:

• Email offers
• Text promotions
• Push notifications
• In-app messaging

Whether disclosure is required in all such contexts remains an open question.

3. Placement of Disclosure and UI Tension

The disclosure must be “clear and conspicuous,” provided “in the same medium as” and “on, at, or near and contemporaneous with” every covered price display.

As suggested in the Instacart letter, disclosures buried in terms and conditions or a privacy policy likely will not suffice.

In evaluating whether a disclosure is “clear and conspicuous,” regulators typically consider factors such as:

• Proximity to the claim
• Font size and visual prominence
• Contrast and readability
• Whether scrolling or clicking is required
• Overall user experience context

For mobile-first ecommerce platforms, placing a prominent disclosure next to every personalized price may create friction within carefully designed checkout flows and loyalty programs.

Multi-State Enforcement Risk

New York’s approach is disclosure-focused. However, scrutiny of personalized pricing practices is expanding beyond the state.

In January 2026, the California Attorney General announced an investigative sweep focused on businesses using “surveillance pricing” in ways that may violate the California Consumer Privacy Act (CCPA). The Attorney General emphasized the CCPA’s “purpose limitation” principle — that businesses may use personal information only in ways consistent with consumer expectations.

While New York law requires transparency, California’s approach suggests a broader substantive inquiry into whether pricing practices themselves are permissible. In some jurisdictions (particularly those with comprehensive data privacy laws), disclosure alone may not be sufficient.

Whether other states adopt similar disclosure requirements — or move beyond disclosure toward substantive restrictions — will be an important regulatory trend to watch in 2026 and beyond.

The authors would like to thank Aniket C. Mukherji, a Proskauer legal assistant, for his contributions to this post.

---

[1] Note: Following passage, the law was challenged by an industry group arguing the law violated the First Amendment. A federal judge subsequently rejected the legal challenge. (National Retail Federation v. James, No. 25-05500 (S.D.N.Y. Oct. 8, 2025)). The matter is now on appeal. (National Retail Federation v. James, No. 25-2818 (2d Cir.)).

[2] “Clear and conspicuous disclosure” means: “disclosure in the same medium as, and provided on, at, or near and contemporaneous with every advertisement, display, image, offer or announcement of a price for which notice is required, using lettering and wording that is easily visible and understandable to the average consumer.”

[3] Note: the New York Attorney General previously issued a consumer alert in November 2025 encouraging consumers that have encountered algorithmic pricing that is not properly disclosed to file a complaint with the AG’s office.