The regulatory landscape for algorithmic pricing is undergoing a structural escalation that moves beyond simple disclosure mandates into the territory of aggressive, granular oversight. With the passage of the One Fair Price Act (S.8623B/A.9349B) on June 10, 2026, New York has established a compliance framework that significantly complicates the operational environment for builders. This development follows a series of legislative actions in Connecticut, Maryland, and New Jersey, creating a fragmented, high-stakes patchwork that forces operators to reconcile disparate state-level definitions of surveillance pricing.
New York’s legislation, championed by Attorney General Letitia James, distinguishes itself through the breadth of its data definitions. The law explicitly prohibits algorithms from using personal data—including browsing history, purchase history, real-time location, income, inferred household size, ZIP code, device type, and even device battery level—to set individualized prices. By codifying such a granular list, the state is effectively capturing autonomous pricing systems based on their functional output rather than their specific technical label. This approach leaves little room for ambiguity regarding what constitutes surveillance-based price discrimination, forcing a fundamental redesign of how pricing engines ingest and process user information.
Beyond the ban on personalized pricing, New York introduces a novel transparency requirement for non-personalized dynamic pricing. Any entity that adjusts prices more than once in a 24-hour period must now provide clear disclosure to the consumer. This shifts the regulatory burden from merely policing the inputs of an algorithm to mandating visibility into the frequency of price fluctuations. The enforcement architecture is equally rigorous. While the law does not provide a private right of action—unlike New Jersey’s Fair Price Protection Act, which exposes operators to treble damages and penalties of up to $50,000 per violation—it grants concurrent enforcement authority to both the Attorney General and local governments. With no cure period included in the text, the state is signaling a high-intensity enforcement environment that will take effect 180 days after the bill is signed into law.
This four-state patchwork creates a compliance environment that intensifies pressure on the Federal Trade Commission. As the commission prepares for its September 18, 2026, proceeding on personalized pricing, it faces a growing national trend that it cannot easily harmonize. FTC Chairman Andrew Ferguson has signaled a firm stance, noting that consumers expect listed prices to be uniform rather than estimates based on personal data. However, as detailed in our analysis of the FTC’s policy, the commission is limited to requiring disclosure under Section 5—it cannot ban personalized pricing outright. Furthermore, the Congressional Research Service confirmed in July 2026 that there remains a significant federal gap, with no specific guidance addressing agentic AI in pricing.
The lack of federal clarity is becoming a structural liability for national operators, especially as 11 additional states have introduced similar surveillance pricing bills this year. This trend mirrors the broader uncertainty seen in other areas of AI governance, such as the tension between Colorado’s ADMT framework and federal preemption theory, where state-level rules are testing the limits of federal authority. For builders, the immediate priority is a comprehensive audit of pricing algorithms against the specific data points codified in the New York statute. While the law provides narrow exceptions for entities regulated under Insurance Law, pricing based on creditworthiness as defined by the Fair Credit Reporting Act, and pricing authorized by law, most consumer-facing platforms will find these exemptions insufficient to cover their standard operations.
The divergence in state approaches is now a defining feature of the regulatory landscape. Maryland offers a 45-day cure period for food retailers, while New Jersey imposes the steepest penalties with a private right of action. New York sits in the middle—$5,000 for initial violations and $20,000 for subsequent ones—but its lack of a cure period and its broad data scope make it a high-risk jurisdiction. As these laws move toward implementation, with the earliest enforcement likely beginning in early 2027 based on the bill’s 180-day provision, the ability to demonstrate algorithmic neutrality will be as critical as the performance of the models themselves.