As artificial intelligence continues to reshape consumer commerce, state regulators are becoming increasingly focused on how businesses collect and use consumers’ personal information to influence their purchasing decisions. One example of this is the use of “surveillance pricing.” Surveillance pricing is the use of consumer-specific data, which can include an individual’s browsing history, purchase history, and other personal characteristics, to determine the price a consumer is offered for a product. Pricing determinations are often made using technology such as an algorithm or other artificial intelligence tools. As a result, a retailer can use that individual’s information to offer them a different price than other consumers who purchase the same item.

On April 28, 2026, Maryland Democratic Gov. Wes Moore signed House Bill 895, the Protection From Predatory Pricing Act (the “Act”). There are similar bills in other states, such as California and New York, but Maryland is the first state to enact legislation targeting surveillance pricing. The Act will take effect on Oct. 1, 2026.

The Act provides detailed restrictions and exceptions, but it is important for businesses to understand several key concepts. First, food retailers or third-party delivery services providers (as described in the Act) are prohibited from using surveillance pricing to set higher food prices based on consumers’ personal data. As defined in Md. Com. Law § 14-4701, “Personal Data” means any information that is linked or can be reasonably linked to an identified or identifiable consumer. Second, the Act also prohibits food retailers and third-party delivery services providers from using “Protected Class Data” to offer, advertise, or sell a consumer goods or services under certain circumstances if doing so results in withholding or denying to the consumer an accommodation, advantage, or a privilege accorded to others. “Protected class data” is defined as “information about an individual or group of individuals that alone, or in combination, directly or by implication identifies a characteristic that is legally protected from discrimination under the laws of the state or under federal law.”

While the Act imposes restrictions on food retailers and third-party delivery services providers, it also includes several exceptions. For example, the Act permits the use of promotional pricing offers, loyalty program benefits, or other temporary discounts. The Act also permits changes to pricing related to the retention of existing customers, or to setting different prices based on costs or differences in supply or demand associated with sales in different locations.

The Act represents significant developments in the intersections of consumer protection, data privacy, and artificial intelligence regulation. While the legislation is focused on food retailers and third-party food delivery services, it may serve as a model for future efforts to regulate personalized pricing across other industries. Businesses that utilize consumer data in pricing decisions should carefully evaluate the Act’s requirements and any current software or consumer data used to set prices. Businesses should also consider assessing their data privacy and artificial intelligence policies and practices to ensure compliance with new regulations. For example, businesses should evaluate whether they have given sufficient notice and an opportunity for consumers to opt out of the use of their personal information in conjunction with surveillance pricing. Businesses may also be required to disclose the logic behind the algorithms used with surveillance pricing, as well as other disclosures related to AI use, consistent with California’s ADMT regulations. This Act will most likely serve as a model for other states to enact similar laws.