Governor Wes Moore signed the Protection From Predatory Pricing Act on April 28, making Maryland the first state in the nation to outlaw algorithmic surveillance pricing in grocery stores — a move that is already rippling through boardrooms from Instacart to Kroger.
---
When you pull up a grocery delivery app and see a price for a carton of eggs, that price may not be the same one your neighbor sees — even if you are both ordering from the same store at the same moment. The gap is not random. It reflects what a retailer's AI model has calculated you are individually willing to pay, based on your location, browsing history, purchasing patterns, and inferred demographics. That practice now has a name enshrined in law — "surveillance pricing" — and in Maryland, it is officially banned.
On April 28, 2026, Governor Wes Moore signed House Bill 895, the Protection From Predatory Pricing Act, making Maryland the first state in the United States to enact a sector-specific prohibition on AI-driven personalized pricing. The law, which takes effect October 1, 2026, bars food retailers and third-party grocery delivery services from using consumers' personal data to set higher prices for individual shoppers — a practice that a Consumer Reports investigation found could cost an average family more than $1,200 per year.
What the Law Does
The Act targets what it defines as "dynamic pricing": the practice of using a consumer's personal data to set a personalized price for a good or service, including pricing determined through AI systems or models that retrain or recalibrate in near real time. Covered entities include food retailers operating establishments of at least 15,000 square feet — which effectively means supermarkets — and third-party delivery platforms such as Instacart.
Under the law, these businesses are prohibited from using surveillance pricing to charge individual consumers higher food prices. They are also barred from using "protected class data" — information identifying legally protected characteristics such as race, sex, or disability — in ways that would deny a consumer an accommodation, advantage, or service available to others.
Enforcement falls to the Consumer Protection Division of the Maryland Attorney General's Office. There is no private right of action, meaning individual consumers cannot sue. Penalties reach $10,000 per violation and up to $25,000 per violation for repeat offenders. Companies that receive a notice of violation get a 45-day window to cure the problem before further legal action can be taken.
The Investigation That Made It Political
The legislative push was fueled in large part by a December 2025 investigation by Consumer Reports, conducted in partnership with Groundwork Collaborative and More Perfect Union. Researchers recruited nearly 400 consumers to shop for the same basket of goods from the same store at the same time through Instacart. The analysis revealed that shoppers were routinely shown different prices for identical products, with discrepancies reaching as high as 23% for certain items. Across an annual grocery budget, the effective overcharge could total more than $1,200 per family.
A separate Consumer Reports inquiry into Kroger found that the grocery chain was building detailed personal profiles on individual shoppers — with inferences about their income, family size, education level, and gender — and that one consumer who requested her data under a state privacy law received a document 62 pages long.
Those findings landed in an environment already primed for action. "Surveillance pricing allows companies to take advantage of that information asymmetry and charge you as much as they think you're individually willing to pay," said Grace Gedye, senior policy analyst at Consumer Reports. Gedye's organization had engaged throughout the Maryland legislative process but ultimately assessed the final law as falling short of what consumers need. "While it's encouraging to see the Maryland legislature take up this issue," she said, "this bill has loopholes that will limit its real-world impact."
The Loopholes Critics Identify
The law's critics — including Consumer Reports, the Electronic Privacy Information Center (EPIC), and the IAPP — have identified several provisions that could blunt its practical reach.
First, the ban applies only to using personal data to set higher prices, but the Act establishes no baseline or standard price against which a "higher" price can be measured. Without a fixed reference point, a retailer could theoretically market any price as a discount, with the inflated personalized price reframed as the default and the lower price as the exception.
Second, the Act explicitly carves out loyalty programs, membership-based pricing, promotional offers, and subscription services — even if those programs are the primary vehicle through which surveillance pricing operates. Critics note that loyalty programs are precisely how most grocery chains today collect the behavioral data that feeds their personalized pricing models. Third-party platforms are likewise permitted to set different prices based on objective cost differences such as shipping or taxes.
Instacart itself announced in early 2026 that it would end its practice of showing different shoppers different prices for groceries on its own platform. However, the company told Consumer Reports it would continue allowing grocery retail partners and food brands to run pricing experiments and promotional tests through the platform — a distinction that sits in a grey zone relative to Maryland's new law.
A National Pressure Wave
Maryland did not act in isolation. State legislators across the country have introduced more than 40 bills in at least 24 states targeting personalized algorithmic pricing in 2026 — already surpassing the total number of such bills introduced across all of 2025. California, Colorado, Illinois, New Jersey, New York, and Pennsylvania all have active legislation pending. New York has gone a step further: its Algorithmic Pricing Disclosure Act, already signed into law, requires retailers using personal-data-driven algorithms to display a disclosure at the point of sale reading, "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA."
At the federal level, at least three bills are in play, including the One Fair Price Act of 2025 — introduced by Senators Ruben Gallego, Kirsten Gillibrand, Cory Booker, and Angela Alsobrooks — which would broadly prohibit charging different prices to different consumers for the same product using surveillance data. On May 18, 2026, Congressman Josh Gottheimer announced the No Rigged Grocery Prices Act, a bipartisan bill extending the ban to grocery stores and third-party delivery services nationwide.
The Federal Trade Commission has also remained active. In testimony before Congress in April 2026, FTC leadership confirmed that surveillance pricing remains under active staff review and that the agency is considering whether mandatory disclosures may be required when pricing is driven by consumer data.
What It Means for the Industry
For retailers and delivery platforms, Maryland's law represents a new compliance obligation that takes effect in just months. Skadden, Arps, Slate, Meagher & Flom — one of the first major law firms to publish analysis of the Act — advised food retailers and third-party delivery providers to evaluate the software and data they use to set prices immediately, and to "monitor legislative developments at the federal and state levels, as well as any related case law."
The compliance question is not trivial. Modern grocery pricing systems are deeply integrated with real-time AI models that process dozens of data signals per transaction. Disentangling which inputs count as "personal data" under Maryland's definition — which mirrors the state's existing commercial law and includes any information "linked or reasonably linkable" to an identified consumer — will require legal and technical review across vendor contracts, platform architectures, and data flows.
Maryland's law, however imperfect, has set a precedent that other state legislatures will study closely. The question now is not whether AI-driven personalized pricing will be regulated, but how broadly, and with how many teeth.
---
Sources: Consumer Reports Advocacy, Skadden Arps, IAPP, MultiState, Consumer Finance Monitor, Morgan Lewis
"Surveillance pricing allows companies to take advantage of that information asymmetry and charge you as much as they think you're individually willing to pay."— Grace Gedye, Senior Policy Analyst, Consumer Reports