California's Newest Surveillance Pricing Probe

Two customers shopping for the same product on the same website at the same time may see two different prices. This scenario is a growing reality in today's data-driven marketplace, and California regulators are paying attention. On Data Privacy Day 2026, California Attorney General Rob Bonta announced a new investigative sweep targeting "surveillance pricing"—a practice in which businesses use personal information to set individualized prices for consumers. For online retailers and service providers, this probe raises important questions about how customer data is collected, used, and disclosed.

The California Consumer Privacy Act secures several key privacy rights for California consumers, including:

• The right to know about the personal information a business collects about them and how it is used and shared;
• The right to delete personal information collected from them (with some exceptions);
• The right to opt-out of the sale or sharing of their personal information, including via the Global Privacy Control (GPC); and
• The right to non-discrimination for exercising their CCPA rights.

Of particular relevance to pricing practices, the CCPA includes a "purpose limitation" that restricts how businesses can use personal information. Under this principle, businesses are limited in their use of personal information to purposes that are consistent with the reasonable expectations of consumers. Businesses must disclose in their privacy policies how they collect, use, share, and sell consumers' personal information, and these policies must include information on consumers' privacy rights and how to exercise them.

A Track Record of Active Enforcement Under the CCPA

This enforcement of CCPA actions is not new to Attorney General Bonta. He has consistently demonstrated commitment to robust enforcement of California's privacy law and has targeted a range of data practices. In July 2025, the Attorney General announced the largest CCPA settlement to date resolving allegations that a company's use of online tracking technology on its website violated the CCPA. In 2024, the CCPA investigative sweep focused on compliance by streaming services and connected TVs. In August 2022, the Attorney General announced a settlement resolving a sweep of companies that were allegedly out of compliance with the user-enabled privacy control (GPC) signal to stop the sale of personal information. Other sweeps have addressed the location data industry, employee information, opt-out requests on mobile apps, and business loyalty programs.

What Is Surveillance Pricing?

In plain terms, "surveillance pricing" is the use of consumers' personal information to set targeted, individualized prices for products and services.

This can result in different consumers being offered different prices for the same product at the same time, often without any disclosure to the consumer. Unless a business discloses that it uses a consumer's personal information to set prices, surveillance pricing may be invisible to the consumer.

What Businesses Are Being Asked to Disclose

The California AG's inquiry letters seek detailed information on businesses' data-driven pricing practices, including:

• Companies' use of consumer personal information to set prices;
• Policies and public disclosures regarding personalized pricing;
• Any pricing experiments undertaken by companies;
• Measures companies are taking to comply with algorithmic pricing, competition, and civil rights laws.

Attorney General Bonta emphasized that practices like surveillance pricing "may undermine consumer trust, unfairly raise prices, and when conducted without proper disclosure or beyond reasonable expectations, may violate California law." Similar enforcement has been implemented by the Federal Trade Commission and New York.

Although the current sweep is centered on surveillance pricing in retail, grocery, and hospitality, the California AG's public statements make clear that enforcement is driven by the nature of the data use, not the sector. The CCPA's purpose-limitation and reasonable-expectations principles have been construed to apply broadly, and other uses of personal information that significantly influence economic terms for consumers could come under scrutiny.

Legal Risks Under the CCPA Key Considerations for Businesses

Businesses that may use data to set individualized prices, directly or indirectly, should consider the following:

• Review data use practices: Assess whether consumer personal information is used for pricing decisions and whether such use is disclosed in a manner consistent with CCPA requirements.
• Update privacy disclosures: Ensure privacy policies accurately reflect pricing practices and purposes for data collection.
• Assess reasonable expectations: Consider whether targeted pricing strategies align with what consumers would reasonably expect based on the business's relationship with them.
• Prepare for enforcement: If contacted by the California AG's office, respond promptly and ensure records, data mapping, and compliance documentation are up to date.

The California AG's surveillance pricing probe marks a significant development in privacy enforcement. Privacy enforcement is no longer just about data collection and sharing; it is now about how businesses use consumer data to influence prices. As Attorney General Bonta stated, "Consumers have the right to understand how their personal information is being used, including whether companies are using their data to set the prices that Californians pay." Businesses would be well advised to review their data practices now and ensure that privacy disclosures and pricing strategies are aligned with California's evolving regulatory expectations.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.