Maryland Becomes First US State to Ban Grocery Surveillance Pricing, but Loopholes and a 45-Day Cure Period Test the Model

Overview

Maryland Governor Wes Moore signed the Protection from Predatory Pricing Act into law on April 28, making Maryland the first US state to explicitly outlaw the practice of using a shopper’s personal data to set an individualized grocery price. House Bill 895 prohibits large food retailers and third-party delivery services from charging different consumers different prices for the same item at the same moment based on what the seller has inferred about them. The law takes effect October 1, 2026, as reported by NPR before the bill reached the governor’s desk.

The statute lands at a moment when state attorneys general, federal regulators, and consumer groups are converging on the same concern: that machine-learning pricing engines, electronic shelf labels, and personalized loyalty programs have moved retail past the era of a single posted price. But the version Moore signed was substantially narrowed from the bill as introduced, and consumer advocates argue the final text will not deliver on its promise.

What the Law Does

The law applies to food retailers operating locations of 15,000 square feet or larger with substantial grocery operations selling tax-exempt food, and to third-party food delivery providers. Within that scope, retailers may not engage in what the statute defines as “the discriminatory practice of offering or setting a personalized price for a good or service that is specific to a consumer based on the consumer’s personal data.”

The ban targets two related practices. The first is personalized pricing — a different price for the same product at the same time, calculated from what the retailer knows about the individual shopper. The second is rapid dynamic pricing on shelf labels: the law also requires that posted prices remain fixed for at least one full business day, blocking hourly or sub-daily price spikes pushed to electronic shelf displays.

Violations are treated as unfair or deceptive trade practices. Civil penalties are capped at $10,000 for a first offense and $25,000 for subsequent violations.

Why It Matters

The federal government has spent the past two years documenting how widespread surveillance pricing has become. The Federal Trade Commission opened a Section 6(b) study in July 2024, sending compulsory orders to eight intermediary firms that build pricing engines for retailers. In a January 17, 2025 staff report, the FTC said those intermediaries had at least 250 client relationships with retailers across grocery, apparel, and health and beauty, and that the underlying systems use IP address, device type, browser history, mouse movements, demographic inferences, and emotional-state signals to adjust prices to the individual, according to the FTC.

The FTC report described concrete scenarios: a cosmetics company targeting promotions to specific skin types and skin tones, and a hypothetical in which a shopper profiled as a new parent is shown higher-priced baby thermometers at the top of search results. The agency framed the practice not as theoretical but as already operational across diverse industries.

Maryland’s bill responds to that landscape, but only inside one vertical — the grocery aisle and the delivery app — and only in one state. As reported by TechRadar, Moore framed the moment as a question of basic transparency: “Marylanders deserve to know that the price they see on the shelf is the price they will pay at the register.”

What We Know About the Loopholes

The statute carves out a long list of practices that retailers may continue. Loyalty program benefits, subscription pricing, temporary promotional discounts, supply-and-demand-driven pricing, geographic cost differentials, seasonality, tariff-driven adjustments, error corrections, and post-outage price resets are all explicitly preserved. Pricing offered in exchange for a consumer’s consent to share data is also permitted.

Consumer advocates have flagged three specific gaps. The prohibition applies only to truly individualized prices, not to hyper-specific consumer segmentation. Loyalty and subscription pricing — two of the most common vehicles for personalized rates — are exempt entirely. And no statutory baseline price is defined, meaning a retailer can offer a steep “discount” off an inflated reference price and remain within the law, as NPR reported when the bill cleared the legislature.

Enforcement is the second pressure point. Maryland’s bill contains no private right of action — consumers who suspect they were charged a personalized price cannot sue. Only the Maryland Attorney General’s Division of Consumer Protection may bring an action, and even then, the office must first issue a notice of violation and grant the retailer a 45-day cure period before any penalty can be assessed.

What We Don’t Know

It is not yet clear how Maryland’s Attorney General will operationalize enforcement. The statute requires the office to detect personalized pricing, which by its nature is invisible to anyone but the retailer and the affected shopper, and then prove that a price was set on the basis of personal data rather than one of the many exempted factors. No state regulator has yet built a public framework for auditing the algorithms behind grocery pricing engines.

It is also unclear how the law interacts with retailers that span multiple states. A national chain operating in Maryland could continue to use surveillance pricing in neighboring jurisdictions and would need to demonstrate that its Maryland stores were treated under a different pricing logic — without a baseline reference, that distinction may be difficult to enforce.

The broader uncertainty is whether October 1 will mark the beginning of a state-by-state cascade or a one-off experiment. Several other states are weighing comparable legislation, but none has yet enacted a ban. Whether any of those efforts produces a stronger statute — one that includes a private right of action, narrower exemptions, and a defined baseline price — will determine whether Maryland’s framework becomes the model or merely the floor.

Analysis

Maryland’s law is being described as a first-in-the-nation move, and on its narrowest terms that is accurate. But the gap between what the bill bans and what surveillance pricing actually does is large enough that the statute may function more as a marker than a remedy. The architecture of personalized pricing — loyalty programs that segment shoppers by inferred income and household composition, subscription tiers that lock in different rates for different customers, and dynamic algorithms that adjust prices on a per-session basis — survives almost intact under the carve-outs.

What the law does change is the burden of public justification. After October 1, a Maryland grocer that wants to charge a specific shopper a specific price has to route that price through a loyalty program, a subscription, a promotional discount, or a defensible supply-and-demand explanation. That alone moves the practice out of the shadows that the FTC’s 2025 report described and into a smaller set of authorized channels. The 45-day cure period and the absence of a private right of action mean that enforcement will be slow and concentrated in the Attorney General’s office, but the statutory definition of “dynamic pricing” — explicitly tied to personal data — establishes a precedent that other states and, eventually, federal regulators can borrow.

The more consequential test is whether the next state to act tightens what Maryland left loose. The FTC’s findings have already done the empirical work of establishing that surveillance pricing is real, deployed, and profitable. The legal infrastructure to constrain it — definitions, enforcement mechanisms, baseline-price requirements, private rights of action — is being written one state at a time, and Maryland’s draft is now the document everyone else will start from.