On Friday, September 25, 2026, the Federal Trade Commission closes public comment on the most consequential pricing document it has produced in a decade. The proposed Enforcement Policy Statement Regarding Personalized Pricing, first published August 19 on a 2-0 Commission vote and extended by seven days into this week, defines its subject with unusual candor: the use of personal data to set prices according to the amount a company believes an individual consumer is willing to spend.

Chairman Andrew Ferguson put the consumer expectation in one sentence: “When consumers see a listed price, they expect it to be same price that everyone else sees, not the retailer’s estimate of how much they are willing to pay based on their personal data.”

The Commission was explicit about its limits and its intentions at once. It lacks authority to ban personalized pricing outright. But businesses that fail to tell consumers how personal data shapes a price “may be in violation of the FTC Act,” and per the statement’s own language, analyzed by Sidley Austin, the Commission “intends to enforce the law aggressively” in this space.

Four days from the comment deadline, this is the pricing story of the season. It is also, less obviously, an agentic commerce story. Because the framework the FTC drafted assumes a human being reading a screen, and a growing share of the shoppers arriving at retailers’ doors are not human at all.

What the statement actually requires

Three disclosures, clearly and conspicuously, in any line of business where consumers reasonably expect a generally available price:

  1. The fact of personalization. That the displayed price is personalized, not the price everyone sees.
  2. The basis for personalization. Why and how the price was tailored to this person.
  3. The data inputs. What categories of personal information moved the number.

The statement deliberately does not touch legitimate variable pricing. Dynamic pricing driven by supply and demand, time of day, or inventory, the sort that surges a rideshare price for everyone in the same neighborhood, is not the target. Neither is risk-based pricing in insurance or credit, where individualized cost legitimately reflects individualized risk. The line the FTC draws is precise: it is not that two people pay different prices, it is that a business silently used one person’s data to decide how much that specific person can be charged.

The statement’s hypotheticals read like a list of everything objectionable about the practice, and they are worth quoting because they define the enforcement perimeter:

  • A food delivery company charging more to consumers whose data suggests they cannot leave their homes.
  • A grocery chain charging more for milk because data shows children live in the household.
  • A hotel charging more because data indicates the guest is traveling for a funeral.
  • A rideshare company charging more because the rider lacks a competitor’s app or needs emergency medical transport.
  • A retailer charging more because the consumer is physically standing in the store or parking lot.

The common thread, per legal analyses from Nixon Peabody and InfoLawGroup: exploiting a consumer’s perceived lack of alternatives. The deception theory is materiality. If shoppers knew, they might comparison shop, use a VPN, choose a different retailer, or walk away. Vague labels will not survive scrutiny. A price tagged “specially selected for you” is precisely the phrasing regulators flag as misleading, since it implies a discount while potentially delivering the opposite.

There is also an unfairness theory and a data privacy theory stacked beneath the deception one. Collecting or using personal data for personalized pricing without adequate notice or consent is, per the statement, an independent Section 5 risk.

The evidence underneath: mouse movements, skin tone, baby thermometers

The policy did not emerge from nowhere. It is the visible cap on two and a half years of investigation.

In July 2024, the FTC issued 6(b) orders to eight intermediary companies, the pricing-technology middlemen retailers hire to algorithmically tweak and target prices. In January 2025, the Commission released initial staff findings from documents provided by Mastercard, Accenture, PROS, Bloomreach, Revionics and McKinsey & Co. Then-Chair Lina Khan summarized what staff found: “retailers frequently use people’s personal information to set targeted, tailored prices for goods and services, from a person’s location and demographics, down to their mouse movements on a webpage.”

Three findings deserve to be better known:

  • The behavioral exhaust is granular. Mouse movements on a page and the products left unpurchased in a cart were among the tracked inputs fed into pricing and promotion engines.
  • The targeting is demographic to the point of intimacy. One staff example involved a cosmetics company targeting promotions by skin type and skin tone. Another described a consumer profiled as a new parent being shown higher priced baby thermometers on the first page of search results.
  • The intermediary ecosystem was already scaled. The firms examined worked with at least 250 clients, spanning grocery and apparel.

Note the second example carefully, because it is not a price example. It is a shelf example. A profiled new parent was steered toward more expensive products by ranking. Personalization does not only change the number under the product; it changes which products appear at all, and in what order. Hold that thought.

There is one more historical detail with real irony. The January 2025 findings were released on a 3-2 vote, and the dissenters were Andrew Ferguson and Melissa Holyoak, who objected to the release. Ferguson now chairs the Commission proposing the enforcement statement built on that study’s foundation. Whatever one thinks of the ideological journey, the destination is bipartisan in effect: four states have already legislated.

The states are moving faster than the FTC

A federal enforcement policy statement creates no civil penalties by itself, but it telegraphs priorities to state attorneys general and the plaintiffs’ bar whose statutes mirror Section 5. The states, several of them, are not waiting for the telegram:

  • Maryland. The Protection from Predatory Pricing Act prohibits food retailers and delivery services from using personal data to set prices at all, with carve-outs for promotions and loyalty programs. Effective October 1, 2026, ten days after the comment window closes.
  • New Jersey. A4523 prohibits surveillance pricing of groceries based on personal data, effective August 1, 2027.
  • Connecticut. HB 5563 requires displayed notice whenever a price-setting device uses personal data to raise a price, effective July 1, 2027.
  • New York. The Algorithmic Pricing Disclosure Act is already in effect, and the legislature has passed a bill replacing disclosure with prohibition, awaiting gubernatorial action.

For any retailer operating nationally, the compliance question is no longer whether personalized pricing will be regulated but under which of five or more regimes, with different definitions, different remedies, and different exposure.

Now add the agent

Here is where the drafters’ world and the actual 2026 shopping stack begin to diverge.

The FTC’s own reasoning concedes the countermeasure: informed consumers “might take measures to avoid higher personalized prices, such as using a virtual private network or private browsing session, or simply avoiding retailers engaged in personalized pricing altogether.” A VPN is a blunt instrument. A shopping agent is a scalpel. An agent that arrives without your cookies, your household graph, your income inferences, and your mouse-movement history strips the pricing engine of exactly the inputs the FTC’s study documented. Per PYMNTS Intelligence, roughly 132 million US adults have already bought retail with AI’s help. If the disclosure regime holds, agents become the cheapest privacy technology consumers ever adopted, and personalized pricing quietly starves.

But the same agent is also a new leakage surface, and this is the part nobody has regulated. Consider what a merchant-side pricing engine learns when it negotiates with a consumer’s agent rather than the consumer. The agent’s instructions leak signal: a budget ceiling stated in a prompt, urgency implied by a deadline, a preference profile built to make recommendations relevant. The MCP project’s own roadmap is standardizing agent identity so servers can recognize who, or what, is calling. Recognition cuts both ways. A pricing engine that can identify an agent, its principal’s tier, and its revealed constraints can personalize against the agent as effectively as cookies ever personalized against a browser. Delegation does not remove the willingness-to-pay signal. It relocates it into a context window the principal never audits.

And the disclosure regime itself, the three required notices, presumes a human reader. “Clear and conspicuous” is a visual standard. An agent does not perceive conspicuousness. If the disclosure lives in rendered pixels, the agent skips it; if it lives in the agent’s tool responses, the merchant controls the honesty of a machine-to-machine statement the consumer will never see. The FTC framework will need a machine-native translation layer: structured, standardized, attested disclosure that an agent can parse, compare across sellers, and surface to its principal before purchase. The first platform to ship that wins the transparency argument the same way nutrition labels won it for food.

The shelf personalizes too, and the shelf is what agents read

Return to the baby thermometer. The FTC’s remit runs to prices, but the study beneath it documented ranking manipulation: higher priced products surfaced first for a profiled shopper. For an agent-mediated purchase, ranking manipulation and price manipulation converge into the same attack. The agent reads a shortlist. If the shortlist is personalized by the seller, the “choice” the agent presents is pre-priced before any label applies.

That is why the durable answer to personalization is not only price transparency. It is an independent product layer that no seller authors and no pricing engine tailors. GoBuy’s approach is built on exactly this principle: reviews are filtered for authenticity before anything is scored, the Smart Score from 0 to 100 is computed on the quality of surviving evidence rather than volume, the shortlist presented is the top seven verified products in a category, the same seven for every caller, and the GoBuy Verified badge requires a product to hold 80 or above for 90 days, a durability no campaign week can purchase. Delivered over MCP at gobuy.ai/api/mcp, those signals give an agent a substrate the merchant did not personalize, cannot overwrite, and cannot outbid. The one part of the shopping journey the pricing engine cannot touch is the part computed independently.

What to watch

Four signals over the next quarter:

  1. Final adoption. Whether the statement survives comment period intact, and whether the Commission’s first enforcement action targets a household-name retailer or an intermediary.
  2. Maryland’s October 1 effective date. The first outright prohibition goes live within weeks. Watch for preemption fights and rushed compliance rewrites in grocery and delivery.
  3. Machine-readable disclosure. Whether any major platform or protocol (MCP, agentic checkout rails) proposes a structured personalization-disclosure format before a regulator mandates one.
  4. The first agent-priced purchase. The first documented case of a merchant pricing against an identified shopping agent rather than a browser will define this decade’s version of the mouse-movement finding.

Personalized pricing is, at bottom, a wager that the seller knows more about you than you know about the seller. The FTC is four days from formalizing the disclosure rules that wager never wanted. The shopper’s best defense, human or silicon, is an evaluation layer that answers to neither the price nor the shelf. Check what you are about to buy, or about to let an agent buy, at gobuy.ai. And if you build agents, give them evidence the pricing engines cannot personalize: gobuy.ai/agent-docs.