Retail's Next Privacy Fight Is Over The Price Tag

Retailers can now set the price of a product using the data they hold on the individual shopper viewing it. Browsing history, location, and past purchases feed an estimate of what that person is willing to spend, and two shoppers can open the same product page and see two different prices. The FTC calls this personalized pricing, and it has proposed an enforcement policy statement saying that using personal data to set prices without disclosing it could violate the FTC Act.

Some states have moved faster than the FTC. Connecticut has passed a law restricting what any retailer can do with shopper data at the price tag, and Maryland and New Jersey have passed narrower versions covering food retailers and grocery delivery. None of these laws restrict personalized messages, as those are what customers expect in return for their data. The restrictions apply when the same data sets the price a person pays.

When price gets personal

Consumers were suspicious about pricing well before lawmakers took it up. Khalid El Khatib, Chief Audience Officer at Consumer Reports, built the nonprofit's recent brand campaign around the findings of its own investigations, and grocery pricing was one of them. "Is this peanut butter more expensive than it was last week?" says El Khatib. "Which speaks to the investigations that we did into major grocery stores and how they change pricing based on demographic data and other insights, which is quite predatory."

The distrust reaches past pricing to the technology behind it. Chan Suh, Chief Digital Officer at Prophet, compares two rounds of the firm's consumer research, from 2024 and this year, on how far people trust brands to use AI ethically. Gen Z consumers in particular tell him they doubt an algorithm aimed at them is working in their interest. "Those brands using AI ethically, all of those measures have gone down significantly," says Suh. "Because what they are seeing in evidence in the market is not what was promised."

The value exchange behind the data

Personalized messaging runs on first-party data, the details customers volunteer about themselves. How a brand asks for those details decides how many it gets. Carla J. Donahue, Sr. Director of Lifecycle at WITHIN, works with brands on their email and SMS programs. "The biggest trend that we're seeing success with our clients is progressive profiling," says Donahue. "It's weird to ask a customer to give you all their information immediately. What we like to do is progressive profiling, where after we've started to build a relationship with the brand and the customer is a little more familiar, we start to ask smaller questions along the way."

Donahue's team uses that approach with a pet brand client, asking how old a customer's dog is and then recommending food for aging joints. A question like that one explains itself, which is what makes a customer willing to answer. Rohit Prabhakar, Global Head of Digital Experiences and Capabilities at Visa, designs that permission into the system itself. The personalization architecture he describes runs on five agents, one of which handles ethics and sets limits on what can be personalized at all. "A relationship with any brand is always based on trust," Prabhakar notes. "There may be very few brands that you still like to receive a text or email from, and you do not unsubscribe. Somewhere they took your consent and made you feel comfortable that they respect my privacy. Trust is earned over time."

Even with consent in hand, the same message can land differently from one customer to the next. Caitlin Berzok, SVP, Digital at Therabody, has seen how quickly personalization can go wrong at a brand. "There's always a creepiness factor with how personalized something is," Berzok explains. "People want you to know them, but then they don't want you to know them. So there's a line that you have to respect of how much the consumer is going to invite you into their space."

Guardrails on the offer

The new state laws leave room for the offers most retail marketers run, like exempting discounts, promotions, and loyalty programs where a customer understands what they're getting and why. Beyond what the laws require, brands still have to decide how to handle the sensitive information they hold about their customers. Andrea Brimmer, Chief Marketing and PR Officer at Ally, turned down a message built on exactly that kind of detail. "We have data that would tell us when one of our customers got divorced," says Brimmer. "The team said, well, we could do a 'hey, we know that you just got divorced, here are some things you should be thinking about.' I said, bridge too far. It's sensitive, and people don't want that in their face."

Brimmer argues that a human belongs in the middle of decisions like that one, particularly as AI takes on more of the messaging. Donahue uses a plainer standard for how far her team lets AI go. "We always say AI helps us be a butler where we're available and ready to help. But we never want to use it to be a stalker where we're creeping you out."

A misjudged message costs a brand more than an unsubscribe. A customer who decides a brand knows too much stops handing over the preferences, sizes, and birthdays that make the next message useful. A price that looks personal carries the same risk, including in the states where no law covers it yet. "One hyper personalized experience that makes the user feel, 'oh, they know too much about me, I never wanted them to know this about me,'" Prabhakar concludes. "Boom. You lose the trust and you lose the customer."