Personalized Pricing and Your Customer Data

What the FTC’s August 2026 policy signal means for SMBs that quietly personalize checkout, quotes, and membership pricing

SECURITY MEDIC Personalized Pricing and Your Customer Data

James Venuto Security Medic Consulting, LLC - AI Cyber Security and Privacy · September 21, 2026

Scroll to explore

If you run ecommerce, booking, membership, SaaS, or professional-services quoting for Hudson Valley and New York customers — and you ever vary a price based on browsing history, loyalty score, geography, or a “customer profile” — the FTC’s August 2026 personalized pricing comment process is aimed squarely at your disclosure hygiene, not only at household-name retailers.

On August 19, 2026 (updated August 31), the Commission sought comment on an enforcement policy statement regarding personalized pricing: using personal data to set individual prices. Separately, on August 27, it finalized orders against Cox Media Group and two other firms over deceptive “Active Listening” AI marketing claims. Together, those actions say something simple: tell people clearly when and how their data changes the price — and do not let marketing partners overclaim surveillance capabilities you do not have.

Part I

The SMB trigger hiding in plain sight

Most small and mid-sized businesses I work with do not think of themselves as “running personalized pricing programs.” They think of loyalty discounts, dynamic quote tools, abandoned-cart offers, or a membership portal that “knows” the customer. Underwriters and customers experience that as a price that somehow differs from the one a friend sees on the same product.

That is exactly the fact pattern the FTC’s personalized pricing policy comment is probing: when personal data informs an individual price, failing to clearly disclose that prices are personalized, the basis for the personalization, and the data used can violate the FTC Act.1 The comment window was extended into late September 2026 — which means this is still a live policy conversation, not a dusty advisory.

You do not need a data-science team to be in scope. A third-party marketing platform, booking engine, or revenue-management plug-in that scores customers and adjusts offers is enough. If the customer cannot tell that their data moved the number, you have a transparency problem — and transparency problems are how consumer-protection cases start.

Part II

What the FTC is actually asking for

Read the August 19 press release carefully. The Commission is not banning personalized pricing. It is clarifying how the FTC Act’s prohibition on unfair or deceptive acts applies when sellers use personal information to set individualized prices.1 The practical ask for operators is disclosure that a reasonable consumer can find and understand — not a buried clause in a 40-page privacy policy.

If price can vary by profile, cookie, loyalty score, or purchase history, your checkout or quote flow should say so in plain language — before the customer pays, not in a footer after the fact.

Trade-press summaries of the comment extension emphasize the same point for stakeholders across retail, travel, and digital services: expect scrutiny of whether consumers know personalization is happening and what data feeds it.5 For SMBs, that translates into three checklist items I walk clients through:

Surface the fact of personalization near the price itself (checkout, quote PDF, membership renewal screen).
Name the categories of data that can affect price (browsing, purchase history, location inferences, loyalty tier) without inventing jargon.
Align vendor contracts so marketing and pricing partners cannot claim capabilities — voice “listening,” always-on device surveillance, or similar — that you neither authorize nor perform.

Part III

Active Listening settlements: marketing claims are privacy claims

On August 27, 2026, the FTC finalized orders settling charges that Cox Media Group and two other firms deceived customers about “Active Listening” AI marketing products — claims that suggested far-reaching ambient listening capabilities that did not match reality.2 Why does that matter for a dental office, manufacturer, or insurance agency in the Hudson Valley?

Because many SMBs buy marketing stacks on vendor demos. If a partner’s pitch implies they can “hear” intent from devices or harvest signals you never disclosed to customers, you inherit the deception risk when you repeat those claims on your site, in sales decks, or to cyber insurers. The settlements are a reminder: advertising about data practices is itself a privacy control. Treat marketing copy as an extension of your privacy notice.

This week’s practical move is boring and effective. Pull every vendor one-pager that mentions AI listening, behavioral targeting, or “intent signals.” Compare it to your public privacy notice and to what your team actually configures. If the sales language outruns the product, rewrite the language — or exit the vendor.

Part IV

California-touching SMBs: CPPA is already on the calendar

Even if you are a New York business, selling into California can pull you into CPPA’s updated CCPA program: cybersecurity audits, risk assessments, and automated decision-making technology (ADMT) rules that took effect January 1, 2026.3 Personalized pricing often sits next to ADMT — automated scoring that affects a consumer’s experience of an offer. If your tools make consequential pricing or eligibility decisions with California consumer data, put ADMT notice, opt-out, and access rights on your 2026–2027 privacy program calendar rather than treating them as “next year’s problem.”

Sensitive-data governance remains a federal enforcement theme as well. The FTC’s 2026 Kochava consent order on sensitive location data is still a useful blueprint for how the Commission thinks about secondary use of intimate data — but it is supporting context here, not the headline of this post.4 Personalized pricing is the near-term disclosure issue; sensitive-data minimization is the longer program discipline.

Part V

One concrete action this week

Walk your checkout, quote, or membership renewal flow as a customer — phone and desktop. Ask three questions out loud:

Can two similar customers see different prices for the same offer?
If yes, does the page say that personalization (or loyalty / profile-based pricing) is in play?
Does any marketing partner claim “listening” or similar powers you cannot defend?

If the answers are yes / no / maybe, draft one clear disclosure sentence this week and schedule a vendor-contract review for the next two. That is enough to move from “we hope we’re fine” to “we can explain our practice to a regulator, an insurer, or a curious customer.”

Soft next step: if you want a second set of eyes on privacy notices, vendor claims, and California-touching ADMT readiness, Privacy Medic is built for exactly that work — practical privacy program help for SMBs, not a checklist factory. Visit privacymedic.com.

References

1.Federal Trade Commission, “FTC Seeks Comment on Enforcement Policy Statement Regarding Personalized Pricing,” press release, August 19, 2026 (updated August 31, 2026), accessed September 21, 2026, https://www.ftc.gov/news-events/news/press-releases/2026/08/ftc-seeks-comment-enforcement-policy-statement-regarding-personalized-pricing

2.Federal Trade Commission, “FTC Finalizes Orders with Cox Media Group and Two Other Firms Settling Charges They Deceived Customers about ‘Active Listening’ Marketing,” press release, August 27, 2026, accessed September 21, 2026, https://www.ftc.gov/news-events/news/press-releases/2026/08/ftc-finalizes-orders-cox-media-group-two-other-firms-settling-charges-they-deceived-customers-about

3.California Privacy Protection Agency, “CCPA / CPPA Updates: Cybersecurity Audits, Risk Assessments, and ADMT,” effective January 1, 2026, accessed September 21, 2026, https://privacy.ca.gov/laws-and-regulations/ccpa-cyber-risk-admt-insurance/

4.Federal Trade Commission, “FTC Bans Kochava and Subsidiary from Selling Sensitive Location Data; Settles Charges They Sold Location Data,” press release, May 2026, accessed September 21, 2026, https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-ban-kochava-subsidiary-selling-sensitive-location-data-settle-charges-they-sold-location-data

5.Arnold & Porter, “All Eyes on Personalized Pricing: What Stakeholders Need to Know,” advisory, September 2026, accessed September 21, 2026, https://www.arnoldporter.com/en/perspectives/advisories/2026/09/all-eyes-on-personalized-pricing-what-stakeholders-need-to-know

SECURITY MEDIC

James Venuto | Security Medic Consulting, LLC - AI Cyber Security and Privacy | Hudson Valley, NY