Surveillance-Pricing Bans, Agentic Commerce, and the Laws That Refuse to Name the Technology

Surveillance-Pricing Bans, Agentic Commerce, and the Laws That Refuse to Name the Technology

Every report on the pricing bans that swept state legislatures this year tells the same story: America is outlawing AI pricing. The story is only half true. Today, three states govern the use of personalized pricing in statute — Maryland, Connecticut, and New York — and if you read the laws themselves, the word "AI" barely appears. "Agent" never appears at all.

That omission is not a drafting failure. It is the point of the legislation, and it is the part worth understanding before the machines these laws were apparently not written for show up in volume.

Start with the vocabulary, because the category is doing all the analytical work. "Surveillance pricing" means using data about a specific person — browsing history, purchase history, real-time location, income, even inferred household size — to set that person a different price than the next shopper sees. It is distinct from dynamic pricing, which moves with supply, demand, and cost like a surge or a hotel rate. Surge pricing adjusts to the market. Surveillance pricing adjusts to you. The three states drew the line between those two, and they drew it without naming the technology that makes the second one cheap to do.

That avoidance is the clever bit. A law that said "artificial intelligence may not set prices" would have handed every future defendant the easiest possible defense — we don't use AI, our software is not an agent, our model is just an optimization script. It would also draft the statute into obsolescence in a couple of product cycles, because the machinery doing the pricing keeps changing shape. The New York text comes the closest to naming a machine — it mentions algorithms — but even that is a description of mechanism, not a definition of who operates it. So the drafters banned the relationship instead: personal data in, individual price out. Regulate the mechanism and you catch whatever does the pricing — and, pointedly, the human pricing manager doing it by hand is caught too.

What the three states actually did

The laws are siblings, not twins. Maryland went first in April, with a flat ban that takes effect October 1: food retailers above 15,000 square feet and the delivery platforms can no longer use personal data to charge individual shoppers more for groceries, enforced by the attorney general with penalties up to $10,000 per offense and $25,000 for repeats. Connecticut signed its version in June, effective July 2027, and added a quiet exception that tells you how legislators think about this problem: businesses outside the core prohibition may keep personalizing as long as the price basically confesses, with the required disclosure reading "THIS PRICE WAS INCREASED USING YOUR PERSONAL DATA." And New York passed the One Fair Price Act in June, making it the third state to put a surveillance-pricing ban on the books, still sitting on the governor's desk — a move from a disclosure regime to an outright ban on collecting, using, or sharing personal data to generate individual prices, with penalties of $5,000 and then $20,000 a violation or the profits from the practice, whichever is larger.

That progression from disclosure to prohibition is how consumer regulators escalate when labels don't change behavior — worth remembering, because it is the same sequence we keep seeing in financial rules. The push itself came from a familiar constituency battle: state attorneys general and consumer groups against retailers, delivery platforms, and the data brokers in between.

Written for shoppers, not agents

The part that keeps pulling me back to these laws is timing. They were drafted for a shopper with a browser, a budget, and a pair of eyeballs. The most efficient price-personalizers entering the market have none of those. Agentic commerce — software that tracks listings, monitors prices, and executes purchases on a person's behalf — is the sector every payment network is now building for; Visa was projecting that 2025 would be the last year consumers shopped and checked out alone. The states are regulating the top layer of machine commerce just as the machines arrive, which means their categories are about to be tested on actors they never named.

The mismatch is concrete. When the shopper is an agent told to find the best deal, what counts as "personal data"? The agent is carrying the human's budget proxy, preferences, and inferred willingness to pay — precisely the fuel the pricing bans say may not be used. Whose consent governs, the human's standing instruction or the agent's moment-to-moment decision? Who is the "consumer" with standing to dispute the price? Regulators one layer down are already dealing with this: consumer-payment protections have no framework for agent-authorized transactions or machine-initiated disputes, and the payments bar has begun asking the bluntest version of the question — who clicked buy?

There is another approach, and it is worth holding the two side by side. The UK's competition regulator decided not to write new agent law at all; it asserts consumer-protection law applies to AI agents exactly as it does to human actors, so businesses are responsible for outcomes shaped by their algorithms, and it worries publicly about "agentic collusion" — algorithms coordinating on price in concentrated markets. Two jurisdictions, two ways to avoid defining what an AI is: the states ban the conduct, the UK extends old obligations to the new actor. Neither names the machine. Both leave the real enforcement calls to whoever runs the regulator.

I don't want to oversell the movement, and it is under real pressure from both directions. Colorado's governor vetoed his state's version as too broad, and California's bills died in its appropriations process. Critics of the state-by-state patchwork — more than fifty pricing bills across twenty-four legislatures last year by one count — argue the laws reach into legitimate supply-and-demand pricing and that the right tools for algorithmic collusion already sit in federal antitrust authority. The states that did pass laws answer in their carve-outs: loyalty discounts, real promotions, cost-based variation, and data shared with genuine opt-in consent all survive. The dividing line, in other words, is not "no personalized prices." It is "prices may move with the market, but not with you." All of this is being written even as the federal government threatens to withhold broadband funding from states with "onerous" AI laws — a preemption cloud that keeps the whole state project provisional.

The rails underneath

Pricing is only the top layer of machine commerce being legislated, and this is where the story stops being a retail footnote. The next fights are about consent and, one layer down, the rails on which a machine's payment settles. If an agent cannot be priced individually, the next questions are whether it can meaningfully consent and who is liable when it acts — and the instinct to regulate the relationship rather than the technology will govern the payment layer too. That is relevant beyond state consumer law, because machine-to-machine payments are exactly the frontier toward which programmable, stablecoin-denominated money has been drifting. A rule shaped around the bond between a person and the software acting for them, rather than around the software itself, is a template that decides who wins at the checkout and who wins inside the settlement layer.

Watch two things: whether New York's governor signs the One Fair Price Act before the year is out, and — the more interesting test — what happens the first time an agent-initiated purchase meets a state's definition of "personal data" in court. Every law written for a human shopper eventually meets a machine. That is when we find out whether "regulate the relationship, not the technology" was a clever dodge or the only sane way to write rules for systems that keep reinventing themselves. I suspect it is both: the writing method is sound, and the enforcement era is about to begin.