FTC orders nine firms to explain personal-data pricing as state bans add legal risk

The FTC wants nine companies to show how personal data sets prices and driver pay. New York's governor has until the end of 2026 to sign a state ban.

Nine companies selling flights, rides, food delivery and groceries have 45 days to show the FTC how personal data sets their prices. Ride and delivery platforms must also explain how they set pay for drivers and couriers.

The orders are a study, not a case, so the legal risk for the nine sits elsewhere. The FTC plans to publish a study of the answers, Reuters reported. The risk lies in an August draft policy statement on disclosure and in state law.

The questionnaire provides a way to test disclosures. Specifications 7 and 22 together let the FTC set what each company tells customers beside the inputs it actually uses. Under the August draft, undisclosed use could violate the FTC Act.

Who received the orders

The Commission issued the orders on 28 October under Section 6(b) of the FTC Act, according to the FTC. The recipients are Delta, United, JetBlue, Lyft, Uber, DoorDash, Instacart, Target and Walmart. The vote was 2-0.

Section 6(b) covers what the release calls "wide-ranging studies that do not have a specific law enforcement purpose". If a company fails to answer, the Commission "has the power to compel compliance in federal court".

Chairman Andrew Ferguson said: "We intend to scrutinize the opaque methodology that some companies in these industries may be using to determine how much consumers pay or how much gig workers are paid for the same product or service". He added: "Consumers deserve to know whether companies use their web surfing habits or other personal data to estimate the highest price they can charge each consumer."

What the FTC wants to know

The questionnaire shows what the FTC wants to test. Specification 7 asks each company to describe every method that uses personal information to set a price. For each price component it asks for every input and whether that input varies by individual customer. Reuters reports the data types include location, browsing history and income.

Specification 9 asks for sales and revenue by year, and for the sales and revenue in which each pricing method was used. That lets the FTC measure how much of a company's business runs on pricing on personal data.

Specification 21 asks whether pricing on personal data lets more people buy. It also asks whether the pricing raises or lowers what they pay, and for any statistical link between the two. Specification 20 asks for every A/B test and internal study of pricing, offers and pay since 1 January 2021. Tests that were paused or stopped must be listed with the reason.

Specification 22 asks for the exact wording, location and date of every disclosure to a customer or driver. Specification 23 asks for a copy of each version, including pop-up windows and mouseovers.

The reach is wide. The period covered runs from 1 January 2023 to the day of full compliance. A company official must swear to the report. Within 14 days of service, each company must tell FTC staff whether it holds all the required information. If it does not, it must say what is missing and who holds it.

Confidential material is reported in aggregate or anonymously. The FTC gives ten days' notice before releasing an individual submission marked confidential.

Driver and courier pay

Pay is a second track. The release says ride sharing and food delivery firms "may pay their workers shifting compensation offers based on opaque formulas". It adds that they "may engage in personalized compensation based on their drivers' personal data, such as their phone usage or acceptance history for past offers".

The FTC has gone after businesses that deceive workers with false earnings claims, through its Labor Task Force, the release notes. The orders ask each company "to document the inputs, tools and procedures used to adjust or set compensation and pricing".

Two specifications target the platforms directly. Specification 11 asks which workers are offered which jobs, and in what order. Specification 14(d) asks what share of each customer price the company keeps and what share goes to the worker. Reuters notes studies suggesting platforms learn how much pay a driver will accept for the same work.

The draft policy and state bans

The disclosure test comes from the 19 August draft policy statement. It defines personalised pricing as using personal data to set a price at what the company believes that person will pay.

The draft is a proposal. The FTC release says it notes that undisclosed collection or use of personal data for personalised pricing could violate the FTC Act. Retailers that represent or imply a price is static when it varies by individual risk misleading customers.

Hundreds of commenters on the draft urged the FTC to ban the practice outright, but Ferguson drew the limit himself. "The FTC does not have the legal authority to ban personalized pricing in all circumstances," he said, "but businesses that fail to tell consumers how their personal data is being used to set a price may be in violation of the FTC Act and other laws we enforce."

State law is moving further than the FTC can. Maryland and Connecticut have passed prohibitions, and New York would be the third state, according to Reuters. Its legislature passed the One Fair Price Act on 4 June.

The New York bill would bar prices set from data traceable to a person or device. Examples are browsing history, income and real-time location. Discounts for seniors, teachers and loyalty programmes would stay legal. Companies would also have to disclose algorithmic dynamic pricing.

It would replace a law Governor Kathy Hochul signed last year. That law requires a disclaimer when an algorithm uses personal data to set prices. Her spokesperson said she is reviewing the bill. She has until the end of the year to act.

Retailers are fighting those laws. The National Retail Federation has criticised them and defended data driven discounts as a way to reward loyalty. The FTC acted a week before the US congressional elections. Voters rank the cost of living as their top issue, Reuters reports.

Three of the nine have already rejected the premise. Delta, JetBlue and Instacart told Reuters they do not engage in personalised pricing. Instacart ended random price experiments after a Consumer Reports study and FTC scrutiny.

The FTC is also correcting its own record. Its mid 2024 study of personalised pricing "examined only middlemen consultancies rather than the businesses that actually set prices". The new release states: "This study corrects the Commission's mistaken 2024 approach". This time the questions go to the companies that set the numbers.

The deadlines

Two company deadlines come first. Each company must tell FTC staff by about 11 November whether it holds all the data. Sworn reports fall due from about 12 December, 45 days after the 28 October orders. Governor Hochul then has until the end of 2026 to act on the One Fair Price Act. If she signs, New York joins Maryland and Connecticut in banning prices set from personal data.