Compliance research

Practice page. Legislative position current to 16 September 2026.

We read regulation from the enacted statutory text, tie every operative claim to its source, grade our own confidence in it, and then go and measure what companies actually display in the field. The current subject is algorithmic and personalized pricing.

The subject

In fourteen months, four states went from zero to four distinct algorithmic and personalized pricing regimes. They are not variations on one model. Three mandate a consumer disclosure, and all three mandated strings are different — a national retailer cannot satisfy them with one banner. Three of the four contain outright prohibitions rather than, or alongside, a disclosure duty, which means that in the covered sectors displaying the banner is not compliance; it is an admission.

New York

General Business Law § 349-a. Mandates a fixed disclosure: THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA on, at or near every display of an affected price. Enforcement is Attorney General only, with no private right of action, and cure is available before penalty. In force since 10 November 2025

Maryland

A different mandated string — THIS PRICE WAS SET BY AN ALGORITHM OR BY USING YOUR PERSONAL DATA — and, separately, an outright prohibition reaching large food retailers and food delivery. Effective 1 October 2026

Connecticut

A third string — THIS PRICE WAS INCREASED USING YOUR PERSONAL DATA — and the only one of the three that also permits a substantially similar disclosure rather than fixed words. It does not merely reword the others: it asserts the price was increased, and names no mechanism at all. A prohibition applies to retail sellers of tangible goods. Effective 1 July 2027

New Jersey

A prohibition covering groceries, with no disclosure path at all. A covered seller cannot cure by adding a banner, because the statute offers no banner to add.

Above the states sits a federal layer: the Federal Trade Commission issued a proposed enforcement policy statement on surveillance pricing on 19 August 2026. And the only appellate test of the New York provision has been fully briefed since 24 February 2026 with no ruling and no recorded argument as of our last review. Much of this area is therefore untested — no court has construed the Maryland, Connecticut or New Jersey provisions at all.

Why this needs monitoring, not a memo

Connecticut is the argument, and we would rather show it than assert it.

The legislature enacted its algorithmic-pricing section on 27 May 2026. It then repealed and replaced it twice inside eight days — P.A. 26-64 § 11 was repealed by P.A. 26-100 § 66 and replaced by that act's § 44, which was itself repealed by P.A. 26-130 § 19 and replaced by P.A. 26-130 § 11. Three consequences follow, and each one breaks something a reader would otherwise have believed:

• The operative date moved from 1 October 2026 to 1 July 2027. Anyone still briefing an October double deadline for Maryland and Connecticut is briefing a repealed act.
• The mandated words changed. The earlier text turned on a defined term, "price setting device." That defined term no longer exists in Connecticut law — yet it is still quoted in client alerts published after it was repealed.
• The trigger, the exemptions and a market-price exception all moved with it.

A one-time memo was wrong within a week and did not know it. That is what a monitoring engagement is for.

Method

The discipline is the product. A brief nobody can check is worth nothing to a firm that has to put its name on the advice built from it.

• Enacted text, not summaries. Operative language is read from the act as passed, and cited to the act — including the public-act PDF where a codified version lags.
• Sourcing separated by kind. A dedicated section marks which claims rest on a primary source, which on secondary reporting, and which on our own inference. An unmarked inference is treated as a defect.
• Confidence graded per claim. Every substantive assertion carries a confidence level and the basis for it, including the ones where the honest grade is low.
• Corrections recorded, not quietly fixed. When a refresh contradicts an earlier draft, the brief says so at the top, names what was wrong, and cites what replaced it. The current edition carries two such corrections.
• Negative findings reported. Where the evidence does not support a claim that would help us commercially, the brief says the evidence does not support it.

Field verification

Statutory analysis tells you what is required. It does not tell you what is happening. So we also look for the mandated language in live commerce and record what is there — and, just as important, what we could not reach.

Our sweep of August 2026, re-checked in September: the New York disclosure is real and appearing in the wild, but the category we could confirm is digital-subscription publishing rather than general retail, and its main habitat is renewal email rather than the product page. We did not find the mandated language on any general retail, travel or ticketing page we were able to retrieve. One grocery-delivery platform's attempt was found inadequate by the New York Attorney General in a January 2026 letter. We found no compliance-vendor ecosystem behind any of it — every implementation we saw was written by hand.

These are dated observations, not a census. The brief states the method, the sample, and what the sample cannot support.

Compliance monitoring

We take this on as an engagement, scoped and priced in writing. It is not a subscription to a platform, and we would rather say so than imply infrastructure we have not built. An engagement is made up of:

• Repeat observation of properties you name, on a cadence we agree, rather than a single look.
• Evidence capture — what was displayed, on which page, at what time, retained so the observation can be re-examined later rather than taken on trust.
• Statutory change watch — the four enacted regimes read against their public-act sources, so you hear it when the text you relied on moves. As Connecticut shows, it moves mid-session, repeatedly, and faster than secondary coverage tracks it.
• A written record that states its own method, sample and limits, including what could not be reached, so that anything built on it can be defended.

Observation of a client's own properties is done with that client's authorization. That is partly a matter of conduct and partly a matter of quality: invited access reaches the logged-in and geolocated contexts where a personalized price actually renders, and an anonymous crawler never will.

To be explicit about the division of labour: we supply observation and evidence. We do not supply, and will not supply, an opinion on whether a client complies. That is the firm's work.

Limits

Stated up front, because a research practice that oversells is worse than none — you would be making real decisions on what it implies.

• We are not lawyers and this is not legal advice. We do not opine on any business's compliance position.
• Coverage is the four enacted state regimes plus the federal layer. It is not a fifty-state survey, and we will say so rather than extrapolate.
• Three of the four provisions have never been construed by any court, and the only appellate test of the fourth is pending and undecided. Much of the analysis is therefore about untested language, and the brief marks where that is true.
• A field sweep proves what was observed on the properties we looked at, on the dates we looked. It does not prove an industry-wide rate, and we do not report one as if it did.
• Legislative facts have a shelf life. Every edition is dated, and the parts of it that were not re-verified in a given refresh are marked as not re-verified.

Requesting the brief

The current edition of Algorithmic and Personalized Pricing: A Four-State Compliance Brief — the four regimes side by side, the federal layer, the California enforcement theory, the sourcing and confidence tables, and the correction record — is available on request to law firms, in-house legal and compliance teams, and press.

Email Jason Luker at jason@nullecho.org and say who you are. There is no form, no download gate, no mailing list and no tracking; he reads it and replies with the document.