BILL NUMBER: S8623
SPONSOR: MAY
 
TITLE OF BILL:
An act to amend the general business law, in relation to prohibiting the
use of algorithmically set prices and requires the disclosure of auto-
mated pricing systems
 
PURPOSE OR GENERAL IDEA OF BILL:
To protect consumers from discriminatory, opaque, and exploitative pric-
ing practices driven by algorithmic systems that rely on personal data.
The bill prohibits personalized algorithmic pricing, restricts surveil-
lance-based pricing practices, requires clear disclosure when automated
pricing systems are used, and establishes strong enforcement mechanisms,
including a private right of action.
 
SUMMARY OF PROVISIONS:
Section one amends section 349-a of the general business law to estab-
lish clear definitions for key terms, including algorithm, consumer,
personal data, dynamic pricing, personalized algorithmic pricing, and
automated pricing systems. The section prohibits the use of personalized
algorithmic pricing that relies on consumers' personal data and
restricts the collection, use, retention, or disclosure of personal data
for surveillance-based pricing purposes. Entities that use automated
pricing systems must clearly and conspicuously disclose that such
systems are in use and identify the categories of non-personal data
inputs that influence pricing decisions.
The section includes limited and specific exceptions, including for
regulated industries, subscription-based discounts, uniform promotions,
non-personal dynamic pricing, compliant loyalty programs, prices author-
ized by law, and bona fide group-based discounts. It authorizes enforce-
ment by the Attorney General, provides for civil penalties, restitution,
and injunctive relief, and establishes a private right of action for
aggrieved consumers, including statutory damages, actual damages, and
attorneys' fees. The section further clarifies that its remedies do not
limit other rights or liabilities under law.
Section two provides that the act shall take effect one hundred eighty
days after it becomes law and authorizes the adoption of any necessary
rules or regulations prior to the effective date.
 
JUSTIFICATION:
As pricing algorithms become increasingly sophisticated, many companies
now use personal data such as browsing history, geolocation, purchase
behavior, and online activity to set individualized prices. This prac-
tice, often referred to as personalized algorithmic pricing or surveil-
lance pricing, allows businesses to charge different consumers different
prices for the same good or service based on personal characteristics
rather than market conditions.
These practices typically occur without meaningful consumer awareness or
consent, resulting in hidden discrimination, economic harm, erosion of
consumer trust, and invasive data practices. A recent Consumer Reports
study released this week found that Instacart's AI-enabled pricing prac-
tices inflated grocery bills by as much as twenty-three percent. In
early 2025, the Federal Trade Commission released a report detailing how
companies use personal data, including location and browser history, to
set individualized prices, confirming that consumers may be charged
different prices for the same product based on such data. Over the past
decade, companies including Staples and The Princeton Review were found
to vary prices by zip code, with patterns raising concerns about racial
and ethnic discrimination.
New York consumers are entitled to transparent and fair pricing. By
prohibiting the use of personal data for individualized pricing and
requiring disclosure when automated pricing systems are used, this bill
restores consumer autonomy, promotes fairness, and prevents exploitative
data-driven pricing practices.
 
PRIOR LEGISLATIVE HISTORY:
Section 349-a of the general business law was originally enacted in Part
X of Chapter 58 of the Laws of 2023. This bill strengthens and clarifies
that framework by closing loopholes, expanding consumer protections, and
enhancing enforcement tools.
 
FISCAL IMPLICATIONS:
Minimal. Any enforcement costs incurred by the state may be partially
offset by civil penalties, which are directed toward consumer protection
and data privacy enforcement.
 
EFFECTIVE DATE:
This act shall take effect on the one hundred eightieth day after it
shall have become a law.

Statutes affected:
S8623: 349-a general business law