California Takes Aim at Surveillance Pricing: 4 Steps for Data-Driven Businesses to Prepare

On Data Privacy Day, California Attorney General Rob Bonta announced a new investigative probe focused on businesses that use consumer data to set individualized prices, a practice commonly referred to as “surveillance pricing.” As part of this initiative, California officials are sending letters to businesses seeking detailed information about how they use consumers’ shopping and browsing history, location data, demographic information, and inferred characteristics to determine pricing. The inquiry targets companies in retail, grocery, and hotel industries and focuses on data-driven pricing practices under California law. Here’s everything you need to know about this new enforcement sweep and four steps to prepare your business.

What Information is Being Targeted?

The California AG’s sweep, which was announced on January 28, is part of a growing regulatory focus on how data analytics and AI-driven pricing models intersect with consumer privacy laws – and potentially run afoul of the law’s “purpose limitation” requirements. Those rules limit businesses to only use visitor data for purposes compatible with the context in which the personal data was collected. For example, a person buying a physical good online would expect their name and address to be used and disclosed to a third-party shipping company for the delivery of their purchase. But, if the context of use is not compatible, then a company must obtain consent for using that data.

With that framework, the DOJ is seeking information on:

• Use of consumer personal information to set prices
• Policies and public disclosures related to personalized pricing
• Pricing experiments undertaken by companies
• Measures taken to comply with algorithmic pricing, competition, and civil rights laws

While the requests for information address CCPA concerns, the AG also appears to have broader concerns regarding effects on competition and civil rights laws – signaling that investigations may be broader than the CCPA.

National Effects        

While this sweep is limited to California, the vast majority of consumer privacy laws have a similar purpose or processing limitations. As such, this regulatory sweep could be just the tip of the iceberg if other state Attorneys General follow suit with their own investigations.

Aside from the privacy implications, a number of states (including California) regulate the use of automated decision-making technology or profiling based on the automated processing of personal information. While California regulators have chosen to focus on the purpose limitation angle, surveillance pricing also raises issues regarding the right to opt-out of profiling, which implicates businesses in several states with consumer privacy laws.

Your 4 Next Steps

The latest sweep sends a clear signal that businesses utilizing personal information to influence pricing must ensure transparency, fairness, and adherence to the CCPA, as well as other consumer privacy laws. In the midst of this enforcement push, businesses that profile consumers to adjust services or prices offered should:

1. Know What State Consumer Privacy Laws You Need to Comply With. Currently, around 20 states have their own consumer privacy laws, and not all have the same rights or apply them the same way. A key starting point is identifying what jurisdictions your business is in to determine what laws you may be covered by.

2. Evaluate Whether Your Business Practices Align with Consumers’ Reasonable Expectations. Even if your company discloses that it utilizes individualized pricing or other profiling tools, it must ensure that the disclosure is compatible with the context in which the personal information was collected. While the CCPA regulations do not have a bright line test and view this as a balance of various factors, at its heart is the question: “What would a consumer expect a business to collect in this interaction and how would the consumer expect the business to use the data given the purpose of the interaction?” While disclosures are one factor in setting consumer expectations, they are not the only factor to consider.

3. Ensure Your Business Offers and Honors the Appropriate Consumer Rights. Your business needs to ensure that it identifies the appropriate consumer rights (generally, an opt-out of profiling or an opt-out of automated decision-making) and has processes in place to operationalize that right.

4. Consider a State-Specific Response. While some states have purpose limitations and rights relating to using AI to profile consumers, not all do. In light of the evolving regulatory landscape, businesses should consider whether they want to align their practices to the most stringent state or take a more nuanced approach depending on the state.

Conclusion

We will continue to monitor developments in this area and provide updates as warranted, so make sure you are subscribed to Fisher Phillips’ Insight System to get the most up-to-date information directly to your inbox. If you have questions, please contact your Fisher Phillips attorney, the authors of this Insight, or any member of our Privacy and Cyber Practice Group or Consumer Privacy Team.