Maryland Predatory Pricing Act Limits Surveillance Food Pricing

A new rule in Maryland is drawing attention to a practice most shoppers never see: setting prices based on what a business knows about you. According to a Lexology Pro roundup of data protection updates covering 28 September to 9 October, Maryland's Predatory Pricing Act takes effect and restricts surveillance food pricing. The same roundup notes that Croatia's data protection authority issued a US$2.9 million GDPR fine and that Malaysia is consulting on an AI privacy framework. This post looks at the Maryland surveillance pricing law, why it matters for privacy, and what readers can reasonably do about it.

The source is a short summary, so this article sticks to what it states and avoids guessing at details of the law that it does not cover.

What the Maryland surveillance pricing law changes for food shoppers

Per the Lexology Pro summary, Maryland's Predatory Pricing Act has taken effect and restricts surveillance pricing in the food sector. In broad terms, surveillance pricing means using information collected about an individual to influence the price that person is shown or charged.

The summary does not spell out the law's scope, exemptions, or how it will be enforced. Readers who want those specifics should consult the text of the law itself or guidance from legal professionals, rather than relying on a short news digest. What the summary does make clear is the direction of travel: a US state is now placing limits on how personal data can be used in food pricing.

How personal data can set your price

Most people understand that stores track purchases through loyalty programs and apps. Fewer realize that the same data can, in principle, feed pricing decisions. Data that could be used for this purpose includes:

• Purchase history and browsing behavior in a store app or website
• Location data collected by a mobile app
• Device and account information tied to a profile
• Inferences drawn from all of the above, such as how price-sensitive someone might be

The concern is that two people could see different prices for the same item without knowing why. That opacity is what makes the practice hard for shoppers to detect on their own, and it is why legal limits are getting attention.

This is also where privacy tools fit in, with a caveat. A VPN can mask your IP address and hide your approximate location from sites you visit, but it does not remove the data you hand over when you log in, use a loyalty card, or accept an app's permissions. Reducing the data tied to your identity matters more than hiding your connection alone.

Croatia's US$2.9 million GDPR fine as an enforcement signal

The same Lexology Pro roundup reports that Croatia's data protection authority issued a US$2.9 million GDPR fine. The summary does not give the underlying details of the case, so it would be a mistake to read specifics into it. Still, the fine illustrates a broader point: under the GDPR, regulators can attach real financial penalties to how organizations handle personal data.

The regulation rests on principles such as collecting only the data an organization needs and being clear about how it will be used. Our analysis of Uber's €825M GDPR fine looks at how those principles play out when regulators act. For readers curious about how a national authority operates, our explainer on CNIL, France's data protection authority offers a useful comparison.

The contrast is worth noting. Europe relies on a broad data protection framework enforced by national authorities, while Maryland's approach targets one specific practice in one sector. Both aim to put limits on how personal data is used.

What This Means For You

If you shop for food in Maryland, the law is a reminder that your data may carry value beyond the checkout. If you live elsewhere, the rule is still a useful signal that lawmakers are paying attention to personalized pricing, and other jurisdictions may take their own approaches. The Lexology Pro summary does not say whether that will happen, so treat it as a trend to watch rather than a prediction.

In practical terms, you have more control over your data than you might think. The following steps are general privacy habits rather than guidance tied to the details of any one law:

• Review app permissions. Turn off location access for store and delivery apps unless you need it.
• Think about loyalty programs. Consider what you give up in data in exchange for discounts.
• Check privacy settings. Look for options to limit personalization or opt out of data sharing in the accounts you use.
• Notice price differences. If you spot an unexplained difference, you can note it and, where relevant, raise it with the retailer or the appropriate regulator.
• Know your rights. Data protection laws often give you access and deletion rights, which vary by location.

Takeaways

The Maryland surveillance pricing law shows that regulators are beginning to treat personalized pricing as a consumer protection and privacy issue. Croatia's US$2.9 million GDPR fine shows that data rules can carry serious penalties elsewhere. The best defense for shoppers is to share less data and understand their rights.

To see how enforcement works in practice, read our breakdown of the Uber GDPR fine. To review your own rights, start with our explainer on the UK Data Protection Act 2018.