On Data Privacy Day, Attorney General Bonta Focuses on Surveillance Pricing, Compliance with California Consumer Privacy Act

Californians have the right to understand whether their data is being used to set individual prices they pay for items like groceries

OAKLAND - In honor of Data Privacy Day, California Attorney General Rob Bonta today announced an investigative sweep focused on businesses' use of consumers' personal information to set targeted, individualized prices for products and services, a practice known as surveillance pricing. Surveillance pricing practices may trigger obligations under and even violate the California Consumer Privacy Act (CCPA), which includes a "purpose limitation principle" that limits a business's use of personal information to purposes that are consistent with the reasonable expectations of consumers. Businesses that use data in ways that targeted consumers might not expect - including by using that data to set individualized prices - may be violating California law. As part of the sweep, the California Department of Justice is sending letters to businesses with significant online presence in the retail, grocery, and hotel sectors. The letters request information regarding how businesses use consumers' shopping and internet browsing history, location, demographics, inferential, or other data to set the prices of goods or services.

"Consumers have the right to understand how their personal information is being used, including whether companies are using their data to set the prices that Californians pay, whether that be for groceries, travel, or household goods. We need to know whether businesses are charging people different prices for the same good or service - and if they're complying with the law. Today, my office is launching a formal inquiry and will ask prominent businesses in the retail, grocery, and hotel sectors to provide my office with information so we can understand how these companies are using personal data," said Attorney General Bonta. "Practices like surveillance pricing may undermine consumer trust, unfairly raise prices, and when conducted without proper disclosure or beyond reasonable expectations, may violate California law. On Data Privacy Day and every day, my office is committed to enforcing the CCPA and ensuring that businesses are transparent, fair, and accountable in their use of consumer data."

The letters will request information including:

• Companies' use of consumer personal information to set prices.
• Policies and public disclosures regarding personalized pricing.
• Any pricing experiments undertaken by companies.
• Measures companies are taking to comply with algorithmic pricing, competition, and civil rights laws.

What is Surveillance Pricing:

Surveillance pricing is the use of a consumer's personal information to set targeted, individualized prices for a product or service. As a result, consumers buying the same product or service at the same time from the same business may be offered different prices. Unless a business discloses that it uses a consumer's personal information to set prices, surveillance pricing may be invisible to the consumer, as consumers usually cannot and do not consult with each other to compare the prices they have been offered.

In recent years, media reports and regulators alike have sounded the alarm on the possibility of the existence of surveillance pricing. In July 2024, the Federal Trade Commission (FTC) sought information on surveillance pricing from eight companies that provided surveillance pricing products to businesses. Last year, before the change in federal administration, the FTC published a summary of its research. Since then, the Trump Administration's FTC has closed public comment on a request for information regarding retailers' use of surveillance pricing, illustrating another example of the Trump Administration's abandonment of critical consumer protection work. A 2025 Consumer Reports investigation into the grocery delivery company, Instacart, found that some grocery prices differed by as much as 23% per item from one Instacart customer to the next. According to the investigation, price variations for the same products ranged from as little as seven cents to $2.56 per item. Instacart has since publicly stated that it has stopped offering technology that allowed grocery retailers to charge shoppers different prices for the same groceries at the same time.

The California Consumer Privacy Act (CCPA):

The CCPA is a landmark law that secures increased privacy rights for California consumers, including the right to know how businesses collect, share, and utilize their personal information. Businesses that are subject to the CCPA have several responsibilities, including responding to consumer requests to exercise these rights and giving consumers certain notices explaining their privacy practices. Under the CCPA's "purpose limitation" principle, businesses are limited in their use of personal information to purposes that are consistent with the reasonable expectations of consumers.

Attorney General Bonta is committed to the robust enforcement of California's nation-leading privacy law. Investigative sweeps and inquiries help the California Department of Justice to identify and zero in on compliance issues across industries.

In 2024, the CCPA investigative sweep focused on the compliance of streaming services and connected TVs, and last year, Attorney General Bonta announced a settlement with Sling TV that arose from this sweep. In August 2022, the Attorney General announced a settlement with Sephora resolving allegations that arose from a sweep of companies that appeared to be out of compliance with the user-enabled privacy control (GPC) signal to stop the sale of personal information. Other investigative sweeps have related to the location data industry, employee information, opt-out requests on mobile apps, and business loyalty programs.

In November 2025, Attorney General Bonta announced a $1.4 million settlement with Jam City resolving allegations that the mobile app gaming company violated the CCPA by failing to offer consumers methods to opt-out of the sale or sharing of their personal information across its popular gaming apps. In July 2025, Attorney General Bonta announced a $1,550,000 settlement with website publisher Healthline Media LLC, resolving allegations that its use of online tracking technology on its health information website violated the CCPA. In 2024, Attorney General Bonta and Los Angeles City Attorney Hydee Feldstein Soto announced a $500,000 settlement with Tilting Point Media LLC resolving allegations that the company violated the CCPA and federal law by collecting and sharing children's data without parental consent in their popular mobile app game "SpongeBob: Krusty Cook-Off." In 2024, Attorney General Bonta announced a settlement with DoorDash, resolving allegations that the company violated the CCPA and COPPA by selling California customers' personal information without providing notice or an opportunity to opt out of that sale.

For more information about the CCPA, visit oag.ca.gov/ccpa. To report a violation of the CCPA to the Attorney General, consumers can submit a complaint online at oag.ca.gov/report.