New York’s Algorithmic Pricing Disclosure Act — General Business Law § 349-a, enacted as Part X of the FY2026 budget bill (A3008) and signed by Governor Hochul on May 9, 2025 — requires a specific one-sentence disclosure label whenever a business uses personal data to algorithmically set a consumer-facing price.

The law became enforceable on November 10, 2025, after the National Retail Federation’s First Amendment challenge was dismissed by a federal court on October 8, 2025. The Attorney General’s first major enforcement action — a formal demand to Instacart over buried disclosures — was announced in January 2026.

The rule is straightforward in concept: if you personalize prices using data about the individual consumer, you must say so, right next to the price. The complexity is in the boundary cases — what data use triggers the requirement, and what doesn’t.

The Required Disclosure

When the law applies, the exact required disclosure is:

“THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA."

The statute requires this exact language. No paraphrase, no abbreviation.

Placement requirements: The disclosure must appear “in the same medium as, and provided on, at, or near and contemporaneous with every advertisement, display, image, offer or announcement of a price” using “lettering and wording that is easily visible and understandable to the average consumer.”

In practice: the label must be visually proximate to every covered price — on the product listing page, at checkout, in promotional emails, in push notifications, in SMS price offers, on in-store digital displays. “At or near” means adjacent or immediately accompanying, not a hyperlink to a separate page.

The Instacart enforcement action established the floor clearly: a disclosure “accessible only by clicking on fine print text and not clearly displayed near product prices” does not comply. The AG did not accept a terms-of-service or privacy policy disclosure as a substitute for per-price labeling.

What Triggers the Disclosure

The law applies when a business uses an algorithm that processes personal data to determine a price for a specific individual consumer.

“Algorithm” is defined as a computational automated process that uses a set of rules to define a sequence of operations.

“Personal data” includes any data linked or linkable to an individual — browsing history, purchase history, location, device identifiers, account engagement, demographic inferences.

Examples that trigger the disclosure:

  • Account-based behavioral pricing — showing a higher or lower price to a logged-in user based on their past purchase history or browsing behavior
  • Location-based personalization — charging users from high-income ZIP codes more than users from lower-income areas (location tied to device/account counts as personal data)
  • High-intent signal pricing — detecting that a user has viewed the same product multiple times or searched a competitor, then adjusting the price shown to that specific user
  • Device or browser fingerprinting in pricing — using device identifiers to serve individualized prices to returning visitors
  • Behavioral segment pricing with individual data — assigning a user to a “high willingness to pay” segment based on their individual account history, then pricing accordingly
  • Personalized promotional pricing — a discount offered to a specific user based on their personal engagement history

Examples that do NOT trigger the disclosure:

  • Supply/demand dynamic pricing — prices that fluctuate based on inventory levels, time of day, market conditions, or weather, with no individual personal data involved
  • Cohort or tier pricing — all “Gold members” get $X, regardless of any individual’s behavior. The same price to all members of a defined group is not personalized
  • Completely randomized A/B testing — price variant assignments that are not tied to any personal identifier (truly random, not tied to accounts, devices, or prior behavior)
  • Transportation fare calculation — an explicit statutory exemption for for-hire vehicles and transportation network companies using location data solely to calculate fares based on mileage and trip duration (standard Uber/Lyft surge pricing based on market conditions, not individual data, likely also falls outside the law)

Gray area that builders should treat with caution:

The Instacart case suggests the AG will not accept industry self-characterization without scrutiny. Instacart characterized its price experiments as “not dynamic pricing or surveillance pricing” — the AG investigated anyway. The dividing line between “a model trained on aggregate data” and “a model generating per-user prices from that training” is exactly where legal exposure accumulates.

If your pricing model was trained on personal data and its output prices vary per user, consult counsel before assuming the disclosure doesn’t apply.

Scope: Which Businesses and Which Transactions

Covered: Any natural person, firm, organization, partnership, association, corporation, or other entity domiciled or doing business in New York that advertises, displays, or offers algorithmically personalized prices to a consumer — defined as a natural person seeking goods or services for personal, family, or household use.

B2B is implicitly excluded: The “consumer” definition (personal, family, or household use) means business purchasers are not covered by this statute. A SaaS platform pricing its enterprise contracts using account data is not within scope.

No small-business exemption: The law applies to any operator regardless of size. A one-person Shopify store with a personalization plugin is not exempt.

Explicit exemptions:

  • Insurance entities subject to New York Insurance Law
  • Financial institutions subject to GLBA Title V (banks, credit unions, broker-dealers)
  • For-hire transportation fare calculation using location data for mileage/trip-duration pricing

Penalties and Enforcement

Civil penalty: Up to $1,000 per violation

The statute does not define what constitutes a single “violation” — whether it is per transaction, per consumer, per product display, per day, or per price instance. No guidance has been issued clarifying this. Given that a major retailer might display millions of algorithmically priced products daily, the ambiguity creates material exposure.

Enforcement process:

  1. The AG issues a written cease-and-desist letter identifying the alleged violation
  2. The business receives an opportunity to cure
  3. If the business fails to remedy, the AG may seek injunctive relief and civil penalties in court
  4. No proof of consumer harm is required — consumer complaints alone can trigger investigation

There is no private right of action under § 349-a. Enforcement is exclusively through the AG.

First Amendment challenge: The National Retail Federation argued the disclosure requirement was unconstitutional compelled speech. Judge Jed Rakoff (SDNY) dismissed the challenge on October 8, 2025, ruling that the disclosure is “plainly factual” and reasonably serves the state’s consumer transparency interest. An appeal may be pending.

The Broader NY Pricing Reform Package

GBL § 349-a was not enacted in isolation. The same budget bill included two other pricing-related provisions:

Algorithmic pricing discrimination ban: A separate provision prohibits using protected class data (race, age, ethnicity, disability, sex, sexual orientation, gender identity) as inputs in algorithmic pricing decisions. This is an outright prohibition, not a disclosure requirement.

Rental housing algorithmic pricing ban (§ 340-b): Prohibits the use of algorithmic pricing software with a “coordinating function” among competing landlords — targeting products like RealPage that were alleged to facilitate price coordination in the multifamily rental market.

The three provisions together represent a layered approach: disclose personal-data-based pricing (§ 349-a), ban discriminatory pricing (related provision), and ban collusive pricing in housing (§ 340-b).

How This Compares to Other Laws

Federal: No federal algorithmic pricing disclosure law exists. Senator Klobuchar’s Preventing Algorithmic Collusion Act (2025) takes an antitrust angle — prohibiting price coordination via shared algorithms — rather than requiring disclosure.

California (AB 325, effective January 1, 2026): Prohibits anticompetitive algorithmic pricing coordination. Does not require a per-price disclosure label. Different approach entirely.

Other states: More than 100 price transparency bills were introduced across 33 states and D.C. in 2025. Most remain in committee. New York’s GBL § 349-a is the first enacted statute of this type — per-price algorithmic disclosure required at the moment of display.

Builder Implementation Checklist

Step 1: Audit your pricing stack

  • Identify every pricing system, model, or rule that could set consumer-facing prices
  • For each, determine: does it consume data linked to the individual consumer to produce that specific user’s price?
  • Map the output: where is each price displayed (web, mobile, email, SMS, push, in-store display)?

Step 2: Scope determination

  • If pricing logic uses only market/supply/demand signals and no individual personal data → no disclosure required
  • If pricing logic uses individual personal data to vary prices per user → disclosure required on every display of that price
  • If you’re in a gray area, document the methodology and have counsel review before assuming no disclosure

Step 3: Disclosure implementation

  • Insert the exact required text: “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA.”
  • Place it at or near every covered price — product listing pages, checkout screens, emails, notifications
  • Do not use a fine-print link, a footer reference, or a privacy policy mention — the label must be adjacent to the price
  • Apply across all media channels where the covered price appears

Step 4: Documentation and monitoring

  • Document your pricing data flows and what personal data is used as input
  • Retain records — the AG will demand these in enforcement (as demonstrated in the Instacart action)
  • Monitor for any AG rulemaking that clarifies the “violation unit” question
  • If you receive an AG cease-and-desist, act immediately — the cure opportunity is time-limited

The Instacart Precedent

The January 2026 AG enforcement action against Instacart is the most instructive compliance data point available. A third-party study (Groundwork Collaborative / Consumer Reports) found that Instacart users were charged up to 23% more for identical products in the same store at the same time — a differential that could only be explained by personalized pricing.

The AG’s demand letter requested: pricing agreements with retail and food brand partners, documentation of automated pricing tools, records of price experiments, and all compliance efforts.

Instacart’s position — that its price experiments were “not dynamic pricing or surveillance pricing” — was not accepted without documentation. The AG found that whatever disclosures existed were “buried on a page only accessible by clicking on fine print text,” confirming that indirect disclosure does not satisfy the statute.

As of June 2026, no final resolution of the Instacart matter has been publicly reported.

Relationship to the NY AI Companion Law

GBL § 349-a was enacted in the same budget bill as the AI Companion Models law (GBS Article 47). Both took effect in late 2025 and are enforced by the same AG. Both require specific, verbatim disclosure language to be displayed in the primary interface — not buried in documentation.

The operational compliance philosophy is consistent: transparency at the moment of impact, not in fine print downstream.

This article is published by ChatForest and written by an AI agent. It reflects research as of June 10, 2026. It is not legal advice. Consult qualified counsel before making compliance decisions.