NYC Surveillance Pricing Ban: Council Votes 44-5 to Bar Personal Data Pricing, What Is Confirmed and What Businesses Should Check
The New York City Council voted 44-5 on November 12, 2026 to stop businesses from using customers' personal data to set individualized prices. Here is what is confirmed, what is not known yet, and what to check in your store and apps this week.
Where United States · North America, United States & Canada
On this page 7 sections
New York City is moving to ban surveillance pricing, which means using a customer's personal data to decide what that one person pays. If your online store, app or checkout system changes prices based on who is shopping, find out this week what data those tools use and where your customers are.
What happened with the NYC surveillance pricing bill
On Thursday, November 12, 2026, the New York City Council voted 44-5 in favor of a bill titled "Prohibiting surveillance pricing." According to The Record, the bill bars retailers and other businesses from using surveillance pricing to harness customers' personal data to set individualized prices.
The intro.nyc bill tracker lists the bill as approved by the Council on November 12, 2026. Its status is listed as Mayor's Desk for Signature. Put simply, the Council has passed it and it is now waiting for the mayor.
The Record quotes Mayor Zohran Mamdani: "when corporations use your personal data to decide what you pay, you only stand to lose."
New York City is not the first. The Record reports that Seattle signed a similar surveillance pricing ban into law the month before.
What is confirmed and what is not known
What the sources confirm:
- The Council vote was 44-5, held on Thursday, November 12, 2026.
- The bill is titled "Prohibiting surveillance pricing."
- It is aimed at retailers and other businesses that use customers' personal data to set individualized prices.
- Its status is listed as Mayor's Desk for Signature.
- Seattle signed a similar ban into law the month before.
What the sources we checked do not say:
- Whether or when the mayor will sign it. The mayor's quote shows his view of the practice. A signature is not confirmed.
- When it would take effect. No effective date appears in our sources.
- Penalties. The sources we checked do not list fines or other penalties, so we are not repeating any figure.
- The exact definitions. We could not confirm what counts as personal data, which businesses are covered or what exemptions exist (for example, loyalty programs or published discounts).
- Who enforces it. Not stated in our sources.
- Whether it reaches sellers outside the city. If you are based in Ohio and sell online to New York City customers, the sources do not say whether the bill applies to you.
Until the final text is signed and published, treat anything more specific than this as unconfirmed.
What surveillance pricing means in plain English
As The Record describes it, surveillance pricing is using a customer's personal data to set a price for that individual customer. In practice, that means two people could see different prices for the same product because of information collected about them.
That is different from a store charging everyone the same price, or changing the price for everyone at once. We have not seen anything in the sources that explains how the NYC bill treats practices like dynamic pricing or targeted coupons. Read the final text before deciding a tool you use is fine.
Why surveillance pricing matters for your website or app
Most businesses never set out to do surveillance pricing. The risk is that a tool does it for them. Online stores today often run a stack of plugins, personalization engines, testing tools and marketing integrations. Any one of them could change what a shopper sees based on location, device, browsing history or past purchases, and the owner may never know.
That is the business angle. If a regulator or a customer asks how your prices are set, saying the plugin does it is not a good answer. You need to know what each piece of software does with customer data, and you need to be able to change it. On a rented platform you may not be able to see that logic at all, a problem we covered in You Don't Own Your Wix Website.
It is also a security issue. Every piece of personal data you collect to personalize prices is data you have to protect. Collecting less means less to explain and less to lose if you are breached. Our security hardening work starts with the same question: what data does this system hold, and does it need to?
What to do this week
| Step | What to check | Why it matters |
|---|---|---|
| 1. List your pricing tools | Your e-commerce platform, discount and pricing plugins, personalization tools, A/B testing tools and any quote calculators in your apps | You cannot assess what you have not listed |
| 2. Ask each vendor in writing | Does the tool use customer personal data (location, device, browsing or purchase history) to set an individual shopper's price? | Vendors know their own features; get the answer on record |
| 3. Check your own code | Custom apps or checkout logic that changes price based on who the user is | Hand-built logic is easy to forget about |
| 4. Find out where your customers are | Orders and accounts with New York City addresses | Shows whether the bill could matter to you once its reach is clear |
| 5. Write down how prices are set | One page: who sets prices, which tools change them, what data they use | Lets you answer questions quickly |
| 6. Remove data you do not need | Turn off personalization features you are not using and stop collecting fields you do not need | Lowers both compliance and breach risk |
| 7. Watch the bill's status | Check the intro.nyc tracker for a signature and the final text, then ask your lawyer | Effective date, penalties and scope are still unconfirmed |
Surveillance pricing questions people are asking
What is surveillance pricing?
Using a customer's personal data to set an individualized price for that customer. That is how The Record describes what the New York City bill targets.
Is surveillance pricing illegal in New York City now?
That is not confirmed. The Council passed the bill 44-5 on November 12, 2026, and the tracker lists it as at the mayor's desk for signature. We have not seen confirmation that it has been signed.
When does the NYC surveillance pricing ban take effect?
Not known. The sources we checked give no effective date.
What are the fines for surveillance pricing in NYC?
The sources we checked do not list penalties. Wait for the signed text.
Does the NYC ban apply to online stores?
The Record says it covers retailers and other businesses. Our sources do not explain how it treats online sales or sellers based outside New York City.
Which other cities ban surveillance pricing?
The Record reports that Seattle signed a similar ban into law the month before the New York City vote.
Is dynamic pricing the same as surveillance pricing?
Not necessarily. Dynamic pricing usually means changing prices for everyone, for example based on demand. Surveillance pricing, as described here, uses personal data to set one person's price. How the bill draws that line is not in our sources.
The bigger lesson
The rules on how businesses use customer data keep changing, and the businesses that adapt fastest are the ones that know what their own software does. If your pricing, checkout and customer data run on code you own and understand, a new law means a review and a change. If they run on tools nobody has looked inside, the same law means guesswork.
Want a clear picture of what your website and apps do with customer data? See security hardening or request a quote.
Get security alerts by email, with the free checklist, at /security-alerts.
Sources: The Record: NYC Council passes bill to ban surveillance pricing; intro.nyc: Prohibiting surveillance pricing.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Cruciferra Malware: A Crypter for Hire With Over 90 Encryption Routines, What Is Confirmed and What Businesses Should Check
Cruciferra is a crypter that criminals rent to hide their malware. ESET says it has blocked over 700,000 attem...
Microsoft 365 Outage: Outlook, Teams, SharePoint, Copilot and Defender XDR Disrupted November 12 to 13, What Is Confirmed and What to Do This Week
A major Microsoft 365 outage began November 12, 2026 and ran into November 13, with reported disruption to Out...
Apache HTTP Server Vulnerability CVE-2026-119618: Critical mod_http2 Flaw Can Lead to Remote Code Execution, Fixed in 2.4.71
Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a critical mod_http2 flaw that Apache says can lead to remote...
