Maryland Enacts HB 895, Becoming First State to Restrict Personalized Pricing in the Food Sector

Maryland has enacted House Bill 895, Protection from Predatory Pricing Act, creating a new consumer protection framework aimed at what the legislature believed to be certain personalized pricing practices in the food sector. The law takes effect October 1, 2026. Directly restricting the use of personalized dynamic pricing (rather than only requiring disclosure), this law is the first of its kind in the United States, requiring attention from businesses that sell food at retail or through delivery services and platforms.

SCOPE OF THE NEW LAW

HB 895 applies to food retailers and third-party food delivery service providers (i.e., grocery stores and food delivery services, likely including platforms that connect grocery stores to delivery drivers/couriers). It prohibits the use of “dynamic pricing” or “personal data” to set higher prices for specific consumers or groups of consumers.

For the purposes of this law, “dynamic pricing” is defined as “offering or setting a personalized price for a good or service that is specific to a consumer based on the consumer’s personal data, regardless of whether the seller collected or purchased the personal data.” “Personal data” is defined by reference to the 2024 Maryland Online Data Privacy Act as “any information that is linked or can be reasonably linked to an identified or identifiable consumer,” not including de-identified data or publicly available information.

Context suggests that there may be an intention to include data such as an individual’s browsing history, specific location data, purchasing behavior, and income, for example, although there are arguments to the contrary based on the statutory texts involved.

In addition, the law regulates the use of protected class data to offer, advertise, or sell a consumer good or service in circumstances where the legislature believed it would have the effect of withholding or denying accommodation, advantage, facility, privilege, or service. “Protected class data” means information about an individual or group of individuals that identifies a characteristic legally protected from discrimination such as race, gender, or ethnicity.

The statute includes a number of exceptions. Among other things, it excludes many promotional pricing, loyalty, and rewards programs, subscription pricing, specified geographic- and supply-based price differences, price corrections, and certain prices offered in exchange for a consumer’s consent to provide personal data. These exceptions will be important considerations in determining the practical reach of the law for businesses that use targeted promotions, data-driven offers, or artificial intelligence (AI)-enabled pricing tools.

BUSINESSES MOST LIKELY TO BE AFFECTED

The businesses most likely to be directly affected are grocery chains, supermarkets, large-format food retailers, and app-based food delivery platforms operating in Maryland. Companies in the food and grocery sector that use algorithmic pricing, customer segmentation, behavioral profiling, or other automated methods to tailor prices or offers may see increased scrutiny under the new law. For these businesses, HB 895 requires a review of current practices and may possibly present compliance issues at the intersection of pricing practices, consumer data use, and AI governance.

Important first steps include reviewing:

• What data is used in pricing decisions;
• Whether pricing logic could be characterized as setting a higher price for a specific consumer;
• Whether any use of consumer data may fall within the statute’s definitions of personal data or protected class data; and
• Whether any of the enumerated exemptions may apply.

ENFORCEMENT

The law takes effect October 1, 2026 and is subject to enforcement by the Consumer Protection Division of the Maryland Attorney General’s Office. The law requires the Division to provide companies with notice of an alleged violation and a 45-day opportunity to cure before the Division can file an enforcement action.

The new law does not have or allow for a private right of action; enforcement is solely in the hands of state regulators rather than private plaintiffs. Violations of the law are within the Maryland Consumer Protection Act and are potentially subject to civil penalties of up to $10,000 per violation or up to $25,000 per violation for repeat violators, although there could be arguments about the scope of what that means or how it would be applied.

PRACTICAL CONSIDERATIONS

Businesses that may fall within the statute’s scope should consider taking steps now to prepare for the October 1, 2026 effective date. In particular, companies regulated by the law may wish to assess:

• Whether food pricing practices vary by consumer, particularly in ways that may increase rather than decrease prices;
• What categories of data are used in pricing systems;
• Whether internal documentation adequately explains the basis for price differentiation consistent with the law’s requirements; and
• Whether existing governance around AI and personalization is sufficient in light of the statute’s restrictions.

Retailers and delivery platforms that operate across multiple states should also monitor whether Maryland’s approach signals broader legislative interest in regulating personalized pricing in consumer-facing markets.

Other state legislatures, including California, Colorado, Illinois, New Jersey, New York, Washington, and others, are considering similar dynamic pricing laws.