Your CDP has been quietly setting prices for years. Your personalization engine adjusts offers based on a customer's purchase history. Your AI agent decides which customers see which discount. None of your marketing leadership thought of this as pricing infrastructure. On August 19, 2026, the Federal Trade Commission proposed an enforcement policy that treats it as exactly that -- and your marketing stack is now the system a regulator will look at first.

The FTC is not banning personalized pricing. It is saying that if you do it, you have to disclose it, justify it, and prove the customer agreed to the data being used that way. The marketing team that owns the CDP, the loyalty platform, and the personalization engine is the team that owns the disclosure.

What the FTC actually proposed

The proposed enforcement policy, published on August 19, 2026, leverages Section 5 of the FTC Act -- the unfair or deceptive practices clause. It does not create a new law. It tells sellers what the FTC considers unfair when customer data is used to set prices for specific customers.

The disclosure obligation covers three things. That the price was personalized. Why it was personalized -- what behavior or characteristic triggered the change. What data was used to personalize it. The third point is the one most marketing teams are not ready for. The FTC explicitly includes first-party data -- the purchase history your CDP has been collecting for years to drive "personalized experiences" -- as data that requires disclosure when it is used for pricing.

The FTC also published examples of scenarios where personalized pricing should be scrutinized: a customer who cannot easily leave home to buy food. A parent buying milk for several children. A consumer shopping for a security camera after being a victim of crime. A customer browsing your website from your parking lot. These are not hypotheticals. They are the test cases the FTC is signaling it will use to decide whether your pricing was unfair.

Why your CDP is now a compliance system

The data the FTC wants disclosed lives in your CDP, your loyalty platform, your personalization engine, and the AI agents you deployed in 2026 to scale one-to-one marketing. The marketers who built those systems were solving for relevance and conversion. The compliance team is going to ask the same systems to solve for proof of consent, audit trail, and disclosure justification.

Most marketing organizations cannot answer those questions today. The CDP has the purchase history. It does not reliably have a timestamped, customer-consented record of what that data can be used for. The loyalty platform has the points balance. It does not have a clean signal that the customer agreed to dynamic pricing based on that balance. The personalization engine knows the customer is price-insensitive because they bought the premium SKU last quarter. It cannot prove the customer knew that signal would be used to quote them a higher price next time.

The FTC has signaled that consent collected for one purpose is not consent for pricing. A retailer that collects first-party data to personalize the homepage experience cannot assume that consent extends to personalized pricing on the product page. The business is responsible for verifying that the customer understood the data would be used for pricing, not just for marketing.

What compliance looks like in 2026

Three changes are required before the FTC finalizes this policy. The comment period closes September 25, 2026. The smart move is to have the answers before the policy is final, not after enforcement actions start.

First, inventory every signal that influences a price. If your pricing model uses CDP data -- purchase history, lifetime value, churn risk, segment membership -- that signal needs a documented consent trail. If the signal came from a third party, the consent trail has to come from them too. The FTC has been explicit that inherited consent is not consent.

Second, redesign the disclosure surface. The current product page assumes the price is what it is. Under the proposed policy, the product page needs to disclose when the price was personalized, what data was used, and why the customer got this specific number. The retailers that have started designing this disclosure layer are the ones that will ship it cleanly. The retailers that wait for the final rule will ship it under enforcement pressure.

Third, audit the high-risk scenarios. The FTC's examples -- vulnerable customers, in-store browsers, post-incident shoppers -- are not edge cases in 2026. They are routine segments any AI-driven pricing engine will encounter. Test your pricing model against these scenarios now. If your model charges more to the customer standing in your parking lot because their location data signals intent, the FTC will treat that as unfair.

What the FTC comment window means for you

The proposed policy is open for public comment until September 25, 2026. The trade associations will file detailed comments arguing the policy is unworkable. The consumer protection groups will file comments arguing it does not go far enough. The final policy will land somewhere in between -- which means the disclosure obligation is coming, even if the specifics shift.

Marketing leaders should be filing their own comments through their general counsel's office. The FTC is asking how sellers should disclose personalization, what data categories should be exempt, and how to operationalize consent verification. The companies that get their operational reality into the comment record are the ones whose compliance burden will be calibrated to what is actually possible. The companies that stay silent will get a rule shaped by the people who did show up.

The bigger point is that personalized pricing is no longer a marketing optimization question. It is a compliance question that uses marketing data and runs on marketing infrastructure. The CMO who treats it as a legal team's problem will discover -- as the AI Act compliance reviews showed earlier in 2026 -- that the legal team does not understand the CDP and the marketing team does not understand the disclosure obligation. The companies that have one person who understands both are the ones that will be ready when the final rule lands.

Your CDP was built to drive revenue. The FTC just turned it into a system that has to defend how it sets prices. The marketing team that owns the data owns the compliance, whether or not the marketing team has the budget or the language for it.

Sources