Dechert Cyber Bits

FTC Takes Aim at Personalized Pricing in Proposed Enforcement Policy Statement

On August 19, 2026, the Federal Trade Commission (“FTC”) announced that it is seeking public comment on a proposed enforcement policy statement regarding “personalized pricing.” Also sometimes referred to as “surveillance pricing,” personalized pricing is the practice of using consumers’ personal data to estimate how much an individual is willing to pay for a product or service and setting a price accordingly. The policy statement follows the release of the FTC’s initial findings from  its surveillance pricing study, which we discussed in Cyber Bits Issue 70.  Public comments will be accepted until September 18, 2026.

In the policy statement, the FTC acknowledges it “does not have the legal authority to ban personalized pricing in all circumstances.” Instead, the policy statement focuses on disclosure obligations, asserting that engaging in personalized pricing without clearly and conspicuously informing consumers “likely” violates Section 5 of the FTC Act’s prohibition on deceptive or unfair practices. “When consumers see a listed price, they expect it to be the same price that everyone else sees, not the retailer’s estimate of how much they are willing to pay based on their personal data,” FTC Chairman Andrew Ferguson said in a statement accompanying the announcement.

To avoid enforcement risk, the FTC urges businesses to provide clear and conspicuous disclosures that include, for example, the fact that pricing is personalized, the basis for personalization, and the type of data used to make the pricing determination. According to the policy statement, telling a consumer only that they are receiving a “specially selected” price would “likely be misleading” because it omits important information.

Takeaway: The FTC’s guidance makes clear that the agency intends to enforce its “conclusion” that personalized pricing, without proper disclosures, likely violates Section 5. Privacy and cybersecurity teams should  take note of the FTC’s assertion that the collection, use, or disclosure of personal data for personalized pricing purposes can independently violate Section 5—even apart from the pricing disclosure itself. Businessess also will want to track the patchwork of state legislative activity targeting surveillance pricing, in particular in Maryland, Connecticut, New Jersey, New York, and California.

CalPrivacy Brings First-Ever and Second-Ever CCPA Enforcement Actions Against Data Brokers in Rapid Succession 

On August 11 and August 13, 2026, the California Privacy Protection Agency (“CalPrivacy”) announced back-to-back settlements with data brokers LocateSmarter LLC and Cybba, Inc. for alleged failures to register as data brokers under California’s Delete Act, discussed in Cyber Bits Issue 41 and Issue 44. The LocateSmarter action also marks CalPrivacy’s first enforcement action against a data broker under both the Delete Act and the California Consumer Privacy Act (“CCPA”).

LocateSmarter, an Iowa-based company that provides “data solutions and analytics” with a focus on “location and contact services, fraud identification and detection, and compliance products,” has agreed to a penalty of $116,490 ($30,600 for allegedly failing to timely register as a data broker and $79,890 for alleged CCPA violations). CalPrivacy alleged that LocateSmarter required consumers to provide the last four digits of their Social Security number and mailing address before they could opt out of the sale of their personal information—a practice the Agency said could intimidate consumers from exercising their rights and violates the CCPA’s data minimization requirements. Separately, Boston-based Cybba, which sells geolocation data, internet activity data, and inferences to facilitate targeted advertising, agreed to pay $52,400 for its alleged failure to register as a data broker by the 2025 deadline. Both companies have agreed to process deletion requests going forward through CalPrivacy’s Delete Request and Opt-Out Platform (“DROP”), which launched earlier this year and has already received more than 450,000 consumer deletion requests.  

Takeaway: CalPrivacy is opening new fronts in its enforcement efforts by layering Delete Act registration violations with substantive CCPA claims. This signals that companies operating as data brokers face compounding legal risk from a single enforcement action. Companies that collect and sell personal information about consumers with whom they do not have a direct relationship will want to assess whether they meet the Delete Act’s definition of a data broker, confirm their registration status, and review any friction in their data subject request processes—particularly any requirements for consumers to submit information beyond what is strictly necessary to complete a particular request. With DROP now operational and CalPrivacy’s Data Broker Enforcement Strike Force actively monitoring compliance—as discussed in Cyber Bits Issue 89—the window for self-correction is narrowing.

Meta to Pay Up to $17.2 Billion in Multi-State Settlement Related to Children’s Usage of Platforms

On August 26, 2026, Judge Yvonne Gonzalez Rogers for the U.S. District Court for the Northern District of California entered a consent judgment approving a settlement between Meta Platforms, Inc. (“Meta”) and 52 state and territorial attorneys general resolving claims that Meta violated state consumer protection laws and the Children’s Online Privacy Protection Act (“COPPA”) through the design and operation of Instagram and Facebook.

Under the terms of the approved settlement agreement, Meta is required to pay up to $17.2 billion and implement product changes aimed at protecting teen users (ages 13–17). Meta will initially pay approximately $11.66 billion to the settling states in ten annual installments. An additional contingency payment of up to approximately $5.02 billion total becomes payable to the settling states if Snap, TikTok, and YouTube also adopt comparable reforms in such states. The settlement also includes a $75 million state cost fund payment and a separate approximately $459 million payment to resolve related Cambridge Analytica claims. The obligations expire 10 years from the effective date. Meta has denied any liability or wrongdoing in connection with the matter.

Under the settlement’s terms, Meta must, among other things: (i) adopt an “Age Assurance Framework” within one year that meets specified accuracy thresholds; (ii) impose a default daily time limit of two hours of cumulative use per teen user across its platforms, with a “Night Access Mode” blocking teen access from midnight to 6 a.m. and silencing non-critical notifications from 10 p.m. to 7 a.m. (with stricter Phase II limits); (iii) disable non-critical notifications during school hours (8 a.m. to 3 p.m., Monday through Friday, mid-August to mid-June); (iv) implement “productive pauses” at 60- and 90-minute usage thresholds and a notice upon every 15 minutes of continuous use; (v) offer teen users the option to switch to a chronological, non-personalized feed and prompt them to consider this option within 10 days of account creation and every 90 days thereafter; (vi) hide “like” and reaction counts for teens by default and ban “Cosmetic Procedure Filters”; and (vii) strengthen parental supervision tools, including providing parents with detailed usage data and requiring parental approval to relax default settings.

UK Data Regulator Targets Nuisance Marketing 

The UK Information Commissioner’s Office (“ICO”) announced that it executed search warrants across the UK as part of its crackdown on suspected nuisance marketing linked to car finance mis-selling claims.

The warrants, carried out on July 29, 2026, targeted a mix of residential and business premises linked to companies across five cities in the UK. The companies are under investigation on suspicion of sending a combined 170 million unsolicited text messages to the public between September 2025 and May 2026. The action follows over 12 million complaints about nuisance car finance marketing text messages received by the ICO, with up to 100,000 complaints received in one day.

The action forms part of a collaborative effort between the ICO, the UK’s Financial Conduct Authority (“FCA”) and the Advertising Standards Authority to combat the mishandling of motor finance claims by claims management companies and plaintiff law firms. The taskforce's remit includes taking targeted action to address unsolicited and misleading advertising, meritless claims, multiple representation and unfair exit fees.

Takeaway: The enforcement actions demonstrate both the ICO’s investigatory powers under the Privacy and Electronic Communications Regulations and its increasingly collaborative relationship with the Financial Conduct Authority. In addition to this action targeted at car finance mis-selling claims, last year, the ICO and the FCA issued a joint statement detailing the various ways they are collaborating on AI and innovation in the financial services sector.

Dechert Tidbits 

Washington AG Releases First-Ever Data Privacy Report, Calling for Comprehensive Reform

On August 14, 2026, Washington Attorney General Nick Brown (“Washington AG”) released the state’s first-ever Data Privacy Report, identifying alleged gaps in how personal information is collected, shared, and protected across the state. The Report identifies four of the AG’s key concerns in the modern data economy: (i) overcollection and secondary use of personal information; (ii) weak consent requirements and deceptive design; (iii) the collection and sale of sensitive data (including biometric and precise geolocation data); and (iv) a lack of transparency in the data broker industry. The Report reveals that in 2025, the AG’s office received reports of 209 data breaches affecting more than 8 million residents, with over 80% allegedly exposing Social Security numbers, and that 83% of surveyed residents felt they had little or no control over their personal information. Among its eight recommendations, the Report calls for requiring meaningful consumer consent and prohibiting deceptive design, establishing data minimization standards, mandating data broker registration, and strengthening enforcement mechanisms. The Report notes that Washington lacks a generally applicable consumer privacy law and calls on the Washington Legislature to enact new privacy requirements modelled off of privacy laws in other states.