For food retailers operating in Maryland, the effective date of House Bill 895 — October 1, 2026 — is not the beginning of a transition period. It is the end of one.
The legislation, signed in April as the Protection From Predatory Pricing Act, includes a 45-day cure period. That structural mechanism means any company that had not already adjusted its algorithmic pricing models by mid-August is now operating in a state of non-compliance. The Maryland Attorney General’s Consumer Protection Division can begin enforcement Tuesday. Penalties run up to $10,000 per violation, $25,000 for repeat offenders.
The law is narrow in scope but broad in implication. HB 895 targets food retailers with locations exceeding 15,000 square feet that maintain substantial grocery operations, plus third-party delivery services handling tax-exempt food. The core prohibition is directed at surveillance pricing — the practice of using consumer personal data to set individualized prices. The statute carves out standard supply-and-demand adjustments, perishability-based markdowns, temporary discounts, and loyalty programs. What remains prohibited is the use of personal data profiles to charge different consumers different prices for the same good.
The enforcement question is whether retailers can prove their algorithms optimize for market conditions rather than exploiting individual consumer profiles — a technical distinction that will test how Maryland’s AG interprets the boundary between prohibited surveillance pricing and permitted dynamic pricing.
Maryland’s enforcement date arrives as part of a three-state timeline that reveals a regulatory patchwork forming without federal coordination. Connecticut’s HB 5563, signed June 4 by Governor Lamont, adopts a broader scope covering retail sellers and delivery services generally. New Jersey’s A4085, signed July 23, takes the most aggressive posture: effective August 1, 2027, the law sets penalties at $50,000 per violation or actual damages, whichever is greater, and — critically — empowers consumers with a private right of action and the potential for treble damages.
The divergence matters. Maryland’s enforcement model relies solely on the state AG, which constrains the volume of actions but concentrates interpretive authority. New Jersey’s private right of action means any consumer who believes they were charged a surveillance-adjusted price can bring suit directly, with treble damages creating an incentive structure that could drive enforcement far beyond what a single AG office can manage. National retailers operating across state lines now face a compliance environment where the rules, the penalties, and the enforcement mechanisms all shift at every jurisdictional boundary.
This state-led experimentation is occurring in a distinct federal vacuum. The Federal Trade Commission maintains theoretical authority under Section 5 of the FTC Act to police unfair or deceptive acts, and the agency is currently considering a proposed enforcement policy that would pivot from broad AI deception toward a disclosure-based framework for personalized pricing. But the Congressional Research Service has confirmed there is no specific federal guidance on AI-driven or surveillance pricing as a distinct category. FTC Chair Andrew Ferguson’s recent statement on agent liability — that developers bear responsibility when autonomous systems cause harm — extends the agency’s posture toward algorithmic accountability but stops short of a dedicated pricing framework.
What enforcement will reveal first is interpretive. If Maryland’s AG takes a strict, data-centric view of what constitutes personal data in pricing algorithms, it could force rapid recalibration of retail AI models. A more lenient interpretation — treating aggregate behavioral data as distinct from individual consumer profiles — could leave the surveillance pricing prohibition narrower than its text suggests. Either way, the first enforcement actions will set a precedent that Connecticut and New Jersey will watch closely as they prepare their own frameworks.
For companies deploying AI-driven pricing in food retail, the structural reality is simple: the compliance deadline passed weeks ago. The question is no longer whether to adjust but whether the adjustments already made will survive regulatory scrutiny when the enforcement begins.