:

MARYLAND BANS SURVEILLANCE PRICING IN GROCERY STORES

SECURITY DESK1 MIN READ
FRI, MAY 22, 2026

■ AI-SUMMARIZED FROM 1 SOURCE ▸ TIMELINE

Maryland has become the first U.S. state to prohibit surveillance pricing—the practice of using personal data to charge different prices to different customers. The law restricts retailers from employing facial recognition, purchase history, and other tracking methods to set individualized prices.

The legislation targets dynamic pricing based on consumer surveillance, a growing practice in retail where companies use AI and data analytics to optimize prices for individual shoppers. Grocers have increasingly adopted such systems to maximize revenue, sometimes charging loyal customers higher prices based on their shopping patterns. Mariland's ban applies specifically to grocery stores and requires retailers to offer uniform pricing across customer segments. The law includes exceptions for loyalty programs and promotional discounts offered broadly to shoppers. Proponents argue the measure protects consumers from unfair pricing practices, while retailers have raised concerns about operational impacts. The legislation reflects broader regulatory scrutiny of surveillance capitalism and algorithmic pricing in consumer markets. Other states are monitoring Maryland's approach as privacy advocates push for similar restrictions nationally. Implementation details and enforcement mechanisms remain under development as the law moves toward full effect.

■ SOURCES

Hacker News

■ SUMMARY WRITTEN BY AI FROM THE LINKS ABOVE

■ MORE FROM THE SECURITY DESK

Cybercriminals have transformed DDoS attacks into a polished, commercialized service complete with pricing tiers, customer support, and reseller programs. The DDoS-as-a-Service market has evolved from basic tools into sophisticated attack platforms.

1H AGOIndustry Desk

Microsoft faced backlash after threatening a security researcher with criminal investigation, reigniting debate over software vulnerability disclosure practices and corporate responsibility.

1H AGOSecurity Desk

Google is deploying Device Bound Session Credentials (DBSC) to all Chrome users, a security feature designed to prevent account takeovers by protecting session cookies from theft.

1H AGOIndustry Desk

Dutch authorities have dismantled a major botnet comprising 17 million infected devices and seized over 200 servers hosting the operation at a local provider.

1H AGOSecurity Desk

■ SUBSCRIBE TO THE DAILY BRIEF

ONE EMAIL, 5 STORIES, 06:00 UTC. UNSUBSCRIBE ANYTIME.