Maryland's Pricing Label Sits in a Law Named After Grocery Stores. Connecticut Wrote Its Version Twice, and the Stricter One Is the One In Force.

Yesterday we published a comparison of the two personalised-pricing warning labels we knew about, in New York and Connecticut. Two readings later, that post needs a correction and the map needs a third state on it.

Here is what changed. Maryland has had a prescribed pricing-disclosure sentence in force since 1 October 2026 — the same day as Connecticut’s — and it applies to merchants generally, not to grocery stores. And Connecticut did not write one surveillance-pricing section in its 2026 session. It wrote two, five weeks apart, in two different public acts, both numbered Section 11, with different mandated sentences and materially different exceptions. The one in force today is the stricter of the two on exceptions. The more forgiving one arrives on 1 July 2027.

We read both Maryland’s enrolled bill and both Connecticut public acts directly for this post. Where we could not resolve something from the primary text, we say so rather than guessing.

Part one: the Maryland label nobody told you about

Why it was easy to miss

Maryland House Bill 895 of the 2026 regular session is titled, in the legislature’s own words, “Food Retailers and Third-Party Delivery Service Providers — Dynamic Pricing and Personal Data”, with the short title “Protection From Predatory Pricing Act”. The General Assembly’s bill page records its status as “Approved by the Governor — Chapter 154” on 28 April 2026, with an effective date of 1 October 2026.

Read the title and you file it under groceries. We did. Our own running notes carried this bill for weeks marked food retailers only, and that was wrong.

The Act creates two new sections of the Commercial Law Article, and they do different things to different people.

• Section 13-321 is the food provision, and it is a prohibition. Its population is a “FOOD RETAILER”, defined as a merchant operating an establishment that “HAS A MINIMUM OF 15,000 SQUARE FEET” and “SELLS FOOD THAT IS EXEMPT FROM THE SALES AND USE TAX IN ACCORDANCE WITH § 11-206(C) OF THE TAX - GENERAL ARTICLE”, together with third-party food delivery service providers. If you sell frames, that is not you.
• Section 13-322 is a disclosure duty, and its population is a merchant. Nothing more. If you sell frames online to a Maryland consumer, that is you.

You can see the drafters drawing the line themselves. Section 13-322(B)(2) expressly excludes from its own scope “CONDUCT OF A FOOD RETAILER OR THIRD-PARTY FOOD DELIVERY SERVICE PROVIDER SUBJECT TO § 13-321 OF THIS SUBTITLE”. A section that has to carve out the food industry is not a food-industry section.

What section 13-322 actually requires

The operative sentence, verbatim:

“A MERCHANT MAY NOT SET THE PRICE OF A CONSUMER GOOD OR SERVICE USING DYNAMIC PRICING OR PERSONAL DATA AND DIRECTLY OR INDIRECTLY ADVERTISE OR PROMOTE, INCLUDE ON A LABEL, OR PUBLISH ANY OTHER COMMUNICATION CONTAINING THE PRICE, UNLESS THE MERCHANT INCLUDES WITH THE ADVERTISEMENT, PROMOTION, LABEL, OR OTHER COMMUNICATION A CLEAR AND CONSPICUOUS DISCLOSURE WITH THE FOLLOWING STATEMENT:”

And the statement itself, verbatim and in the statute’s own capitals:

“THIS PRICE WAS SET BY AN ALGORITHM OR BY USING YOUR PERSONAL DATA”

Three things about that sentence are worth sitting with.

First, the trigger has two limbs joined by “or”: dynamic pricing or personal data. They are not the same thing, and the second does not depend on the first. A price set using a shopper’s personal data engages the duty on the face of the text whether or not the process also counts as dynamic pricing.

Second, the duty is not triggered by pricing. It is triggered by pricing and then communicating the price. The verbs are advertise, promote, include on a label, and publish any other communication containing the price. A price sitting in a database breaches nothing. A price rendered on a product page is a communication containing the price.

Third, unlike Connecticut’s, Maryland’s section does not limit itself to online conduct. Connecticut’s disclosure duty, in both of its versions, is expressly about advertising and labelling online. Maryland’s says any other communication.

What “clear and conspicuous” means here

Maryland defines it, which saves a lot of argument. Section 13-322(A)(2), verbatim:

“(I) IN THE SAME MEDIUM AS, AND PROVIDED ON, AT, OR NEAR AND CONTEMPORANEOUS WITH, EACH COMMUNICATION OF A PRICE FOR WHICH NOTICE IS REQUIRED; AND (II) USING LETTERING AND WORDING THAT IS EASILY VISIBLE AND UNDERSTANDABLE TO A CONSUMER.”

Note each communication of a price. Not a line in your terms, not a privacy-policy paragraph, not a banner on the home page. Same medium, same place, same moment as the price. On a storefront that means the collection grid tile, the product page, the cart line and the checkout summary are four communications of a price, and the text has to travel with each of them.

Who is out

Section 13-322(B) exempts four things, and no more:

• “CONDUCT OF A MERCHANT THAT IS REGULATED UNDER THE INSURANCE ARTICLE”;
• the food retailers and third-party food delivery providers already covered by section 13-321;
• “A FINANCIAL INSTITUTION, AS DEFINED IN § 1-101 OF THE FINANCIAL INSTITUTIONS ARTICLE”, or a financial institution or affiliate subject to Title V of the Gramm-Leach-Bliley Act;
• “A LOWER PRICE THAT IS OFFERED TO A CONSUMER WHO IS AN EMPLOYEE OF THE MERCHANT”.

There is no revenue threshold, no headcount threshold and no number-of-consumers threshold anywhere in section 13-322. We looked subsection by subsection. The exemptions are sectoral, exactly as Connecticut’s are. A two-person optical shop that ships to Maryland is covered on the same terms as a national chain.

Nor does section 13-322 contain any sentence limiting it to merchants established in Maryland, or to conduct occurring in Maryland. We looked for one and there is none. What the section does not say about geography, it leaves to the rest of the Consumer Protection Act and to ordinary principles about a state’s reach over sellers who market into it — which is a question for Maryland counsel, not for us.

The definitions it borrows

Section 13-322 does not define merchant. Title 13 of the Commercial Law Article — the Consumer Protection Act — does, at section 13-101, which opens “In this title the following words have the meanings indicated” and defines a merchant as “a person who directly or indirectly either offers or makes available to consumers any consumer goods, consumer services, consumer realty, or consumer credit”. That is about as wide as a retail definition gets. Caveat: the copy of section 13-101 we read is a commercial reproduction of the 2025 code and is not certified as current enacted text. Confirm it against the official code before you rely on the wording.

Personal data is also borrowed. Section 13-322(A)(5) says it “HAS THE MEANING STATED IN § 14-4701 OF THIS ARTICLE”, which is Maryland’s data-privacy definitional section: “any information that is linked or can be reasonably linked to an identified or identifiable consumer”, excluding “De-identified data” and “Publicly available information”.

This is the same structural move Connecticut made when it imported retail seller from its sales and use tax chapter, and it has the same consequence: the answer to am I covered is not in the pricing section. It is one or two statutes away.

Enforcement, and the forty-five days

This is where Maryland is genuinely more generous than either of the other two states, and it is the single most useful thing in the section.

“(D) (1) BEFORE INITIATING AN ENFORCEMENT ACTION UNDER SUBTITLE 4 OF THIS TITLE FOR A VIOLATION OF THIS SECTION, THE DIVISION SHALL ISSUE A NOTICE OF VIOLATION TO THE ALLEGED VIOLATOR. (2) THE DIVISION SHALL PROVIDE THE ALLEGED VIOLATOR 45 DAYS AFTER THE NOTICE OF VIOLATION IS RECEIVED TO CURE THE VIOLATION. (3) IF THE ALLEGED VIOLATOR CURES THE VIOLATION WITHIN THE TIME PERIOD SPECIFIED UNDER PARAGRAPH (2) OF THIS SUBSECTION, THE DIVISION MAY NOT INITIATE AN ENFORCEMENT ACTION FOR A VIOLATION OF THIS SECTION.”

A notice must come first. Forty-five days run from receipt. A cure inside the window does not mitigate the enforcement action; it bars it. “MAY NOT INITIATE” is not discretionary language.

One honest gap: the Act uses the term “THE DIVISION” without expanding it anywhere in the bill, and we did not establish from primary text which unit that is. Title 13 is administered through the Consumer Protection Division, and that is the obvious reading, but we did not verify it and we are not asserting it.

And there is no private right of action. The Act goes out of its way about this, amending two separate sections of the Consumer Protection Act to add the identical sentence “THIS SECTION DOES NOT APPLY TO A VIOLATION OF § 13-321 OR § 13-322 OF THIS TITLE” — once to section 13-408, which carries private remedies, and once to section 13-411. Section 13-321 adds its own belt-and-braces sentence: “THIS SECTION MAY NOT BE CONSTRUED TO AUTHORIZE A PRIVATE RIGHT OF ACTION UNDER THIS SECTION OR ANY OTHER LAW.”

Three states have now written a personalised-pricing label, and all three have closed the courthouse door to consumers while opening it to a regulator. That is not an accident of drafting any more.

The part of Maryland we could not resolve, and will not pretend to

Section 13-322’s first limb turns on dynamic pricing, which section 13-322(A)(4) defines by cross-reference: “DYNAMIC PRICING” HAS THE MEANING STATED IN § 13-321 OF THIS SUBTITLE.”

We went to section 13-321 to read it, and could not settle it. The enrolled bill as published renders as plain text, which loses strike-through markup, and the definition went through at least three rounds of renumbering. The paragraph number prints as “(3) (2) (3)”, and two items in the exclusion list print as “4. 8. 3.” and “5. 9. 4.” — three numbering schemes interleaved on one line. Two different substantive definitions appear in sequence, one about varying prices within the same business day and one about “OFFERING OR SETTING A PERSONALIZED PRICE FOR A GOOD OR SERVICE THAT IS SPECIFIC TO A CONSUMER BASED ON THE CONSUMER’S PERSONAL DATA”, and the exclusion list similarly contains more items than the final numbering can accommodate.

We cannot tell you from that document which text survived into law, so we are not going to tell you. If the scope of your Maryland exposure turns on the boundaries of dynamic pricing or on its exclusions — and for a store running loyalty pricing or published group discounts it very well might — read the codified section 13-322 and section 13-321, not the enrolled bill.

What that ambiguity does not touch is the second limb. “OR PERSONAL DATA” stands on its own in the prohibition and borrows its definition from a different article entirely. Whether the dynamic pricing exclusions also limit the personal data limb is an open question on the face of the text, and we flag it as open rather than answering it.

Part two: Connecticut wrote it twice

The correction we owe

In our post yesterday on Connecticut Public Act 26-64 we addressed a date conflict in the commentary — some sources putting Connecticut’s pricing rules at 1 October 2026, at least one putting them at 1 July 2027 — and we told you the 2027 date belonged to Section 20 of the same act, on the loudness of advertisements on streaming video services.

That explanation was wrong, and we are correcting it here and in that post.

The 1 July 2027 date that commentators attach to Connecticut surveillance pricing belongs to a surveillance-pricing provision. It is just in a different act. Public Act 26-130, House Bill 5563, a criminal-justice omnibus whose long title opens “AN ACT CONCERNING VARIOUS CRIMINAL LAW AND CRIMINAL JUSTICE PROPOSALS, CERTIFICATES OF APPROVAL FOR AIRPORTS,”, contains its own Section 11, and it opens:

“Sec. 11. (NEW) (Effective July 1, 2027) (a) As used in this section:”

It is a complete second surveillance-pricing regime. It defines surveillance pricing, imposes an online disclosure duty with a mandated sentence, prohibits retail sellers and third-party delivery services from engaging in surveillance pricing, carries its own exceptions and exemptions, and routes enforcement to the Attorney General alone.

And it never mentions Public Act 26-64. We searched the act for the string 26-64 and it does not appear. It does not repeal, amend or replace the section already in force.

We also checked the explanation we had given. The effective-date line of Section 20 of Public Act 26-64 reads “(Effective October 1, 2026)”, exactly like Section 11’s. Whatever internal compliance date sits inside that section, it was never the source of the conflict.

The lesson we are writing on the wall: we found the rival date inside the act we were already reading, and stopped. A coincidence is not an explanation. When two acts of the same session carry the same section number and the same subject, resolving the conflict inside one of them resolves nothing.

The two Connecticut sections, side by side

These are not duplicates. They differ in ways that change what a store has to do.

The ten months that matter

Put the retention exceptions next to each other and you get the practical point of this entire post.

Under the section in force now, the exception for a personalised discount aimed at keeping a customer covers a consumer service, for the purpose of retaining the customer. One category, one purpose.

Under the section arriving 1 July 2027, the same exception covers a consumer good or consumer service, for retaining, reestablishing, attracting, cross-selling or reengaging.

Frames are goods. Lenses are goods. Solution is a good. A box of contact lenses is a good.

So on the face of the two texts, a personalised win-back discount sized from a shopper’s behaviour and offered on goods sits outside the retention exception of the section in force between 1 October 2026 and 30 June 2027, and inside the retention exception of the section that starts the next day. The narrower regime is the live one. The drafting that fixes it is eight and a half months away.

That is a very unusual shape for a compliance problem, and it lands on the most widely installed category of e-commerce software there is — the cart-abandonment and win-back engine that watches what a shopper did and sizes a discount from it.

We are not telling you that running one breaches Connecticut law. Whether a given tool meets the surveillance pricing definition depends on its own collection behaviour, and the definition has two limbs joined by and. We are telling you that the exception most people would reach for does not say what they will assume it says, and that it says something different in 2027. We deliberately make no claim about how any named app behaves, because that would require reading that app’s own documentation, and we have not.

Which one applies on 1 July 2027

Both, on the face of the statute book, unless something changes. Two free-standing sections, neither repealing the other, overlapping in subject, differing in wording. One prescribes a sentence the other does not; each permits a substantially similar disclosure, which is the most plausible route to satisfying both with one line of text — but that is our reading of two texts, not a rule, and Connecticut counsel should be the one to confirm it.

What we would not do is assume the later act quietly replaced the earlier one. It does not say so, and legislatures that mean to repeal normally say the word.

Three states, three sentences, three enforcement postures

As of today, if you sell eyewear online into all three states and you set any price using a shopper’s personal data:

• New York wants “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA”, requires the disclosure and stops there — display it and you have complied. The Attorney General must send a cease and desist letter and allow a cure period before seeking an injunction or civil penalties. We make no claim about the date this took effect; we were not able to verify one.
• Maryland wants “THIS PRICE WAS SET BY AN ALGORITHM OR BY USING YOUR PERSONAL DATA”, in the same medium and contemporaneous with every price communication, online or off. Notice of violation first, then forty-five days, and a cure bars the action.
• Connecticut wants “THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA” online — and separately forbids retail sellers from doing the thing at all, with no cure period anywhere in the section. From 1 July 2027 a second section wants a shorter sentence and a pointer to the consumer’s statutory rights.

Notice the drift in the verbs. New York says the price was set. Maryland says it was set. Connecticut says it was increased — in both of its sections. Three legislatures looked at the same conduct and only one of them made the merchant concede the direction of travel.

And notice what Maryland adds to New York’s sentence. New York’s covers an algorithm. Maryland’s covers an algorithm or personal data, which is wider, and sits on a prohibition whose own trigger is dynamic pricing or personal data. A plain conditional rule written by hand into a pricing app is not an algorithm in any interesting sense, but a price set from a shopper’s data is a price set using personal data.

What we would actually do this week

1. Find out whether any price you publish is computed from anything you know about the individual shopper. Not whether you use artificial intelligence — none of these three statutes asks that. Connecticut’s live definition reaches “any automated or programmed process”, and Maryland’s prohibition reaches a price set “USING…PERSONAL DATA” full stop. A hand-written rule in an app qualifies.
2. Inventory where prices are communicated, not where they are calculated. Grid tile, product page, cart, checkout, email, feed, printed insert. Maryland’s disclosure has to travel with each communication; Connecticut’s duty attaches to online advertising, labelling and publication.
3. Re-read your win-back and cart-abandonment discounting against Connecticut’s live exception, not the 2027 one. The live one covers services.
4. Where you can, move personalised discounts onto published terms. Both Connecticut sections and — subject to the ambiguity we flagged — Maryland’s structure treat a discount differently when its eligibility criteria are posted publicly, anyone can satisfy them, and the discount is honoured for everyone who does. The line all three draw is between a price you publish and a price you compute for one shopper.
5. Check the codified Maryland sections before you build anything. We could not resolve the dynamic pricing definition from the enrolled bill and neither will you.
6. Diary 1 July 2027. Connecticut’s second section, and a different mandated sentence.

If you are already working through the fee and price-presentation questions, this sits alongside the FTC’s complaint against a contact lens retailer over a fee line below the fold and New York City’s cancellation rule. If your personalisation is fed by anything captured from a face, the biometric privacy position on virtual try-on is the other half of the same exposure.

What we do not know

Stated plainly, because a post like this is only as useful as its honesty about its edges.

• Which dynamic pricing text and which exclusions are law in Maryland. Unresolvable from the enrolled bill, as described above.
• Whether the dynamic pricing exclusions limit the personal data limb of the Maryland prohibition. Open on the face of the text.
• What “THE DIVISION” is, in the Act’s own words. Undefined in the bill.
• How Maryland’s section applies to a seller with no Maryland presence. The section contains no geographic limitation at all, which is a question rather than an answer.
• Whether the currency of the section 13-101 text we read is good. It is a commercial reproduction of the 2025 code.
• Which Connecticut section governs conduct on and after 1 July 2027, and whether a single line of disclosure can satisfy both.
• Whether a device that only ever discounts triggers either Connecticut disclosure duty, given that both prescribed sentences assert the price was increased. Unresolved, and we said so yesterday too.
• Whether any of the three states has begun enforcing. We found nothing.
• The New York effective date. Still unverified, so still unstated.

We will keep reading these as they move. Where we get something wrong, you will find the correction in the post itself, as you have in this one.

Sources: Maryland House Bill 895 of the 2026 regular session, enrolled bill, read directly, covering sections 13-321 and 13-322 of the Commercial Law Article and the amendments to sections 13-408 and 13-411; the Maryland General Assembly bill page for House Bill 895 for chapter number, approval date and effective date; section 13-101 of the Commercial Law Article and section 14-4701, via a commercial reproduction of the 2025 code, not certified current; Connecticut Public Act 26-64, Substitute Senate Bill 4, enrolled act, Section 11 and the effective-date lines of Sections 11 and 20; Connecticut Public Act 26-130, House Bill 5563, enrolled act, Section 11 in full; and our own earlier post on Public Act 26-64, corrected today.

This article is general information about regulatory developments, not legal advice, and it does not describe the compliance position of VisioncarePro or of any app. Pricing and consumer-protection statutes are being enacted and amended quickly, definitions differ between states that use near-identical words, and the operative text of a recently enacted section can differ from the enrolled bill. Verify every provision against the official code for the state concerned and take advice from counsel admitted there before changing how you price or what you disclose.