FTC Proposes Personalized Pricing Disclosure Policy as Connecticut Settles with TaxAct Over Pixel-Sharing of Taxpayer Data

Do you want to receive these privacy recaps in your inbox each week? Subscribe here or follow us on LinkedIn.

The Federal Trade Commission released a proposed Enforcement Policy Statement on personalized pricing for public comment. Meanwhile, Connecticut’s Attorney General announced a $275,000 settlement with TaxAct over improper disclosure of taxpayer data to Meta and Google.

Keep reading to discover my analysis and takeaways.

United States

FTC Proposes Personalized Pricing Enforcement Policy

The FTC’s proposed statement says Congress hasn’t authorized the Commission to prohibit personalized pricing in all circumstances, but treats inadequately disclosed personalized pricing as likely unfair or deceptive under FTC Act Section 5. Where consumers reasonably expect a price to be static or widely offered, a business charging a data-driven personalized price should clearly and conspicuously disclose that fact, the basis for the personalization, and the types of data used. Illustrative scenarios in the statement include a food delivery company inferring a customer can’t easily leave home, a grocery chain inferring children in the household, and a hotel inferring a funeral trip. 

As a policy statement, it confers no rights, doesn’t bind the FTC or the public, and requires the Commission to prove a violation of existing law in any enforcement action. The 30-day comment period begins once the statement is published in the Federal Register, after which the Commission could adopt, revise, or drop it.

Takeaway

The FTC’s approach is disclosure-based rather than a categorical ban, similar in spirit to New York’s current law, though the FTC also declines to say whether some fully disclosed personalized pricing could still be unfair. It’s a lighter touch than the prohibition regimes in Maryland, New Jersey, and Connecticut, or the one New York’s pending bill would establish. And unlike those state laws, which are tied to an algorithm requirement, a data-collection method, or a named sector like groceries or tangible-goods retail, the FTC’s approach has none of those limits.

The biggest net-new element, if adopted, is the granularity of the required disclosure. No enacted state personalized pricing law requires an explanation of the pricing decision. New York and Connecticut require a fixed disclosure statement, but neither requires explaining why a price was personalized or what data drove it. The FTC’s proposal leans toward a contextual explanation of the basis and the data type involved. The second net-new element is geography: a finalized FTC statement wouldn’t itself create a binding nationwide duty, but because Section 5 applies nationally within the FTC’s jurisdiction, it would announce a federal enforcement position extending well beyond the handful of states with pricing laws today. Companies already complying with New York’s disclosure banner have a head start, and should be preparing now for Connecticut’s forthcoming one. But even a complete disclosure may not be a safe harbor, since the FTC reserves judgment on whether some disclosed personalization could still be unfair.

United States

Connecticut Settles with TaxAct Over Pixel-Sharing of Taxpayer Data

Connecticut’s Attorney General announced a $275,000 settlement with TaxAct resolving allegations that, between January 2018 and December 2022, the company used Meta and Google tracking technologies for internal analytics and marketing and, in doing so, improperly disclosed detailed taxpayer financial data to those platforms, including rounded adjusted gross income, rounded refunds or amounts owed, and information about dependents, charitable contributions, investment income, and mortgage or student loan interest.

The AG’s office found that TaxAct’s contract with Meta placed no limits on Meta’s ability to use the data for its own purposes or share it further, that TaxAct never told taxpayers before sharing their information, and that this ran contrary to TaxAct’s own privacy notices. Beyond the payment, the settlement requires TaxAct to stand up a review committee, adopt written policies for approving new or changed trackers, document the specific data points each technology can access, deploy a monitoring system to scan for configuration drift, and undergo two independent third-party audits of its tracking program.

Takeaway

This is the fourth matter arising from the same underlying conduct: an FTC warning to five tax-prep companies in 2023, Missouri’s 2023 lawsuit and $195,000 settlement with TaxAct, a $14.95 million private class settlement approved in December 2024, and now this more detailed Connecticut settlement. Together they tell a consistent story.

Data collected in a confidential context, like tax prep, is treated as purpose-bound. Using it for marketing or handing it to an ad platform for the platform’s own use requires specific consent in most circumstances, not just a privacy-policy disclosure. Don’t assume a tracker is compliant just because it’s labeled “analytics”: Connecticut’s order describes TaxAct running the same Meta and Google technologies for both internal analytics and marketing, and treated the disclosure as improper either way. Vendor contracts matter too. Connecticut specifically flagged that TaxAct’s agreement with Meta didn’t restrict Meta’s downstream use of the data, and that gap between installing a service provider and actually restricting what they can do with the data is a recurring regulatory focus.

The Connecticut remedy is also a useful blueprint for what regulators now expect as a baseline governance program: a documented approval process for any new or changed tracker, a documented inventory of the data points each one tracks, regular monitoring for drift, and independent audits, not a one-time tag review. This conduct ended in 2022 but is still generating enforcement in 2026.

A Little More Privacy, if You Please

• Apple commits to German court to change ATT consent requests
• South Korea assembly approves PIPA amendment to establish AI legal basis
• Justice Department Secures $400M Settlement with TikTok and ByteDance to Resolve Children’s Privacy Litigation

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.