Colorado Just Outlawed Surveillance Pricing. Here's What It Means.

Person holding a credit card while looking at a laptop screen during an online shopping session

TL;DR: Colorado's legislature passed HB 1210, banning companies from using "surveillance data" (your browsing history, location, biometrics, device fingerprints, inferred health conditions) to set individualized prices or worker wages. The Senate passed it 19-15 on May 6, 2026. The House concurred on May 7. Governor Jared Polis has 30 days to sign or veto, and he hasn't said which way he's leaning. Maryland signed a food-only surveillance pricing ban on April 28, but Colorado's law covers every industry and includes a private right of action, meaning you can sue. Connecticut's SB-4 includes a similar ban and is also on the governor's desk. Three states, three bills, all within weeks of each other. The era of companies silently charging you more because an algorithm decided you'd pay it may be ending.

What Colorado Actually Banned

The concept is simple. You search for a flight to Denver. You check a hotel. You browse winter jackets. The airline's algorithm notices you've been searching obsessively for three days, that your IP address is in a high-income zip code, and that you're using a MacBook. So it charges you $847. The person next to you, searching for the same flight on an Android phone from a different zip code, pays $612.

That's surveillance pricing. And Colorado just said: not here.

HB 1210 targets "surveillance data": a deliberately broad term covering information gathered through observation, inference, or monitoring of personal characteristics, online behaviors, or biometrics ^[1]. That includes:

Browsing and search history: what you looked at, how long you looked, how many times you came back
Location data: where you live, work, and shop
Biometric information: facial recognition, fingerprints, voice patterns
Device fingerprinting: what hardware and software you use
Inferred characteristics: health conditions, income estimates, family structure, all derived from your data trail

Companies can't feed any of this into an algorithm that spits out a personalized price. Period.

It's Not Just Prices. It's Wages Too.

Here's where Colorado went further than anyone expected. HB 1210 also bans algorithmic wage setting based on surveillance data. Employers can't use your browsing habits, financial status, or social connections to decide what to pay you ^[2].

The Colorado Chamber of Commerce warned the bill's definitions are broad enough to capture "common tools such as scheduling systems, HR software and performance analytics platforms" ^[3]. That's their way of saying the law might actually work. When business groups complain a privacy law is too broad, it usually means it's broad enough to matter.

The wage protections include sensible carve-outs: seniority-based pay, task-specific compensation, and performance reviews based on actual job performance are all fine. What's banned is using surveillance data (your online behavior, inferred income, demographic profile) to algorithmically low-ball your salary.

The Part That Makes It Dangerous: You Can Sue

Maryland's surveillance pricing ban, signed by Governor Wes Moore on April 28, was the first in the nation. But it only covers food retailers with 15,000+ square feet. No private right of action. Enforcement depends entirely on the state attorney general. Penalties cap at $10,000 per violation, $25,000 for repeat offenders ^[4].

Colorado's version has teeth.

Violations are classified as deceptive trade practices under the Colorado Consumer Protection Act. The attorney general and district attorneys can bring civil actions. But the real kicker: HB 1210 establishes a private right of action. You, personally, can sue. You can bring a class action. You can recover damages, costs, and attorney fees ^[1].

That changes the math completely. A $10,000 state penalty is a rounding error for airlines and hotel chains. A class action from millions of customers who got charged different prices for the same product? That's existential.

Industry knows it. The Travel Tech association and the Chamber of Progress both urged Governor Polis to veto the bill, specifically citing the consumer pricing provisions ^[3]. When two separate industry groups lobby the governor to kill a bill, the bill is probably working.

How Bad Is Surveillance Pricing? 23% Bad.

Consumer Reports published an investigation in December 2025 that put hard numbers on what surveillance pricing actually costs. They found Instacart's algorithmic pricing created price differences of up to 23% for identical products. Same item, same store, different price, based on who was buying ^[5].

Over a year, that adds up to $1,200 per family.

Airlines have been doing it forever. Hotels do it. Insurance companies do it. E-commerce platforms do it. Amazon has been accused of adjusting prices based on a user's browsing history and purchase patterns. Uber's surge pricing is a public version of the same idea, but at least Uber tells you.

The core problem: surveillance pricing happens in secret. You never see the other price. You never know you paid more. The algorithm decides what you're worth, and you pay whatever it says.

Consumer Reports called HB 1210 a bill that will "protect consumers from pricing practices that companies deploy in secret" ^[5]. That's understated. It's a bill that makes secret pricing illegal.

Three States, Three Bills, Three Weeks

Colorado didn't move alone. The timeline tells a story:

April 28: Maryland Governor Wes Moore signs HB 895, the Protection From Predatory Pricing Act. Food-only. No private right of action. Takes effect October 1, 2026 ^[4]
May 4: Connecticut's House passes SB-4, 141-6. Includes a surveillance pricing ban alongside a data broker registry and centralized data deletion mechanism. Awaiting Governor Lamont's signature ^[6]
May 6-7: Colorado's Senate passes HB 1210, 19-15. House concurs on amendments. Broadest coverage of the three: all industries, plus wage-setting, plus private right of action ^[1]

California, Illinois, New Jersey, New York, and Pennsylvania all have similar bills in the pipeline ^[5]. This isn't a one-state experiment. It's a wave.

And the federal backdrop makes it more urgent. The SECURE Data Act, introduced by House Republicans in April, would preempt all state privacy laws (including these surveillance pricing bans) and replace them with weaker federal standards. If the SECURE Data Act passes, Colorado's HB 1210 dies on arrival.

What's Still Allowed

The bill isn't a ban on all price variation. It carves out:

Supply-and-demand pricing: charging more during peak demand is fine, as long as it applies equally
Loyalty and rewards programs: earn-your-discount models are explicitly protected
Group discounts: student, military, senior, and bulk pricing stays
Location-based availability: using your zip code to determine whether a service is offered (not to determine the price)
Need-based programs: income-qualified discounts and assistance programs
Good-faith customer service credits: reps can still cut you a deal

The carve-outs are smart. They protect legitimate business practices while closing the loophole that lets companies charge you more because an algorithm profiled you.

The Governor Problem

None of this matters if Polis vetoes it.

Governor Jared Polis hasn't said publicly whether he'll sign HB 1210. His office told the Denver Post in April that he's "concerned about policies that interfere with the free market" ^[7]. That's not a veto signal, but it's not a signature either.

Polis has 30 days from when the bill hits his desk. He can sign it, veto it, or let it become law without his signature. If he does nothing, it becomes law anyway.

The political pressure cuts both ways. Consumer groups want a signature. Industry lobbyists want a veto. And Colorado already passed a sweeping AI Act (SB 189) this session that Polis signed, suggesting he's not allergic to tech regulation. But surveillance pricing hits different industries (airlines, hotels, e-commerce) that generate significant tax revenue and employment.

If Polis signs, the law takes effect in August 2026 ^[3]. Colorado becomes the first state with a comprehensive, cross-industry surveillance pricing ban with real enforcement teeth.

What You Can Do Right Now

If you're in Colorado: Contact Governor Polis's office. The bill is on his desk. Constituent pressure matters during the 30-day signing window. Call (303) 866-2471 or use the governor's contact form
Use a VPN when shopping online. Surveillance pricing relies on knowing who you are. A VPN masks your IP address and location. It won't stop all tracking, but it removes one of the biggest pricing signals
Shop in private/incognito mode. Clear cookies between shopping sessions. Use different browsers for research and purchasing. Price-comparison tools like Google Shopping show you what other people pay
Opt out of data brokers. The less data in circulation about you, the fewer data points algorithms can use against you. The same broker data also feeds government surveillance purchases. Services like DeleteMe and DataPurge automate this
Check if your state has a bill pending. California, Illinois, New Jersey, New York, and Pennsylvania all have surveillance pricing legislation in the pipeline. Find your legislators and tell them you want it

The Bottom Line

For years, companies have charged you different prices based on what their algorithms know about you, and you never had any way to know it was happening, let alone fight back. Three states just decided that's not okay.

Maryland went first but stayed narrow. Connecticut went broad but bundled it into a larger privacy package. Colorado went all in: every industry, wages included, and a private right of action that turns every affected consumer into a potential plaintiff.

The question now is whether Governor Polis signs. If he does, August 2026 becomes the month surveillance pricing starts dying in America. If he vetoes, it becomes a campaign issue in every state with a pending bill. Either way, the companies that built their pricing models on your data just got put on notice.

References

Published: May 13, 2026