New York’s Algorithmic Pricing Disclosure Act Takes Effect

By Felicity Slater, Sam Castic, Clara De Abreu E Souza

New York's Algorithmic Pricing Disclosure Act, signed into law by Governor Kathy Hochul on May 9th, 2025, officially took effect this week. The act regulates algorithmic pricing and requires covered entities to clearly and conspicuously disclose to consumers when such pricing methods are used.

Six days before the law was originally to take effect, it faced a First Amendment challenge from the National Retail Federation, which argued that the mandated disclosures constituted compelled speech. However, the U.S. District Court for the Southern District of New York upheld the law, allowing enforcement to proceed. 

Scope

The Act applies to entities that use “Personalized Algorithmic Pricing,” which the law defines as “dynamic pricing set by an algorithm that uses personal data,” to determine the cost of goods or services offered to consumers in New York.

The Act broadly defines personal data as “any data that identifies or could reasonably be linked, directly or indirectly, with a specific consumer or device,” excluding certain location data used by ride and transportation services “solely to calculate the fare based on mileage and trip duration between the passenger's pickup and drop-off locations.”

Other key terms clarifying the scope include:

• “Algorithm” defined as, “a computational automated process that uses a set of rules to define a sequence of operations.”

• “Dynamic Pricing” defined as “pricing that fluctuates dependent on conditions.”

Disclosure Requirement

Covered entities must clearly and conspicuously display that "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA” along with their display of the offered, algorithmically set price.

Exemptions

The Act exempts entities subject to New York State’s insurance law, the Gramm-Leach-Bliley (GLBA), and New York State-regulated financial institutions, as well as pricing offers made to customers with subscriptions that are lower than their current subscription cost.

Enforcement

The New York Attorney General’s Office (OAG) has enforcement authority under the Act. The OAG must give alleged violators notice and the chance to cure alleged violations. If entities fail to cure violations, the OAG may ask a court to enjoin the activity. The court issuing this injunction may also impose civil penalties of up to $1,000 per violation.

Attorney General Letitia James has signaled her office’s readiness to enforce the new law. She has encouraged consumers who suspect that a company uses their personal data with algorithms to set prices without being properly informed of this practice to file complaints with her office. 

Hintze Law PLLC is a Chambers-ranked and Legal 500-recognized, boutique law firm that provides counseling exclusively on privacy, data security, and AI law. Its attorneys and data consultants support technology, ecommerce, advertising, media, retail, healthcare, and mobile companies, organizations, and industry associations in all aspects of privacy, data security, and AI law. 

Felicity Slater is an Associate at Hintze Law PLLC with experience in global data protection issues, data breach notification laws, privacy impact assessments, GDPR, and privacy statements.

Sam Castic is a Partner with Hintze Law, chair of the firm’s Retail Group, and co-chair of the Cybersecurity and Breach Response Group and FinTech + Financial Services Group. As a former chief privacy officer, he helps companies build, scale, and right-size privacy programs and strategies.

Clara De Abreu E Souza is an Associate at Hintze Law PLLC. She has experience with artificial intelligence, data privacy, and the regulation of emerging technologies, including evolving state and federal privacy laws, algorithmic accountability, and health data governance.

Washington Marijuana Retailer Sued Under My Health My Data Act for Website Pixel Use

by Sam Castic and Felicity Slater

A class action suit was recently filed against the companies that operate Uncle Ike's, a Seattle-area marijuana retailer. The suit filed in Washington federal court alleges common law tort claims, ECPA claims, and a claim under the My Health My Data Act (‘MHMDA’ or ‘the Act’). 

Unlike the MHMDA claims that have been brought to-date against other companies that seem to allege MHMDA violations as something of an afterthought, the complaint brought against Uncle Ike’s makes a number of allegations in support of the MHMDA claim. In particular, the complaint alleges that:

• the Uncle Ike's website accepted online purchases of marijuana products, including medical marijuana products, and permitted medical marijuana card appointment scheduling;

• information about these transactions was shared with Google via pixels and other tracking technologies; and

• Uncle Ike’s online privacy policy said that sensitive personal data would be kept private.

To bring a claim under MHMDA, plaintiffs must demonstrate that they have suffered a "harm to business or property" under the Washington Consumer Protection Act (WCPA) that was caused by defendant's violation of MHMDA. Here, plaintiffs allege that Uncle Ike’s disclosure of their sensitive information without consent has caused “numerous injuries,” including “invasion of medical privacy,” “diminution of value of the[ir] Sensitive Information,” and “continued and ongoing risk to their Sensitive Information.” The court’s receptivity to these allegations of harm will be significant and may create a playbook for future MHMDA plaintiffs.

If your company has a website or app that sells even tangentially health-related products, shares medical or health related content, or allows appointment scheduling for medical appointments, this lawsuit is a good reminder to:

• Assess which data involved in these activities is "health data" under laws like the MHMDA; and

• Confirm that appropriate consents and authorizations are obtained before that data is "sold" to third parties, including for targeted advertising purposes (under MHMDA, the required authorizations may be impractical to obtain in the website or mobile app context).

You can read the plaintiff law firm's announcement here. If you need a refresh on MHMDA, check out our blog series here.

Hintze Law PLLC is a Chambers-ranked and Legal 500-recognized, boutique law firm that provides counseling exclusively on privacy, data security, and AI law. Its attorneys and data consultants support technology, ecommerce, advertising, media, retail, healthcare, and mobile companies, organizations, and industry associations in all aspects of privacy, data security, and AI law. 

Sam Castic is a Partner with Hintze Law, chair of the firm’s Retail Group, and co-chair of the Cybersecurity and Breach Response Group and FinTech + Financial Services Group. As a former chief privacy officer, he helps companies build, scale, and right-size privacy programs and strategies.

Felicity Slater is an Associate at Hintze Law PLLC with experience in global data protection issues, data breach notification laws, privacy impact assessments, GDPR, and privacy statements.