The price board knows more about your customer than you think
The FTC calls it surveillance pricing. The cannabis industry calls it smart discounts. Same thing, different vocabulary, and the gap between those two names is where compliance careers go to die.
In January 2025, the Federal Trade Commission released findings from its 6(b) surveillance pricing study, revealing that companies use granular personal data like precise location, browsing behavior, and demographics to set individualized prices for different customers. A year later, reporting indicates the FTC has moved beyond study mode and opened an active probe into AI-driven tools that generate different prices for different buyers.
Cannabis dispensaries are walking straight into this probe. They collect loyalty program data, purchase histories, consumption preferences, and demographic details. POS platforms like Flowhub, Sweed, and Mosaic are adding AI pricing tools that use exactly the kind of consumer data the FTC flagged.
Industry projections suggest AI will influence 40 to 60 percent of cannabis transactions by the end of 2026. Nobody is checking whether that pricing engine also triggers a federal investigation.
What Dispensaries Are Already Doing
The cannabis retail pricing data from Cannabis Industry Journal's US Cannabis Price Index shows dispensaries are already running aggressive, data-driven discount strategies. Pre-roll prices dropped 62 percent in a single week in January 2026, paired with nearly 20 percent discounting.
THC flower held at $62.35 with sub-1 percent discounts. CBD capsules showed 30 percent discount rates.
These are not random promotions. Dispensaries are using purchase history, loyalty tier, basket composition, and visit frequency to decide who gets which price. That is the textbook definition of surveillance pricing.
Loyalty data in, different prices out
The POS vendors are not hiding this. Flowhub advertises AI that scans customer data and inventory to provide personalized suggestions. Sweed markets AI that analyzes customer data to optimize pricing. Mosaic publishes case studies on AI-driven dynamic pricing for cannabis retailers. The tools exist, the adoption is accelerating, and the compliance question is an afterthought.
The same loyalty data that powers your discount engine is the data the FTC says can make individualized pricing unfair.
The Loyalty Data Trap
Cannabis dispensaries have a data problem most retailers do not. In states like California, Nevada, and Colorado, dispensaries are required to track purchases and verify customer identity. That means your POS system contains purchase history tied to a real person, with a real government ID, buying a product that is still federally regulated.
Under the California Consumer Privacy Act (CCPA), purchase history tied to an individual is personal data. Cannabis purchase patterns can reveal health conditions, consumption habits, and behavioral patterns. That makes it sensitive data under privacy law, which carries stricter consent and disclosure requirements than ordinary retail data.
The California AG has already issued CCPA non-compliance notices to businesses operating loyalty programs that fail to meet financial incentive disclosure requirements. California's Delete Act adds another layer: cannabis loyalty programs that store and share consumer data may need to register as data brokers and honor deletion requests.
The tablet knows what this customer paid last time
If your dispensary is using that loyalty data to feed an AI pricing algorithm that charges different prices to different customers, you have stacked three compliance regimes on top of each other. Cannabis regulations govern what you can sell and how. Privacy laws govern what data you can collect and use.
Algorithmic pricing rules govern how you can use that data to set prices. Most operators are checking the first one and ignoring the other two.
Three compliance regimes, one data pipeline
State Laws You Probably Have Not Heard Of
Editor's Note: New York's Algorithmic Pricing Disclosure Act took effect in November 2025. It applies to any retailer using personal data to set individualized prices for customers in New York, regardless of where the retailer is located.
New York's law requires a conspicuous, all-caps disclosure: "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA." The law is the first of its kind in the United States, and a legal challenge remains on appeal, but the disclosure requirement is currently in force.
California Attorney General Rob Bonta announced an investigation into how businesses use personal data to set targeted prices. His office has issued inquiry letters to grocers, hotels, and retailers with significant online presence, requesting detailed information on pricing experiments, data usage, and compliance measures.
As of March 2026, four state laws specific to data-driven pricing have been enacted. The regulatory direction is clear: if you use consumer data to set individualized prices, you will need to disclose it, document it, and justify it.
Cannabis dispensaries operating in multiple states face a patchwork. California requires loyalty program financial incentive disclosures. New York requires algorithmic pricing disclosures.
Other states are drafting similar legislation. If your AI pricing tool charges a customer in Sacramento a different price than a customer in Buffalo for the same eighth of flower, both state laws may apply simultaneously.
The menu shows one price. The POS might charge another.
The Triple Bind Nobody Is Talking About
Most cannabis compliance conversations focus on state cannabis regulations and advertising restrictions. The surveillance pricing issue sits outside that conversation, but it is arguably more dangerous because it is unexpected.
Here is the triple bind:
| Compliance Layer | What It Covers | Who Enforces |
|---|---|---|
| Cannabis regulations | Product sales, advertising, age verification | State cannabis boards |
| Data privacy laws | Consumer data collection, loyalty programs, deletion rights | State AGs, CPPA |
| Algorithmic pricing rules | Individualized pricing using personal data | FTC, state AGs, new state laws |
A dispensary using AI dynamic pricing can be fully compliant with cannabis regulations and still face FTC enforcement for unfair pricing practices. It can pass a state cannabis board audit and still receive a CCPA non-compliance notice from the California AG. It can have a perfect advertising compliance record and still violate New York's Algorithmic Pricing Disclosure Act.
The enforcement pathways are separate. The penalties are separate. And most dispensaries have not mapped which of their tools trigger which rules.
What Operators Should Do Now
You do not need to rip out your pricing tools. You need to build the compliance layer around them.
Audit your data inputs. List every data field your AI pricing tool uses. Purchase history, loyalty tier, visit frequency, basket size, location, device type. For each field, document the legal basis for collecting and using it. If you cannot identify the legal basis, that data should not feed your pricing engine.
Check your vendor contracts. Your POS or pricing vendor should indemnify you against regulatory action caused by their algorithm. Most do not. If your contract says "customer is responsible for compliance," you are holding all the risk. Renegotiate or add a compliance addendum before the FTC sends its first letter.
Implement disclosure where required. If you operate in New York and use personal data for individualized pricing, you need the algorithmic pricing disclosure posted at the point of sale. If you operate in California and run a loyalty program, you need the financial incentive notice. Do not wait for enforcement to find out what you missed.
Separate compliance data from marketing data. The purchase tracking data you are required to collect for state cannabis compliance is not the same as the behavioral data you use for pricing optimization. Mixing them creates legal exposure. Store them separately, document the separation, and make sure your AI pricing tool only accesses the marketing-approved dataset.
Build a pricing decision log. When the FTC or a state AG asks how your pricing algorithm works, "the AI did it" is not an acceptable answer. You need a log showing what data was used, what the algorithm decided, and why a specific customer received a specific price. Start logging now, even if the process is manual at first.
The Quiet Before the Letter
The FTC's surveillance pricing probe is expanding. State laws are multiplying. Cannabis dispensary AI adoption is accelerating. These three lines are converging, and the intersection point is a compliance event that most operators have not prepared for.
The dispensaries that will be fine are the ones that treat AI pricing as a regulatory question, not just a revenue optimization question. The ones that will not be fine are the ones who discover the rules exist when the letter arrives.
If you want to understand how cannabis loyalty data already creates privacy exposure beyond pricing, read our breakdown of the loyalty data privacy trap. For the broader FTC personalization liability picture, see our analysis of AI personalization and FTC enforcement risk.
And if you are still building your compliance foundation, start with the cannabis AI compliance gap that most operators miss entirely.
Frequently Asked Questions
What is surveillance pricing in cannabis?
Surveillance pricing is when a dispensary uses a customer's personal data (purchase history, loyalty tier, location, browsing behavior) to set individualized prices through an AI algorithm. The FTC has identified this practice as a potential consumer protection risk and is actively investigating companies that use these tools.
Does the FTC's surveillance pricing probe apply to dispensaries?
Yes. The FTC's 6(b) study and subsequent probe cover any company using personal data to set individualized consumer prices. Cannabis dispensaries that use AI pricing tools fed by loyalty program data fall within this scope. The FTC has not carved out any industry exemptions, and cannabis retailers are not excluded from consumer protection enforcement.
What does New York's Algorithmic Pricing Disclosure Act require?
The law requires retailers using personal data to set individualized prices to post a conspicuous disclosure reading "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA." It took effect in November 2025 and applies to any retailer serving customers in New York, regardless of where the business is located.
Can cannabis dispensaries use AI for dynamic pricing legally?
Yes, but with conditions. Dynamic pricing itself is not illegal.
The legal risk comes from using personal data without proper disclosure, using sensitive data (like cannabis purchase history) without adequate consent, or failing to meet state algorithmic pricing transparency requirements. Operators should audit their data inputs, implement required disclosures, and maintain a pricing decision log.
What should a cannabis dispensary do if it is already using AI pricing?
Start with a data audit. Map every data field your pricing tool uses and document the legal basis for each. Check whether you need algorithmic pricing disclosures in the states where you operate. Review your vendor contract for indemnification. Build a pricing decision log so you can explain how specific prices were set if regulators ask.