The Federal Trade Commission wants to know whether the price you see for a flight, a ride or a basket of groceries depends on who you are, and whether the same is true of what a delivery driver gets paid. On Oct. 28 the agency issued orders to nine large consumer-facing companies: Delta, United, JetBlue, Lyft, Uber, DoorDash, Instacart, Target and Walmart. Each must describe the inputs, tools and procedures it uses to set pricing and compensation.
The Commission voted 2-0 to issue the orders, according to the FTC's press release (via mirror). Recipients have 45 days from the date they receive the orders to respond.
The inquiry is more direct than the FTC's last look at the subject. Below is what the agency is asking, what the companies have said publicly, and why it matters to the people who run data systems at companies like these.
What exactly did the FTC do?
The orders were issued under Section 6(b) of the FTC Act, which lets the Commission require companies to hand over information for a study. That is different from a lawsuit or a complaint. MarketScale notes that these are study orders, not enforcement, and that the FTC has accused none of the recipients of wrongdoing.
A study order is still compulsory. As The Record reported, the nine firms have 45 days to respond, and if they don't, the agency can force them to comply in federal court.
The inquiry covers two sides of the market at once: what consumers are charged, and what gig workers are paid. On the pay side, the FTC release says ride-share and food-delivery companies may pay workers shifting compensation offers based on opaque formulas, potentially using drivers' personal data such as phone usage or their history of accepting past offers.
FTC Chairman Andrew Ferguson framed the effort as a way to "scrutinize the opaque methodology" that some companies in these industries may be using, according to the agency's release.
Why start over?
This is the second FTC study of what it calls personalized pricing, and the agency is openly critical of the first one.
In July 2024 the Commission sent orders to eight intermediary firms: companies that build or sell pricing tools rather than set prices themselves. The Record reports that then-Chair Lina Khan released preliminary findings from that study in January 2025, that Ferguson objected to them, and that he later announced he was closing the probe.
The new press release explains why. Because the 2024 study covered middlemen, the FTC says it "learned nothing about actual pricing decisions." This round goes straight to the companies that set the prices and pay people.
The study also isn't the only thing the FTC is doing on this topic. In August the agency invited public comment on a proposed enforcement policy statement describing how the undisclosed use of personal information to set a price unique to a consumer could violate the FTC Act, per both the FTC release and The Record. A policy statement explains how the agency intends to apply the law. The 6(b) study and that proposal are separate tracks, but together they show where the Commission is focused.
What have the companies said?
Several recipients have publicly denied setting prices for individuals based on their personal data, though not all of them have commented. MarketScale compiled the public record:
- Walmart: a Sept. 25 letter from the CEO said the company prices the product, not the person.
- Target: updated a pricing fact sheet on Oct. 15 addressing its pricing practices.
- Delta: told the Associated Press it has no individualized fare product in use, in testing or planned.
- JetBlue and Instacart: also gave statements reported by the AP.
- United, Lyft, Uber and DoorDash: the AP report did not include statements from them.
MarketScale also points out that the FTC announced the orders one day before DoorDash and Instacart announced an agreement for DoorDash to buy Instacart. The FTC has not connected the deal to the study, and nothing in the agency's release refers to it.
What It Means for Defenders
This story has no CVE and no patch. It is a regulatory demand for information, and for security, privacy and data-engineering teams that is its own kind of exposure. Below is who is affected and what to check.
Who is directly affected. The nine named companies have 45 days to describe their pricing and compensation inputs, tools and procedures to a federal regulator, and the FTC can seek to compel compliance in federal court if they don't. Inside those companies, the teams that own customer data pipelines, pricing models and driver-pay systems will be the ones who have to produce accurate answers quickly.
Who is indirectly affected. Any business that feeds customer or worker data into pricing or pay decisions should read this as a signal. The FTC's August proposed enforcement policy statement targets undisclosed use of personal data in pricing. The 6(b) study is how the agency is gathering information about how these systems actually work. The agency said its 2024 study of intermediaries taught it nothing about actual pricing decisions, so businesses that license third-party pricing tools should assume they may be asked what their vendor's tool uses as inputs, and may not know the answer today.
What to check now:
- Inventory the inputs. Document which data fields reach any system that sets a price, a discount, a fee or a worker's pay. The FTC's orders ask for exactly this: inputs, tools and procedures. If you can't list them, you can't answer a regulator, and you can't defend the system either.
- Map vendor tools. Where a third-party product makes or influences pricing decisions, find out what data you send it and what it returns. Get that in writing.
- Check disclosures against practice. Since the proposed policy statement is about undisclosed personal-data pricing, compare what your privacy notices and terms say with what your pricing systems actually consume.
- Keep the paper trail. Retain model documentation, change logs and access records for pricing and pay systems, so that you can answer a request for information on a short timeline.
- Treat pricing data as sensitive. Data that can shift what a specific person pays or earns deserves the same access controls and logging as other regulated personal data.
For consumers and gig workers: the sources give no remedy or opt-out. What the study finds, and what the agency does after the August comment process, will determine whether disclosure rules or enforcement follow.
What happens next
The clock started with the Oct. 28 orders. After the companies respond, the FTC is expected to analyze what it receives, though the release does not say what the agency will publish when the study is complete. Separately, the agency has a proposed policy statement out for public comment since August. Neither step is an accusation. But this time the Commission is getting its answers from the companies that set prices and pay workers, not from the vendors behind them, and it has said plainly that it wants to see inside methods it calls opaque.
