Why It Matters: As businesses increasingly rely on AI and algorithmic models to optimize pricing and labor costs, state legislatures are drawing strict boundaries around the data fueling these systems. Colorado has just passed groundbreaking legislation (HB26-1210) targeting "surveillance pricing," setting a new, high-stakes compliance benchmark for companies operating across the U.S.

The Development: The Colorado legislature has officially passed a landmark bill aimed at prohibiting companies from utilizing "surveillance data"—defined broadly as information gathered through observation, inference, or monitoring of personal characteristics, online behaviors, or biometrics—to set individualized prices for consumers or wages for workers.

Targeting "automated decision systems," the legislation sharply curtails the use of artificial intelligence, statistical modeling, and data analytics to process sensitive personal data for dynamic pricing and compensation structures.

For compliance teams and legal counsel, there are several critical takeaways:

• High-Risk Enforcement: Violations are classified as deceptive trade practices under the Colorado Consumer Protection Act. Crucially, the bill empowers not just the Attorney General and district attorneys to seek civil penalties, but it also establishes a private right of action, exposing companies to class-action litigation risk.

• Broad Scope of Data: The definition of surveillance data intentionally captures browsing histories, inferred health conditions, income estimates, and demographic information.

• Employment Implications: The restriction explicitly extends to the workforce, barring the use of surveillance data for individualized wage setting. Employers can only use task-specific data for compensation if there is clear, upfront disclosure to the worker.

• Strategic Carve-Outs: The bill provides necessary exceptions for standard supply-and-demand pricing, commonly understood group discounts, loyalty and rewards programs, and location data used strictly to determine jurisdictional availability.

Looking Ahead: Colorado is acting as the tip of the spear, but they will not be the last. With similar legislative efforts gaining momentum in California, Illinois, New York, and other jurisdictions, companies deploying dynamic pricing or automated wage algorithms must urgently audit their data pipelines.

Understanding exactly what data feeds your AI systems—and whether those inputs could be construed as "surveillance data" under this new standard—is the critical first step to mitigating regulatory and litigation exposure in an increasingly scrutinized digital economy.