Shop like it's 1999 (a consumer playbook to outsmart surveillance pricing)

This week a Senate Judiciary subcommittee spent an afternoon on surveillance pricing, the practice of using what a company knows about you to decide what you, specifically, should pay. The examples were concrete. Staples charged different prices based on a shopper's IP address, and one Kroger customer discovered the company held a 62-page profile on her. Three states now have laws on the books restricting it, Seattle votes on a city ordinance this week, and Senator Hawley says a federal bill is coming.

All of that is progress, and I'm glad the machinery of government is finally grinding on this. But laws take years, they arrive full of carve-outs, and in the meantime the pricing algorithms are running right now, tonight, on your next grocery order and your next subscription renewal. Nearly all of the coverage describes the problem or handicaps the legislation. Almost none of it answers the question I'd want answered first. What can I actually do about this today?

Quite a lot, it turns out. The Mozilla Foundation ran a practical guide on exactly this in July, "How to Skip Surveillance Pricing," built on advice from security folks, advocates, and ordinary shoppers, and it's the best starting point I've seen. I'm going to borrow its skeleton, add what I've learned from months of tracking this beat, and organize it around a simple idea. These systems price the profile they hold on you. Make that profile thinner, blurrier, or wrong, and the price they compute drifts away from anything that describes you. Put differently, most of what follows is shopping the way everyone shopped in 1999, when the price was printed on the shelf, identical for whoever picked up the box, and the store knew you about as well as the clerk did.

Starve the profile

The deepest fix is giving the machine less to work with.

If you're in California, the Delete Act's deletion mandate went live August 1. The DROP platform has been taking consumer signups since January 1, and as of this month every registered data broker in the state must check it every 45 days and delete what verified requesters ask for. One signup, hundreds of brokers, and the place to start is the state's own portal at privacy.ca.gov/data-brokers. Over 242,000 Californians got in line before the mandate even kicked in. If you live there, this is the single highest-leverage twenty minutes on this list. If you don't, broker opt-out services can approximate it, and more states are drafting their own versions.

Everywhere else, the principle is the same. Stop volunteering data.

• Mask your email address when a checkout demands one (more on that below).
• Skip the app when the mobile site works, because the app sees far more of your phone than the browser does.
• Disable your advertising ID in your phone's privacy settings, which cuts one of the cleanest threads linking your behavior across apps. On an iPhone, turn off "Allow Apps to Request to Track" under Settings > Privacy & Security > Tracking. Android goes one better and lets you delete the ID entirely under Settings > Privacy > Ads; the EFF's walkthrough covers both platforms step by step.

Scramble the signals

Mozilla's guide has a solid starter list for the session-level moves. Clear your cookies, browse in a private window, block third-party trackers, and use a VPN to shift your apparent location, perhaps to a ZIP code with a lower cost of living, since location is one of the inputs these systems lean on hardest.

I'd add one upgrade to that list. Stop doing all your shopping in one browser.

Your browser is your face to these systems. Using the same logged-in Chrome profile for everything is how the 62-page dossier gets compiled. So run a rotation:

• Firefox with Enhanced Tracking Protection set to strict, which walls off cookies per site and keeps trackers from following you shop to shop. Mozilla makes it, and the guide above comes from their foundation, so the browser is the same philosophy shipped as software.
• Brave, which blocks trackers and ads by default and randomizes the fingerprint your device presents, so you look like a slightly different machine each session. The most aggressive of the three out of the box.
• DuckDuckGo's browser, which blocks trackers before they load and comes with a one-button "Fire" wipe of your data, plus Email Protection, which gives you unlimited @duck.com addresses that forward to your real inbox with the trackers stripped out. (Firefox Relay does the same trick if you're in the Mozilla camp.)

The rotation matters more than the choice. Do your comparison shopping in a clean, logged-out private window in one browser, and only log in to buy, in a different one. When the price-setting happens before the system knows who you are, you get something closer to the sticker price. And before any large purchase, run the same search from two of them, one logged in and one clean. The spread between those two numbers is what your profile is costing you. I plan to test this myself and report the results in a future issue.

Get tricky

This is my favorite section of Mozilla's guide, because it treats the algorithm as a negotiating partner you're allowed to bluff. Their tips are worth reading in full, and the highlights:

• Download the competing app and compare. Price the same ride in Uber and Lyft, the same burrito in DoorDash and Uber Eats, the same room in the hotel's own app and the booking sites, and let the loser know why it lost by closing the app.
• Abandon the cart and walk away, since desperation is a signal and patience often shakes loose a discount email. Close the app for a few hours while you're at it.
• Plug in your phone, their most delightfully specific suggestion, because a dying battery reads as urgency, and urgency reads as willingness to pay. (Pennsylvania's ride-share bill specifically bans pricing off battery level, which tells you the practice is real.)

I'll add two of my own:

• Start canceling a subscription and a retention offer often appears before you can confirm. The fastest discount I know lives on the cancellation page, and it tells you what the service actually thinks your business is worth.
• Be a new customer whenever the best deals are reserved for fresh signups; a masked email address makes you one as often as you care to be.

Walk into a store

The most complete way to exit the profile is to shop in person.

But do it right. The loyalty card is the tracking cookie of the physical world, and it's precisely what Seattle's grocery fight is about. The industry argues a surveillance-pricing ban would sweep in loyalty programs and coupons, which is another way of saying the loyalty program is where the personalized pricing lives. So:

• Shop without the card when the spread between card price and shelf price is small. You're paying a few dollars for a blank page in their file, which is sometimes the best deal in the store.
• When the spread is too big to ignore, sign up with a masked email and the minimum the form will accept. A @duck.com address earns the same discount, and your life story stays home.
• Ask the cashier about the courtesy card many stores keep at the register; they'll happily scan it, and you get the price without the profile.
• Pay cash when the purchase is nobody's business. Retailers can link a payment card across visits even without a loyalty card; cash closes that loop entirely.

Think of it as declining to fund the file that gets used to set your prices.

Read the tells

New York's disclosure law now forces companies to say, right in the email, "this price was set by an algorithm using your personal data." Subscribers to the Journal, Wired, and NJ.com started noticing the line in renewal notices, comparing notes, and finding wildly different prices for the same product. Treat that sentence as a starting gun. When you see it, that's the moment to open the clean browser, check the logged-out price, and negotiate or churn. The disclosure is the system admitting the price is soft.

Come together

Mozilla's last step is the one that scales, and it amounts to treating this as a group project. Compare prices with a friend, buy the deal for a neighbor when your profile prices something low, and tell your elected officials this bothers you, because the state-by-state wave is being driven by exactly that. If you want to follow the policy side, EPIC's surveillance pricing page is the place to start. The tactics above are self-defense; the durable fix is collective, and for once the momentum is real.

The through-line in all of it is that the profile is the price. In 1999 the price was on the shelf, the same for everyone who walked in, and every tactic here is just a way of getting back to that, by reminding the system it knows less about you than it thinks. Prince threw a party. I would settle for a fair price on groceries.

What's the biggest logged-in versus logged-out price spread you've found? Send it to me, I'm collecting them.

Get curious. Stay grounded. Keep testing.