Incognito — September 2026: Are You Being Robbed by Your Own Data?

Welcome to the September 2026 issue of Incognito, your monthly privacy and security deep dive with DeleteMe. 

This month:

• Robbed by Your Own Data?: Surveillance pricing is this month’s news, and it may be hurting your wallet more than you know. Personal data drives it. 
• Listen to the Experts on Surveillance Pricing: Guests Chris the Producer, Grace Gedye of Consumer Reports, and David Dayen of the American Prospect kick off a three-part series on surveillance pricing. Check out our podcast What the Hack? 
• DROP Enforcement Begins: Data brokers registered in California started complying with DROP requests, but there are some exceptions you should know about.
• Recommended Reads: Just 9% of data brokers comply with CA’s privacy law; DROP enforcement is live; the FTC claims it will enforce surveillance pricing regs; a massive breach exposed 150 million U.S. drivers’ licenses.
• Q&A: How can you fight back against surveillance pricing?
• Connect with Us at GSX: We want to see you! Learn more.

Robbed by Your Own Data?

Surveillance pricing affects everyone. 

Companies use data about you to figure out the highest price you will pay for a product or service.

This practice is powered by all kinds of data gathered and parsed by advertisers, data brokers, retailers, smartphone apps, internet service providers and loyalty programs. If that sounds unfair to you (not to mention creepy), you’re not alone. Three quarters of America hate the idea. 

We’re talking about surveillance pricing because it’s a privacy issue. As consumers, we should all have a say about how our data is collected, used, and sold. We should also have a right to know how things are priced, and whether everyone is paying the same thing. 

Some states are working to change that (read our recent blog post on surveillance pricing). Control starts with awareness, so here’s what to know. 

1. Advertisers Sell What They Know about You

Advertisers record your interaction with ads and related products. You don’t even have to click. Simply hovering over an ad or looking up a product provides them with usable and sellable data about you. 

Sometimes, that’s convenient. We’ve all been served that spookily relevant ad for a product or service you want. 

Things change for the worse when a consumer has an immediate need or, worse, an emergency. Here’s what it might look like: You google a medical symptom and you see advertisements for related over-the-counter treatments. The price is higher for you than it is with someone who did not perform that search. 

Many of your communications are not private. If advertisers get their hands on what you’re talking about, it could affect the price you pay. AI models are used to tune this data so that retailers know exactly how motivated you are. 

2. Your Loyalty Is Being Abused

Retail brands like Kroger can make hundreds of millions of dollars off of selling the data they collect through loyalty programs. You might save some money with loyalty programs, but the information you’re providing to that retailer is worth a lot more. 

Loyalty programs let companies know what kinds of products you buy regularly and how much they can raise prices before you switch to another product or brand. 

3. Apps Are Data Vacuums 

The apps on your phone collect your data by default. Types of data can include: 

• Precise location
• In-app purchases
• In-app searches and messages
• Financial data
• Name, email address, and user IDs
• Home address
• Phone number
• Political or religious beliefs
• Sexual orientation
• Voice or sound recordings

And more. 

In the Google Play store and Apple App Store, apps are required to report what types of data they collect and whether they are shared with third parties. Make sure you read those warnings before you download, and turn location tracking off whenever you can. 

4. Dishonest Brokers 

At least 100 of the 603 data brokers on California’s data broker registry have admitted to selling precise geolocation data. Retailers use that data to infer your financial status and target you accordingly. 

You might think that would be to your advantage. After all, if a data broker can show you live in a lower-income neighborhood, surely you’ll be targeted with lower prices. 

The data shows the opposite. Individuals with lower incomes often pay more for mortgages based on their personal data. At one time, Home Depot was reported to be charging individuals in affluent neighborhoods lower prices. Staples charged higher prices for consumers in areas with less competition. 

The resulting cost difference for the rich and the poor can be high, as our recent What the Hack episode covered. 

Surprise: You Lost $8,793 to Surveillance Pricing Last Year

Well, maybe not quite that much. It’s an estimate, based on one YouTuber Chris the Producer’s experiment. The video has been viewed more than 1.2 million times. 

So of course, host Beau Friedlander covered the topic on our podcast What the Hack? 

Chris knew some companies, like DoorDash, Uber, and many online retail giants, are already believed by many to engage in surveillance pricing. He decided to find out what that means for the average consumer — and what it means for the highest income brackets. 

First, Chris created a new “person” for data brokers and retailers to target. Prices varied between Chris’ made-up persona and his real one by as much as 30%. He ran additional tests comparing prices for goods and services offered to him, his brother, and his mother. They tested the exact same items, including Spam, an Uber ride and a hotel room. There were price differences for no visible reason. 

Then the real (not entirely scientific, n-of-one trial): Chris used a drone to fly his invented person’s smartphone into a wealthy Minnesota neighborhood and bought some food. The drone phone got a 19% discount on a DoorDash order from White Castle. Just 300 feet away, outside the wealthy area, the price was $8 higher. Chris did the math. If he could apply that discount to every purchase throughout the entire year, he would save $8,793. 

Surveillance pricing is a black box that runs algorithms with our data, almost always to our detriment. We have no visibility into the process. 

Our best tip for escaping the data trap? Be rich. Don’t like the sound of this? Listen to the first part of the series on What the Hack? Where Chris the Producer is joined by Grace Gedye of Consumer Reports and David Dayen of the American Prospect. 

In the meantime, use cash when you can and don’t give sites access to your location. Ditch loyalty apps and remove yourself from data brokers. 

What DROP Enforcement Means for Privacy

California’s Delete Request and Opt-Out Platform (DROP) allowed residents to submit broker opt-out requests to 600+ data brokers back on January 1st. August 1st marked the first day data brokers were legally required to act on those requests.

Now, data brokers have until November 1st to fully process the requests submitted since January. After that, they’re on the hook for 45-day compliance checks on an ongoing basis to ensure your data stays off their sites. Brokers that drag their feet can face financial penalties for every day a request goes unprocessed. 

DROP still has certain gaps. Information that’s already considered public record, like data found through voting and property records, fall outside its reach. This is a loophole data brokers can exploit to keep much of your file while only removing what DROP actually covers. And as with any new regulation, it’ll take time to see how consistently brokers actually comply. Lastly, DROP sends requests but is not yet designed to monitor for compliance. 

DeleteMe tracks where your data resurfaces on broker sites, pushes for full profile removal, and keeps at it on a recurring basis. 

DROP gives Californians a new right. DeleteMe makes sure that right actually gets enforced. Use both to take back control of your personal information online. 

Learn more in our related blog post. 

Recommended Reads

Just One in Ten Data Brokers are Delete Act-Compliant

A Stanford study found that just nine percent of data brokers registered under California’s 2023 Delete Act are fully complying with the privacy law. Many brokers deliberately obstruct consumers from submitting privacy requests, and they often fail to disclose how many such requests they receive. Upcoming requirements could improve compliance. 

DROP Enforcement Is Here

California’s Delete Act is now in its enforcement phase: as of August 1, registered data brokers must process deletion requests via the DROP platform every 45 days or face steep penalties, up to $200 per unprocessed request, per day. Regulator CalPrivacy has already fined several companies. 

FTC Targets Surveillance Pricing

The FTC issued its clearest statement yet on personalized pricing, proposing that businesses be required to disclose when and how they tailor prices to individual customers, including what personal data drives those decisions. The proposal, aimed at retailers, rideshare companies, and hotels, stops short of banning the practice outright but signals the agency may pursue broader enforcement under existing consumer protection laws. 

153 Million Drivers’ Licenses Hit the Dark Web

The FBI is investigating a dark web site selling tens of millions of drivers’ licenses from the U.S. and Canada, along with other identity documents and medical records. Journalist Brian Krebs discovered the breach and verified the data’s authenticity; researchers called it unprecedented in scale with serious identity theft and security risks. The database appeared to be updating in real time, suggesting an active breach, and the site disappeared after Krebs published his report. 

You Asked, We Answered

Q: How can you fight back against surveillance pricing? 

A: Start by locking down your digital footprint. 

Here are a few more ways to protect yourself against surveillance pricing:

• Use cash when possible – This decouples purchases from your digital identity, though most surveillance pricing happens online.
• Hide your location – Avoid sharing location with apps/sites, or use a VPN to reroute traffic (this may violate some terms of service, so use VPNs with caution).
• Ditch loyalty apps – They rarely save much money and let retailers track what you’ll pay, sometimes selling that data to third parties. 
• Clear your cache – Wiping cookies and search history limits what retailers know about you. 
• Remove yourself from data brokers – Opt out yourself or use a service like DeleteMe. 
• Push for better legislation – Vote and advocate with this issue in mind, and support groups like the EFF. 

For more on surveillance pricing, visit our blog. 

Say Hi to DeleteMe at GSX

Join DeleteMe at GSX 2026, Booth #3959, for a firsthand look at how we protect executives and workforces from doxxing, physical threats, and AI-driven social engineering. Stop by for a free executive exposure scan or chat with our privacy and security team. Don’t miss our session, “Benchmarking Executive Exposure in the Age of AI,” where we’ll debut exclusive findings on how specific PII is weaponized in real-world attacks. See you there!

Learn more.

Back to You

Get in touch with us. We love getting emails from our readers. You can also find us on X, BlueSky, Instagram, Facebook, LinkedIn, and YouTube. 

And don’t forget to share! If you know someone who might enjoy learning more about data privacy, feel free to forward them this newsletter. If you’d like to subscribe to the newsletter, use this link.

That’s it for this issue of Incognito. Stay safe, and we’ll see you next month.