Your Smartphone Is Costing You More at Checkout — And Your Data Is Why

Your Phone Knows Too Much — And Retailers Are Cashing In

Surveillance pricing — the practice of using personal data to set individualized prices — is quietly reshaping what consumers pay for everyday goods, and your smartphone is one of the primary enablers. A recent investigation by Mozilla, the nonprofit behind the Firefox browser, has put hard numbers behind a practice that privacy professionals have long warned about: the device you use to shop online can directly affect how much you pay. When a journalist was asked to purchase the same basket of goods — toilet paper, blueberries, and breakfast cereals — once from an iPhone and once from a public library computer in New York City, the difference was stark. The toilet paper alone cost approximately 20% more when ordered from the smartphone, according to security.nl's reporting on Mozilla's findings.

The reason, Mozilla explains, is straightforward: the library computer holds almost no data about the user, while a personal smartphone is a rich repository of behavioral signals — location history, app usage, purchase history, browsing habits, and even keystroke patterns. Retailers and their data broker partners aggregate these signals to estimate each individual's willingness to pay, then adjust prices accordingly — often invisibly and in real time.

How Surveillance Pricing Turns Personal Data Into a Pricing Weapon

To understand why surveillance pricing is so effective — and so difficult to detect — it helps to understand the data pipeline that powers it. Modern e-commerce platforms don't operate in isolation. They are embedded within extensive advertising and analytics ecosystems that continuously collect, share, and monetize user data. Location data can signal affluence: someone who shops from a high-income zip code may be shown higher prices than someone browsing from a lower-income area. Purchase history reveals brand loyalty and price sensitivity. Even the type of device being used — iPhone versus Android, high-end versus budget model — can serve as a proxy for spending power.

According to Mozilla's research, the data points used to calibrate these prices include location, purchase history, and keystroke timing. But the full scope is likely much broader. A Federal Trade Commission report on commercial surveillance documented how data brokers compile thousands of data points per individual, including inferred attributes like estimated income, political affiliation, and health status. These profiles are sold and licensed across industries, enabling retailers to fine-tune pricing well beyond what any individual shopping session could reveal on its own.

This isn't a fringe phenomenon. Research published by Wired on the FTC's investigation into surveillance pricing noted that major retailers and intermediary platforms have been actively exploring and deploying these techniques. The FTC launched a formal inquiry into eight companies suspected of using surveillance pricing, including intermediaries that offer AI-powered pricing tools to retailers — tools designed explicitly to maximize revenue by tailoring prices to individual users.

What Data Signals Drive Personalized Pricing?

For developers, IT decision makers, and privacy professionals building or auditing systems, it's worth mapping out exactly which data points are implicated in surveillance pricing. The list is longer than most users realize, and much of it is collected passively — often without meaningful informed consent.

"The library computer knows almost nothing about you, while your phone knows nearly everything," Mozilla stated in its findings. This asymmetry of information is the engine of surveillance pricing — and it is deliberately engineered by the platforms and data intermediaries that benefit from it.

GDPR and Digital Sovereignty: Is Surveillance Pricing Legal in Europe?

For European privacy professionals and policy makers, Mozilla's findings raise an immediate question: does surveillance pricing as described here violate GDPR? The short answer is: it depends — but there are serious grounds for concern. Under the General Data Protection Regulation, personal data may only be processed where there is a lawful basis, and profiling that produces significant effects on individuals requires explicit consent or falls under strict limitations. Using behavioral and location data to charge one person more than another for the same product could plausibly constitute automated decision-making with significant effects — a practice regulated under Article 22 of the GDPR.

The European Data Protection Board (EDPB) has not issued specific guidance on surveillance pricing as a standalone practice, but its guidelines on automated decision-making and profiling are directly relevant. If a retailer uses a consumer's data profile to present a personalized price without disclosure, this likely runs afoul of transparency obligations under Articles 13 and 14 of the GDPR. A consumer in the EU has the right to know that profiling is occurring, the right to object to it, and — in many cases — the right to request that decisions affecting them are not made solely on automated grounds.

European digital sovereignty advocates have long argued that the data economy as currently structured systematically disadvantages individuals in favor of platforms. Surveillance pricing is perhaps the most financially concrete manifestation of that imbalance: your data is used not merely to target advertisements, but to extract the maximum possible price from your wallet. EDPB guidelines on deceptive design patterns further underscore that nudging users toward higher-priced options through personalization without transparency can itself constitute a violation of fair processing principles.

What Can Privacy-Conscious Users and Organizations Actually Do?

The Electronic Frontier Foundation (EFF), the US-based digital civil liberties organization, has weighed in on practical defenses. According to the EFF, disabling the advertising ID on your phone is a relatively simple step that reduces cross-app tracking. On iOS, this is done through Settings > Privacy & Security > Tracking. On Android, it's accessible through Google's advertising settings. However, the EFF also notes a critical limitation: once data has been shared with companies, it is extremely difficult to retrieve or delete it in practice. This makes prevention — not correction — the primary strategy.

The EFF specifically highlights email addresses as a particularly high-value data point to protect. Providing your email to a retailer links your offline, online, and cross-platform behavior into a unified identity that can persist across sessions, devices, and even data broker sales. Using alias email addresses, disposable addresses, or services that generate forwarding addresses can significantly reduce this risk.

For developers and IT architects building e-commerce or data platforms, Mozilla's findings also carry compliance and reputational weight. Implementing privacy-by-design principles — minimizing data collection, avoiding unnecessary behavioral profiling, and ensuring transparent pricing logic — is not merely an ethical stance but increasingly a legal requirement under frameworks like GDPR, the California Consumer Privacy Act (CCPA), and the emerging EU AI Act, which will regulate AI-driven decision-making systems including dynamic pricing engines.

Practical steps for individuals and organizations concerned about surveillance pricing and data-driven digital privacy risks include:

• Disable your advertising ID: Available on both iOS and Android; reduces cross-app behavioral profiling.
• Use a browser with strong privacy defaults: Firefox (Mozilla's own product), Brave, or a Chromium-based browser with uBlock Origin can block many tracking scripts.
• Use a VPN: Obscures your IP address and location, reducing one of the key signals used in surveillance pricing.
• Avoid loyalty programs where possible: These are among the richest sources of purchase history data for retailers.
• Use alias or disposable email addresses: Prevents cross-platform identity stitching via your primary email.
• Browse in private/incognito mode or from a clean browser profile: Reduces the session data available to retailers, mimicking the effect of the library computer in Mozilla's test.
• Exercise your GDPR rights: In the EU, you have the right to request access to, rectification of, or deletion of your personal data held by retailers and data brokers.

Originally reported by Security.NL. Summarised and curated by European Purpose.