Direct answer: in the UK, charging different customers different prices is not banned in itself, and travel has always done it — early-booking fares, member rates, mobile rates and country rates are all forms of it. What changes when AI sets a price from what it knows or infers about one person is the legal surface. The Competition and Markets Authority (CMA) says businesses “should be clear and open about using personalised pricing, and make sure that they comply with the law” (CMA: AI and collusion, March 2026). Under the Digital Markets, Competition and Consumers Act 2024 (DMCC Act), leaving out information the average consumer needs to take an informed decision is a misleading omission (DMCC Act s227). Under UK GDPR, using personal data to predict someone’s “economic situation”, “personal preferences”, “behaviour” or “location” is profiling (UK GDPR Art 4). Under the Equality Act 2010, the terms on which you provide a service must not discriminate, including indirectly (Equality Act s29, s19). If you also sell to consumers in the EU, the EU’s consumer rules add a specific duty to tell them when a price “was personalised on the basis of automated decision-making” (Directive (EU) 2019/2161, Art 4).
Kaize is a UK AI product studio for travel and hospitality. This article is based on the CMA’s dynamic pricing project update and tips for businesses, its price transparency guidance, its 2018 and 2021 papers on pricing algorithms, the DMCC Act 2024, UK GDPR and the Equality Act 2010 as published on legislation.gov.uk, the Information Commissioner’s Office (ICO) guidance on automated decision-making and DPIAs, Directive (EU) 2019/2161, the New York Attorney General’s 2025 consumer alert, Delta Air Lines’ published letter on AI pricing, and Google Hotel Center and Booking.com partner documentation, all read on 19 October 2026. The ICO’s automated decision-making guidance is a draft under consultation following the Data (Use and Access) Act 2025 (ICO: automated decision-making and profiling), so check for updates. This is not legal advice, and it does not describe any Kaize client project.
Why this question is live now
AI revenue-management and CRM tools have made it cheap to vary a price by audience, and the public argument about “surveillance pricing” has reached travel directly. In July 2025 three US senators wrote to Delta Air Lines about its AI pricing pilot with Fetcherr. Delta’s published reply says: “There is no fare product Delta has ever used, is testing or plans to use that targets customers with individualized prices based on personal data”, that its AI pricing functionality uses aggregated data as “a decision-support tool” overseen by analysts, and that it does not share personal information with Fetcherr (Delta: response on AI pricing). Whatever you think of the episode, the lesson for any travel brand is that “we use AI for pricing” will be read by customers, journalists and legislators as “you charge me more because of who I am” unless you can say precisely what your model does and does not use.
Legislators have started to write rules. New York’s Algorithmic Pricing Disclosure Act took effect on 10 November 2025 and, according to the state Attorney General, requires most businesses that set prices with an algorithm using personal data to display “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA” near the price, with a $1,000 penalty per violation (New York Attorney General, 5 November 2025). The same alert cites, as a recent example, “customers being charged more for hotel rooms when booking from a high-income ZIP code” (New York Attorney General). In the UK, the CMA ran a project on dynamic pricing across sectors including air travel and hotels, and said it is more likely to be concerned when consumers are unaware of how prices may change, feel pressured into quick decisions, or when “vulnerable consumers are particularly disadvantaged such that they pay higher prices than others” (CMA: update on dynamic pricing).
Meanwhile the distribution channels hotels already use make segment pricing routine. Google Hotel Center lets partners show conditional rates based on the user’s device, country, language, whether they are signed in to Google, or a downsampled subset of users (Google Hotel Prices: conditional rates). Booking.com lets properties offer country rates to travellers in chosen markets and mobile rates to app or mobile-web users (Booking.com: country rates, Booking.com: mobile rates). The question for a hotel group, airline, tour operator or attraction is therefore not “may we ever vary prices?” but “which kind of variation is this, what data drives it, and have we said so?”
Three things that get called “personalised pricing”
Most confusion comes from treating three different practices as one. The CMA defines personalised pricing as using information “observed, volunteered, inferred, or collected about individuals’ conduct or characteristics, to set different prices to different consumers (whether on an individual or group basis), based on what the business thinks they are willing to pay” (CMA: pricing algorithms, 2018). EU law draws the line in a similar place: its personalised-price disclosure duty “should not apply to techniques such as ‘dynamic’ or ‘real-time’ pricing that involve changing the price in a highly flexible and quick manner in response to market demands when those techniques do not involve personalisation based on automated decision-making” (Directive (EU) 2019/2161, recital 45).
- Dynamic pricing: the price for a room, seat or tour date moves with demand, time to departure, capacity and competitor prices, and every customer looking at the same product at the same moment sees the same price. This is the long-standing revenue-management model. Our guide to AI pricing tools and competition law covers the competition-law side; the CMA’s tips cover how to present it.
- Segmented or targeted rates: a defined, visible group gets a different price — members, mobile users, residents of a market, people who signed in. The criteria are objective and the customer can usually see or choose them. Google’s conditional rates and Booking.com’s country, mobile and Genius-tier rates are examples (Booking.com Demand API: discounts and rates).
- Individually personalised pricing: a model uses personal data — booking history, browsing behaviour, device, location, loyalty status, inferred income or urgency — to estimate what this person is willing to pay and sets or adjusts their price, surcharge or discount accordingly. This is what the Delta letter denied doing, what New York now requires to be labelled, and where UK consumer, data protection and equality law all start to bite at once.
The categories blur in practice. A “member rate” becomes personalised pricing when the member discount itself varies by a model’s prediction of each member’s price sensitivity. A country rate can become a proxy for nationality. And the CMA has pointed out that ranking can achieve the same result without changing a price at all: “price steering … by presenting higher priced products to consumers with a higher willingness-to-pay” (CMA: algorithms, how they can reduce competition and harm consumers, 2021). If your AI decides which room types, fares or tour options appear first for a given guest, treat it as part of the pricing question.
What UK consumer law requires
There is no UK statute that bans or specifically labels personalised prices. The rules that apply are the general ones in Part 4 of the DMCC Act, in force since 6 April 2025. Unfair commercial practices are prohibited, and a practice is unfair if it is likely to cause the average consumer to take a transactional decision they would not otherwise have taken because of a misleading action, a misleading omission, an aggressive practice or a contravention of professional diligence (DMCC Act s225). “Material information” means “information that the average consumer needs to take an informed transactional decision”, and omitting it includes providing it “in a way that is unclear or untimely” or “in such a way that the consumer is unlikely to see it” (DMCC Act s227). An invitation to purchase must include the total price (DMCC Act s230; CMA: providing clear and accurate information about prices).
Whether the fact of personalisation is itself material information is not settled by any UK guidance we found, and the CMA’s published price transparency guidance does not address it directly. But the CMA’s direction of travel is clear. Its 2021 paper lists personalised pricing among the harms that can arise when it is “particularly complex or lacking transparency to consumers”, or when consumers need to “take significant or costly steps to avoid being charged a premium” (CMA 2021). Its 2025 tips tell businesses to be transparent about pricing, to explain what makes prices change, to present that information prominently rather than in small print, and to consider vulnerable consumers (CMA: tips for businesses using dynamic pricing). And its March 2026 blog says to be “clear and open about using personalised pricing” (CMA blog). Our reading: if a guest would reasonably assume everyone sees the same price, and yours does not, keeping that quiet is the riskiest choice you can make.
Two practical consequences for travel. First, any personalised price is still a price in an invitation to purchase, so it must be the full total with unavoidable fees, as covered in our guide to total-price rules under the DMCC drip-pricing ban. Second, the CMA explicitly warns against changing prices “while customers are paying” and against pressuring customers into snap decisions (CMA tips). A model that raises a quote because the guest hesitated, returned twice or is booking at 2am for tomorrow is the sort of design that makes those warnings concrete.
What UK GDPR requires
Personalised pricing almost always involves profiling, which UK GDPR defines as automated processing of personal data to evaluate personal aspects, “in particular to analyse or predict aspects concerning that natural person’s … economic situation, … personal preferences, interests, reliability, behaviour, location or movements” (UK GDPR Art 4(4)). That brings four duties into play.
Data minimisation matters here in a commercial as well as a legal sense. Every additional input — device model, precise location, browsing on competitor sites, inferred family status — makes the model harder to explain to a guest, a regulator or your own revenue team. The fewer personal inputs your pricing needs, the less of this article applies to you.
What the Equality Act 2010 adds
A service provider must not discriminate “as to the terms on which A provides the service to B” (Equality Act s29), and price is a term. Indirect discrimination happens when a provision, criterion or practice applied to everyone puts people who share a protected characteristic at a particular disadvantage and the business “cannot show it to be a proportionate means of achieving a legitimate aim” (Equality Act s19). Race includes “colour”, “nationality” and “ethnic or national origins” (Equality Act s9).
For travel, the obvious pressure points are pricing by country, language and postcode. Google itself recommends using country rather than language conditions “for determining user origin or nationality” (Google: conditional rates), which tells you how closely these signals track protected characteristics. A deliberate market rate — say, a discount to win back a domestic market — will normally be explainable as a legitimate commercial aim. A model that learns to charge more to postcodes, languages or device types that correlate with ethnicity, age or disability, without anyone choosing that outcome, is much harder to defend. The CMA describes this risk as “algorithmic discrimination, a harmful form of personalisation regarding protected characteristics” (CMA 2021). If your pricing model can see proxies, test its outputs for disparities before launch and on a schedule after it. The Equality Act sections cited here extend to England, Wales and Scotland; Northern Ireland has its own equality legislation. For the accessibility side of booking journeys, see our guide to the Equality Act and AI booking interfaces.
If you sell to EU or New York consumers
UK operators selling direct to consumers in the EU should plan for the EU’s explicit rule. Directive (EU) 2019/2161 inserted into the Consumer Rights Directive a pre-contract information duty: “where applicable, that the price was personalised on the basis of automated decision-making” (Directive (EU) 2019/2161, Art 4). Its recital explains that traders “may personalise the price of their offers for specific consumers or specific categories of consumer based on automated decision-making and profiling of consumer behaviour”, and that consumers “should therefore be clearly informed” (recital 45). Booking.com already treats the European Economic Area as a single market for country rates — targeting travellers in any EEA country requires selecting the whole EEA region (Booking.com: country rates) — and Google marks prices that vary by device, sign-in or audience list as “customised” with an asterisk for users in the EEA (Google Hotel Center: private rates). Check with EU counsel how the member-state rules where your customers live apply to your contracts.
Airlines, hotel brands and tour operators — UK ones included — that market prices to consumers in New York should note the New York disclosure. The Attorney General’s alert says the law covers prices set by an algorithm using personal data, and that such schemes are “most commonly used on businesses’ apps or as part of loyalty programs, where consumers may receive an individualized discount” (New York Attorney General). That is a useful reminder that a personalised discount is still personalised pricing.
Where AI changes the risk in hotels, airlines and tour operations
Revenue-management systems that move from demand to people
Most hotel and airline revenue systems forecast demand at product level. The step change is a feature that takes guest-level inputs — CRM history, loyalty tier, past cancellations, device, booking channel — and outputs a guest-level price or uplift. Ask vendors whether any personal or pseudonymous identifier reaches the pricing model, not just the marketing layer.
Member and loyalty rates that quietly become individual
Member rates are transparent when the rule is visible: sign in and get 10% off. Google Hotel Center supports member rates and audience-list targeting as private rates (Google: private rates); Booking.com’s Demand API distinguishes target rates, closed user group rates and Genius tiers (Booking.com Demand API). The risk appears when the discount depth varies per member according to a churn or willingness-to-pay score. That can be lawful, but it is now individually personalised pricing and needs the transparency, objection and DPIA work above.
AI booking assistants and agents that quote prices in conversation
A chat assistant that negotiates, offers a “special price just for you” or decides whether to show a discount based on the conversation is personalising the price, and it is doing so in a medium where the customer cannot compare with anyone else. Fix the price logic outside the model, let the assistant present it but not invent it, and log what each customer was offered. Our guides to AI agents under UK consumer law and building your own ChatGPT app with agentic checkout cover the surrounding controls.
Ranking and recommendations
If the AI orders room types, fares, packages or excursions differently according to a guest’s predicted budget, it may achieve the effect of a personalised price without changing one — the CMA’s “price steering” point (CMA 2021). Decide whether ranking uses personal predictions, and say so if it does.
Metasearch and price accuracy
Conditional rates in Google Hotel Center must still match what the user can book on your site; the user always sees the lowest eligible rate, and Google’s Price Accuracy Policy checks that search and booking prices match (Google: conditional rates). An AI personalisation layer on your booking engine that raises or lowers a price after the click can break that match. See our guide to Google Hotel Center price accuracy before AI updates rates.
Eight common scenarios, and how we would treat them
Questions to ask your pricing, CRM or booking-engine vendor
- Does any personal data or persistent identifier (account ID, cookie ID, device fingerprint, email hash, IP-derived location finer than country) reach the model that sets or adjusts prices, discounts or ranking?
- Can we switch individual-level personalisation off entirely while keeping demand-based pricing?
- Which inputs drive a given guest’s price, and can you export that explanation for a single booking?
- Does the system ever raise a price, or only vary discounts? Can we cap the range?
- Can it change a price after the guest has entered checkout? Can we prevent that?
- Do you test outputs for differences by country, language, postcode, age band or device? Can we see the results?
- Do you use our guest data to train models used for other customers?
- How are prices shown to Google Hotel Center, OTAs and our own site kept consistent when personalisation is on?
- What do you recommend we tell guests, and where in the journey?
A pre-launch gate for AI pricing (Kaize recommendation)
What this article is not
It is not legal advice and it does not cover competition-law risks from shared pricing tools, which are in our CMA and AI pricing guide, or package-holiday price revisions after booking, which are in our guide to PTR Regulation 10 fare increases. It also does not cover airline fare filing rules or sector-specific pricing regulation outside consumer, data protection and equality law.
Questions
Is personalised pricing illegal in the UK?
No. It is lawful in principle, but it must not mislead, must not omit material information, must comply with UK GDPR profiling rules and must not discriminate. The CMA’s position is that businesses should be “clear and open” about it (CMA blog).
Is dynamic pricing the same as personalised pricing?
No. Dynamic pricing changes the price for everyone with market conditions; personalised pricing changes it for a person or group based on data about them. The EU disclosure rule explicitly excludes dynamic pricing that does not involve personalisation (Directive (EU) 2019/2161, recital 45).
Are country rates and mobile rates personalised pricing?
They are targeted by objective criteria rather than individual predictions, which is easier to explain. Google labels device, sign-in and audience-list prices as “customised” for EEA users (Google Hotel Center: private rates). Country rates still need an Equality Act check because nationality is part of the protected characteristic of race (Equality Act s9).
Do we have to tell guests in the UK that their price was personalised?
There is no UK equivalent of the EU’s specific disclosure line. But if the average guest needs to know to make an informed decision, leaving it out risks a misleading omission (DMCC Act s227), and UK GDPR requires transparency about profiling (UK GDPR Art 13). We recommend telling them.
Can we use AI to offer personalised discounts only, never surcharges?
Discount-only designs are easier to defend and are what the New York Attorney General describes as most common (New York Attorney General). They are still profiling and, if sent as marketing, subject to the right to object (UK GDPR Art 21).
Kaize point of view
For most hotels, airlines, tour operators and DMCs, AI should make pricing better at reading demand, not better at reading people. Demand-based pricing, visible member rates and clearly explained market rates capture most of the commercial value, with far less legal and reputational exposure. If you do personalise, personalise discounts rather than premiums, keep the inputs few and explainable, show the explanation next to the price, and make sure a named person can switch it off. A good test: if you would not be comfortable showing a guest the exact reasons their price differs from the person next to them, the model should not be using those reasons.
Related reading: AI pricing tools and competition law, Google Hotel Center price accuracy, ADM and profiling in a travel CRM, what staff can put into ChatGPT, Copilot or Gemini and testing a travel AI agent before go-live.
If you run a hotel group, tour operator or DMC and are evaluating AI revenue management, CRM personalisation or an AI booking assistant, Kaize can help you separate demand pricing from personal data, question vendors and design the guest-facing explanation. Start with an AI opportunity review or discuss a project with Kaize. For how guest data moves between booking engine, PMS and CRM, see connecting travel booking systems and CRM.