Some years ago I made someone a job offer, and the number I picked had very little to do with the job.
I had a salary band, so that part was honest. I also had a folder in my head, built out of things she had mentioned while being perfectly pleasant to me: that she had just moved cities, that she was between leases, that her last role had ended sooner than she planned. None of it belonged on the scorecard. All of it was in the room when I chose where in the band to land. I went low. She said yes in forty minutes, and the speed of that yes has bothered me ever since — because I had not priced the work. I had priced her.
I did that once, clumsily, by hand, from scraps I happened to overhear. What follows is about what happens when the folder is bought instead, holds ten thousand people, and reruns every morning before anyone has had coffee.
Four states wrote the same idea, and the definitions are the whole story
In January, Bloomberg Law counted four states with live bills restricting the use of personal data to set what a worker is paid: Georgia, Illinois, Maryland and New York. Four sets of drafters, one idea — and very nearly one text.
Illinois called its version the Surveillance-Based Price and Wage Discrimination Act: "A person shall not use surveillance data as part of an automated decision system to inform the individualized wage paid to an employee." Maryland's House Bill 148 was blunter — "AN EMPLOYER MAY NOT ENGAGE IN SURVEILLANCE-BASED WAGE SETTING." Georgia's Senate Bill 164 said "No person shall engage in surveillance based wage discrimination," at up to $10,000 a violation. New York's Senate Bill 8872 would simply have banned "algorithmic wage-setting," with a private right of action.
None of them bans an algorithm. They ban inputs — and the input lists are the part that should stop you.
Illinois's "personal characteristics" run from race and eye color to mutable traits "such as address, weight, citizenship, or parenthood status." Georgia's drafters, nine hundred miles away, produced the same sentence with three words changed. When two states independently decide a pay system must not know your weight or whether you have children, that is not a drafting quirk. That is two sets of legislators watching the same demos.
"Behaviors" reaches further — in Georgia, your "political, personal, or professional affiliations, web browsing history, IP addresses, locations frequented, purchase history, financial circumstances." The Illinois list ends on a word I cannot put down: an individual's "actions, habits, preferences, interests, or vulnerabilities." Vulnerabilities. Somebody wrote into a statute that your vulnerabilities must not touch your paycheck — which tells you what they believed was already happening.
Nor need the data come from your employer. Illinois counts information "gathered, purchased, or otherwise acquired." Bought counts.
Against those long lists sits a very short one. You could still be paid individually on data "directly related to the tasks the employee was hired to perform", or on what it costs you to provide the labor, after a plain-language disclosure before hiring. Maryland adds where you work and what it costs to live there. That is the entire permitted universe.
Two definitions matter more than they look: Georgia counted "scheduling, task assignment," bonuses and commissions as "wage," and New York reached "real-time data to automate workforce compensation structures."
And these are not gig-economy bills. Every text applies to any "person" or any "employer"; ride-hail and delivery are only the best-known example. Any of them would have landed on hospitals, warehouses and call centers too.
And then, in all four states, nothing happened
Here is where the January headlines and the August reality separate.
Georgia's bill was read, referred, and forgotten: last action February 13, 2025. No hearing, no committee vote, nothing for the remaining thirteen months of a two-year term that ended when the General Assembly went sine die on April 2, 2026.
Illinois did better and landed in the same place. Fourteen senators signed on, and the bill still never got a committee vote — sent back to the Assignments Committee under Senate Rule 3-9(a) in April 2025 and again on May 22, 2026. It is the only one of the four with a pulse: the 104th General Assembly runs into January 2027, so that bill is parked rather than buried.
Maryland gave its bill one hearing and nothing after it, on February 10, 2026, and the ninety-day session ended April 13; its analysts had priced enforcement at $349,400 in fiscal 2027. New York's was referred to the Labor Committee on January 13, 2026, and that was the whole story — one recorded action in its life.
The half that passed protects the shopper
Now the part that made me put my coffee down. Maryland did not drop the idea. It split it.
On April 28, 2026 the governor signed the Protection From Predatory Pricing Act as Chapter 154, effective October 1, 2026, restricting dynamic and personal-data pricing by food retailers and third-party delivery. The enrolled text governs what you are charged, not what you are paid — the only employees in it are a staff-discount carve-out and a savings clause for an existing collective bargaining agreement. And Maryland was not alone: reporting from Stateline, three states, Connecticut, Maryland and New Jersey, became the first to enact surveillance-pricing laws this year, out of at least eleven that considered them.
So the score for 2026: three states have enacted laws restricting a company from using your personal data to decide what you pay. No state has enacted one restricting a company from using your personal data to decide what you are paid. Same data, same math, opposite sign — and only one of them got a signing ceremony.
One of them did reach a governor's desk — in Colorado
The four-state story is not the whole story.
Colorado wrote the same architecture into a bill called Prohibit Surveillance Price & Wage Setting, and its legislature passed it — the House 39-24-2 on March 27, the Senate 19-15-1 on May 6, reaching the governor on May 29. It would have barred personal characteristics such as genetic data, online behavior history and biometrics from setting wages or prices while still letting employers use AI on performance and other job-related factors, provided they disclosed it.
On June 2, 2026, Governor Jared Polis vetoed it. His reason was breadth — the "scope and definitions are overly broad," discouraging "perfectly acceptable uses of technology to set an appropriate price or wage" — and his most quoted line was that "We should be championing, not deterring, opportunities for Coloradans to save money." The Denver Metro Chamber of Commerce welcomed the veto; the sponsor called it a missed opportunity.
Read those objections again and notice who is standing in them. Discounts. Savings. Loyalty pricing. The word "wage" was in the bill's title, and the argument that ended it was about the price of groceries.
And California? The tidy version says California tried this first and Newsom said no. Not quite. Its No Robo Bosses Act — SB 7, vetoed on October 13, 2025, the veto left standing in March 2026 — required notice before an employer deployed an automated decision system, barred sole reliance on one for discipline or termination, and gave workers a right to the data behind it. Notice, human review, access; nothing forbidding personal data from setting pay. California vetoed a transparency bill; Colorado vetoed an input ban.
Now the case against, and it is not a weak one
Here is the other side, in its own words, because it is better than the caricature.
Uber told the Maryland committee to report the bill unfavorably in February, while saying it supports the intent. Its objection is a real one: the bill risks "conflating discriminatory pricing (which should be banned) with dynamic market balancing (which is essential for reliability)." Surge is not a moral position; it is how you get more cars onto the road at 2 a.m. And no state has permanently banned it, the company argues, because the result is always "fewer rides, longer waits, and lower driver pay."
The same filing carries a denial whose scope deserves care. Uber's core pricing models are not personalized, it says: they generate a price from market dynamics, "not on who the user is." Note the noun. That is about what a rider is charged, not how a driver's pay is calculated.
The trade groups pressed the point at scale. The U.S. Chamber of Commerce urged the veto because the bill was "drafted so broadly that it risks sweeping in commonplace, beneficial pricing and compensation tools," and because algorithmic pricing used responsibly can help everyday consumers, "especially those who are most price-sensitive." NetChoice aimed at the wage half, warning that "bonus and incentive structures that this bill could reach" are how workers earn more on skill and output. And the Information Technology and Innovation Foundation made the economist's case: a ban on personalized pricing does not lower prices, it merely reshuffles them — the American evidence, it argues, shows the capability exists and is being sold, not that harm is documented.
And that last point is honest: nobody has produced an American dataset showing employers at scale setting wages from browsing histories. But notice where every objection lands. All are about breadth — the net catching a loyalty discount or a safety bonus. None defends the specific thing the bills forbid. Nobody wrote a letter arguing an employer should be free to price your labor using your weight, your citizenship, your parenthood status or your financial distress. That question is not being lost. It is not being asked.
Spain never wrote a list of forbidden facts. It wrote a duty to explain.
Five years ago Spain met the same question and answered it with a different verb.
Real Decreto-ley 9/2021 — the Rider Law — added one clause to article 64.4 of the Workers' Statute: works councils have the right to be informed of "los parámetros, reglas e instrucciones" — the parameters, rules and instructions — behind algorithms or AI systems affecting working conditions and employment, including profiling. It came into force on August 12, 2021. (The same decree created a presumption of employment for riders managed by a platform's algorithm; the transparency clause is the half that outlived the headline.)
The European Agency for Safety and Health at Work called it a right to "algorithmic transparency" at a national regulatory level for the first time; in its official English rendering the duty runs to "the Works Council of any company," not only the apps, and Eurofound's record reads it the same way.
Now the honest part, because a contrast that flatters the other country is worthless. Spain bans nothing about your pay. It does not say which facts about you may not enter the equation; it says the employer must explain the equation to your representatives — and even that is limited. EU-OSHA's own case study calls the right passive, general and ex ante: how the system was designed, given in advance, not what it did to you last Thursday. Unions wanted an algorithm registry as a backstop and did not get one, and the same evaluators wrote that "questions can be asked" whether a right of this shape shifts the balance enough.
The platforms objected there too: disclosure, the Spanish delivery-platform association said, "would without doubt very negatively affect the development of the digital economy in Spain." The arguments travel.
And then, four summers later, a Spanish court enforced it. On July 4, 2025 the Audiencia Nacional held that a company had violated the fundamental right to freedom of association by refusing to show a union how an algorithm turned a workload forecast into who was needed each day, and ordered 6,250 euros in damages. The company was Foundever Spain, a call center, not a delivery app; the algorithm set shifts and rest days; the union was CGT.
Six thousand two hundred and fifty euros is not a deterrent. It is proof of concept — a rule that exists, in a court that will apply it, against a company nobody was watching. The next round is on the clock: member states must transpose the EU's Platform Work Directive by December 2, 2026, and officials in Madrid "have indicated that they are looking at an ambitious transposition," possibly one reaching all workers, with a government audit of algorithms before use. Possibly. Nothing is drafted yet.
The difference is one of kind, not of strength. America's four bills tried to shorten the list of things a machine may know about you; Spain lengthened the list of things a company must say out loud. Only one of those is in force anywhere.
Now run it forward to 2032
Here is the version I find most plausible, and it is not the dystopia you are braced for.
Nobody personalizes your hourly rate. The rate is what auditors check, journalists request and legislatures write bills about, and it is the easiest thing in the world to leave alone. So it stays alone: your rate is $22.40, your colleague's is $22.40, and the pay stub is boring, identical and entirely honest. What differs is everything around it — which shifts the scheduler offers you at 6 a.m. and which it offers her, how many jobs route to you an hour, how far the bonus threshold sits from where you actually finish, whether the good routes quietly stop arriving in the eleventh month because a retention model decided you had made up your mind to stay. Georgia's drafters saw this coming, which is why "wage" there already reached scheduling and task assignment. The pay is personalized; the pay rate never was.
The inputs will not come from your workplace either. They will be bought: your commute, the month your lease renews, a new dependent in the household, how often you opened a job board last week. None of it labeled a wage decision. All of it a wage decision. That is plausible rather than paranoid because the consumer half already shipped — which is why three legislatures wrote pricing laws this year. As the Center for Democracy & Technology's Travis Hall puts it, "Uber was the baseline model, and we are seeing that model being exported into different industries."
What the people who have actually studied this are saying
The name came from Veena Dubal, a law professor at UC Irvine, in a 2023 Columbia Law Review article, On Algorithmic Wage Discrimination. Her framing is the sentence to carry out of all this: the importation of price discrimination from the consumer context to the labor context. Her remedy is not disclosure but a non-waivable ban, on the ground that digitally variable personalized pay is a historical rupture in how wages are determined.
She is also skeptical of the Spanish route: writing in 2023 about British organizers using data-protection law to reverse-engineer these systems, she concluded that those transparency efforts have yet to change firm practices. Set that against the Foundever judgment and you have the policy argument of the next five years.
Zephyr Teachout of Fordham built the taxonomy — five distinct forms of algorithmic wage differentiation, from productivity-based adjustments to wages shifted to run an experiment — which she argues are likely to spread from gig work into the formal employment context, and reads, more sharply than I would, as innovations in power and domination.
The strongest peer-reviewed evidence is narrower than the rhetoric: a longitudinal audit of 1.5 million trips by 258 British Uber drivers, presented at ACM FAccT 2025 and run with a drivers' union, found that after the move to dynamic pricing "pay has decreased, Uber's cut has increased, job allocation and pay is less predictable," inequality between drivers widened, and drivers waited longer for jobs. The UK, one company, 258 people — and still the best data anybody has. Human Rights Watch's 2025 report rests on a survey of 127 Texas platform workers, whose median wage was $5.12 an hour after expenses. Again: a survey, one state, 127 people.
The National Employment Law Project states the model in a line — consumers pay the highest amount they are individually willing to pay, workers earn the lowest amount they are willing to accept — and says it is spreading to new industries. And the Federation of American Scientists, nobody's idea of a labor pressure group, reached the same guardrail in June 2026: bar employers and vendors from using non-job-related personal data in pay decisions, with audit trails behind it.
And the category now sits under a stated federal threat. An executive order signed December 11, 2025 told the Attorney General to stand up an AI Litigation Task Force "whose sole responsibility shall be to challenge State AI laws" at odds with administration policy — an attempt, Lawfare wrote, to preempt state regulation of AI. Nobody has sued over these wage bills; there is nothing to sue. What exists is what Bloomberg calls it: proposals subject to threats of federal preemption — a threat over a category, not an action against a statute.
What does this mean for you?
Ask, in writing, whether a system sets your pay. Nothing obliges anyone to answer today. Ask anyway — an email creates a dated record, and the answer, or the silence, is what a lawyer will want in two years.
Read the variable half of your compensation, not the salary line. Georgia's drafters treated scheduling and task assignment as wages for a reason. If your income moves with which shifts, routes or accounts you get, the algorithm is already inside your pay.
If you are in Illinois, this is not over. The bill is parked in Assignments, not defeated, and the General Assembly runs into January 2027. Constituent mail to a sponsor is worth more in that window than at any other.
If you are in Maryland, know which counter protects you. From October 1 the pricing law covers grocery stores of at least 15,000 square feet and third-party food delivery. Your wages are not in it — nor your rent, your insurance or your loan.
If you set pay for a living, adopt the rule anyway. The Federation of American Scientists has written the policy for you; you do not need a statute to stop doing something.
Argue about definitions, not about AI. Both vetoes turned on the word "broad." The next version needs the discount, the safety bonus and the surge multiplier carved out on page one, or it dies the same way.
The lesson, as I see it
In one year, three American states decided a supermarket may not use your personal data to decide what you pay for a chicken, and none decided an employer may not use it to decide what you are paid for eight hours of your life. Both problems have the same math, the same vendors, the same evidence base. The difference is that a shopper is a constituency and a wage bill is a cost.
I keep coming back to the smallest number here. Not the $10,000 penalties that never took effect, not the $349,400 Maryland budgeted for enforcement it never had to fund — the 6,250 euros a Spanish court ordered a call-center operator to pay for refusing to explain how a machine decided who worked which days. It is the only figure in this story a company has been ordered to hand over, and it was won not with a ban on inputs but with a duty to explain, in front of a judge who could enforce it.
My vote? Write both, and write the duty first. The list of facts a machine may not know about you is the right destination, and Illinois and Georgia drafted it better than I could. But the rule that survives a lobbying season and ends up in front of a court is the one that makes a company say out loud, in writing, how the number was reached. Make them explain it — that is what makes the rest enforceable, and on five years' evidence it is the only part anyone has actually enforced.
Three legislatures spent this year deciding what a store may not know about you before it names a price. Nobody has decided what your employer may not know before it names your wage — which is roughly why the HAIA Foundation exists. If you have ever wondered how your own number got picked, come read the rest with us.