united-states internet gdpr european-union commerce
Are online retailers breaking EU/US law by using user&#39;s log-in information to charge different prices without explicitly notifying them?
<p>I am aware that in most places firms are generally allowed to price discriminate, i.e. offer different prices for the same product to different customers based on personal characteristics. For example, students getting book discounts, retirees cheaper fare etc. However, is it legal in the EU/USA to do so without explicitly stating that's their policy and/or informing you they use your data to do so?</p>
<p><strong>Context:</strong></p>
<p>Very recently I tried to purchase an eBook from Amazon.com, form the US store while being in the EU because the local Amazon.nl did not offer an eBook version, only hard-copy, and I made previously purchases from Amazon.com while being here in such situation without problems. However, the listed price changed (and increased) after I logged in into the store and made a purchase.</p>
<p>I contacted the Amazon customer support about this and their first response was that this was due to different taxes or just natural price variation over time. However, I noticed that even before I logged in into amazon.com the amazon.com was displaying the Netherlands as my region (I also do not use VPN or any service to hide my IP address). Furthermore, since I accidentally purchased it I could see that the pre-tax changed, not VAT. Another suspicious thing was that only the price of eBook version changed. In addition, after their customer support response I decided to run an experiment and log-in/out multiple times and the price was changing always whenever I logged in or out.</p>
<p>I made a photographic and video evidence of this and after confronting the customer support with this evidence, they admitted that it is in fact log in status that determines my price and not region/time. In their response they stated:</p>
<blockquote>
<p>... &quot;I'm very sorry about the incorrect information you received. [referencing the previous incorrect claims about price changing due to my location or time variation through day]</p>
<p>Please be informed that the change of price differs before you login and after you login onto our Kindle store using your Amazon account&quot; ...</p>
</blockquote>
<p>The text in [] are my clarifications.</p>
<p>However, this response made me wondering if this conduct is legal. The reason for that is that according to <a href="https://europa.eu/youreurope/business/dealing-with-customers/data-protection/data-protection-gdpr/index_en.htm" rel="nofollow noreferrer">GDPR explanation on EU website</a> under GDPR company collecting my personal data and using it for automated decision making should inform me about that and have me agree to it. Amazon has an explanation page for how they use your data but they never mention individualized price hiking/price discrimination <a href="https://www.amazon.com/gp/help/customer/display.html?nodeId=G7LUHQG6TKZRR4QQ" rel="nofollow noreferrer">explicitly</a> (or maybe they use language that legally covers such action as well that as an layman I can't understand). The same applies to their <a href="https://www.amazon.com/gp/help/customer/display.html?nodeId=202140280" rel="nofollow noreferrer">user agreement</a>.</p>
<p>Furthermore, even though I currently reside in the EU I don't know if this would not fall outside GDPR and under the US law, and if so I would like to know what it would say about the situation.</p>
<p>Lastly, their response shows that they always had data which showed that price changed due to my log in and hence first time they misled me either intentionally or hopefully just due to some human error. What does US/EU law say about that?</p>

<blockquote>
<p>The reason for that is that according to GDPR explanation on EU website under GDPR company collecting my personal data and using it for automated decision making should inform me about that and have me agree to it.</p>
</blockquote>
<p><strong>Only if the basis for processing is consent.</strong></p>
<p>The GDPR provides 6 legal basis for data processing - consent is only one of them. If their basis for processing is any one of the other 5 then a) they don’t have to ask for consent and b) they don’t have to tell you about it.</p>
<p>In the context of Amazon with respect to a particular purchase, it's far more likely that the basis is &quot;to fulfil a contractual obligation with the individual&quot;. Specifically, the price to be paid is clearly a fundamental part of the contract.</p>
<blockquote>
<p>Furthermore, even though I currently reside in the EU I don't know if this would not fall outside GDPR and under the US law, and if so I would like to know what it would say about the situation.</p>
</blockquote>
<p>You are in the EU and they, Amazon are operating in the EU, the GDPR applies. US law also applies.</p>
<blockquote>
<p>Lastly, their response shows that they always had data which showed that price changed due to my log in and hence first time they misled me either intentionally or hopefully just due to some human error. What does US/EU law say about that?</p>
</blockquote>
<p>Nothing - people can make mistakes without incurring legal liability. Only if the mistake rises to the level of negligence  or breach of contract are there any legal ramifications.</p>
