On 11 November 2026, the European Commission presented its proposal for a Digital Fairness Act (Proposal for a Regulation on promoting fair business-to-consumer commercial practices in the offline and digital single market, COM(2026) 1100 final, “DFA” or “DFA-P”). The reactions from consumer advocates and industry representatives signal that the Commission may not be far off in calling its proposal the most ambitious reform of EU consumer protection rules in a generation. The DFA-P aims to repeal and replace the Unfair Commercial Practices Directive 2005/29/EC (“UCPD”), updating its substantive principles for the digital age and adding more regulatory detail. In particular, the new chapter on “digital fairness” would cover dark patterns, influencer marketing, personalisation, addictive design, and digital contracts. In addition to this reform in substance, a revision of the Consumer Protection Cooperation Regulation (“CPC-R” and “CPC-R-P”), proposed in parallel, would give the Commission direct powers to investigate and impose fines in large-scale cases, likely significantly increasing the enforcement risk for companies.
This article gives an overview of the most significant points of the Digital Fairness Act initiative, including practically relevant differences in structure (see Section I.), important new obligations (see Section II.), enforcement changes (see Section III.) and a practical outlook (see Section IV.). More detailed articles on individual changes will follow separately.
I. From Directive to Regulation
The draft DFA converts the substantive law on unfair commercial practices from a directive into a regulation, which is directly applicable and does not require implementation in national law. This could represent a significant advantage for globally active companies, since they could orient their compliance efforts towards a single EU regime rather than having to deal with 27 different national jurisdictions. While cultural differences would likely lead to some differences remaining at first, these would hopefully be reduced in time. Areas where national deviations – including stricter national rules – are still permitted are few, for example financial services and real estate (Art. 2(8) DFA-P), and doorstep selling and commercial excursions (Art. 2(4) DFA-P).
The draft DFA carries over the existing general clause prohibiting unfair commercial practices (Art. 5 DFA-P) and the rules on misleading and aggressive practices (Art. 6-8 DFA-P) with the aim of (at least) maintaining the current level of consumer protection. It also codifies into law the Commission’s interpretation of consumer protection law, as previously published in a (non-binding, but influential) notice of 17 December 2021.
The territorial reach stays broad, applying not only to EU companies but also to non-EU companies targeting consumers in the EU. Traders, i.e. persons acting for purposes of trade, business, craft or profession (Art. 3(11) CPC-R-P), without an establishment in the EU are to be required to designate a legal representative in writing. Companies who have already done so under other EU law, for example under the Digital Services Act (Regulation (EU) 2022/2065, “DSA”), can extend their representative’s mandate to cover consumer protection as well (Art. 59(1), (2) CPC-R-P).
II. The new digital fairness obligations at a glance
In its eponymous Chapter III, the Digital Fairness Act includes a number of new substantive rules. Each of the following areas is likely to require changes to product design, contracts or processes for companies that want to sell their products or services to consumers in the EU. Companies in the e-commerce, gaming, and digital services sectors are likely to be impacted the most.
1. Dark patterns
The first new rule is a general prohibition on traders to design, organise or operate online interfaces in a way that is likely to deceive or manipulate consumers, or in a manner that is likely to otherwise (i.e., without deception or manipulation) materially distort their economic behaviour (Art. 10(1) DFA-P). The same Annex that will include a list of unfair commercial practices will also include a list of dark patterns that are unfair in all circumstances – which the Commission may extend by delegated act (Art. 10(2), (3) DFA-P).
According to the draft annex, always unfair dark patterns are to include (Annex I Part III DFA-P):
- a. Making false claims about availability or popularity or omitting relevant qualifications in this regard (e.g., “Only 1 item left in stock” if that is not the case)
- b. Persistently displaying availability/popularity or promotional information to create an impression of scarcity
- c. Default options that require the consumer to reject them or that otherwise infer consent for additional payments (e.g., automatically adding an accessory or side dish to the main order so that the consumer has to deselect it before ordering)
- d. Presenting the option to decline an offer as the wrong choice
- e. Creating the false impression that a prominently featured option is the only one
- f. Persistently requesting the consumer to make or change a choice they already made (unless necessary for compliance reasons)
- g. Misleading or ambiguous presentation of choices, including by linguistic or logical framing, or double negatives
- h. Presenting the price or contract duration less prominently than other material information
- i. Notifications that falsely suggest a direct contact or other matter requiring attention
- j. Making refusals, withdrawals or changes of choice overly difficult
While the unfairness of some of these practices is largely uncontroversial, others are likely to cause disagreement and may disproportionately affect companies from certain countries. For example, “double negatives” are an extremely common feature in the Japanese language, so Japanese traders may face more difficulties than others in ensuring that their presentation is free from language the EU Commission would deem unfairly misleading or ambiguous.
The dark pattern prohibition under the DFA is meant to complement the prohibition that already applies to providers of online platforms under Art. 25 DSA, since it applies to traders directly (Recital 52 DFA-P). However, the fixed list of dark patterns included in Annex I Part III of the DFA will likely have a significant influence on the guidelines the Commission is still to adopt to specify the application of Article 25 DSA.
2. Influencer marketing
In a move to rein in irresponsible marketing by influencers, each commercial communication by a trader carrying out influencer marketing shall include the terms “advertisement” or “commercial collaboration” to disclose its commercial intent. On online platforms, this shall be done via the functionality required under Art. 26(2) DSA (Art. 11(1), (2) DFA-P).
A complete prohibition applies to
- a. direct exhortations to minors to buy products or persuade adults to do so,
- b. creating the false impression of not acting for commercial purposes,
- c. creating the false impression that a product is appropriate for minors (Art. 11(3) DFA-P).
If implemented and enforced, especially the first prohibition is likely to significantly change how influencer marketing to EU consumers will look. Considering that “minor” is defined as any natural person under the age of 18 (Art. 3(16) DFA-P), even extremely common refrains like “You must buy this video game/make-up/energy drink/etc.” would need to disappear.
Influencer marketing for products classified as “dangerous”, i.e. carrying more than a minimum risk under normal or reasonably foreseeable use, within the meaning of the General Product Safety Regulation (Regulation (EU) 2023/988) would also be completely prohibited (Art. 11(5) DFA-P).
Notably, these prohibitions do not only apply to influencers themselves, but also to companies using influencer marketing services, e.g. via agencies. They must ensure, by contract or otherwise, that influencers comply with the regulation (Art. 11(6) DFA-P).
3. Personalised advertising and pricing
Profiling is also seen as a risk to “digital fairness”.
Traders shall therefore be prohibited from targeting advertisements based on profiling where they are aware with reasonable certainty that the consumer is a minor, or where the targeting uses special categories of personal data under Article 9(1) GDPR (Art. 12 DFA-P). This essentially extends the advertising restrictions for online platforms under the DSA beyond online platforms (cf. Art. 26(3), 28(2) DSA), who for that reason do not also have to comply with the DFA (Art. 12 sent. 3 DFA-P).
Moreover, Article 13 DFA-P prohibits personalised pricing based on profiling where it is reasonably likely to harm minors or consumers whom the trader knows with reasonable certainty to be vulnerable. In both cases, the proposal expressly states that traders are not obliged to process additional personal data in order to establish whether a consumer is a minor or vulnerable (Art. 12 sent. 2, 13 sent. 2 DFA-P). However, how this might be used as a defence in practice remains to be seen, and will depend to a large extent on the interpretation of the term “additional”. Even if there is no statutory requirement, additional data processing may nevertheless be incentivised as companies may otherwise find it difficult to rule out an impact on underage or vulnerable consumers.
A further point of contention will likely be how to determine vulnerability, given that the DFA-P allows for vulnerability due to “age, credulity, disability, or any specific misfortune or circumstance of such gravity as to impair the consumer’s judgment” (Art. 13 sent. 1 lit. (b) DFA-P). Credulity especially may prove difficult to assess, and misfortunes or circumstances cover a lot of very different scenarios.
Special rules are to apply to price transparency in the event ticket sector. For event tickets whose price may rise dynamically, traders shall be required to state how many tickets are available at the advertised price and what the maximum price is. When re-selling, the original total price must also be provided. In virtual queues, traders shall display the current price in real time and the maximum price (Art. 18, 19 DFA-P). Certain misleading price practices will also be prohibited under Article 5 in conjunction with Annex I DFA-P.
4. Spending-maximising practices and addictive design
The target of further provisions are various monetisation models that are particularly prevalent in gaming.
Firstly, building on the hotly debated principles published by the CPC Network in 2025 (see our previous article), the DFA sets out to impose new rules on the use of virtual currencies. Traders shall be required to state the real monetary value of virtual items that consumers buy with paid-for virtual currencies, potentially upending a traditionally observed distinction that had recently received some indirect support from the Court of Justice of the European Union (judgment of 5 March 2026, Case C-472/24). Furthermore, they shall be required to disclose the odds of variable reward systems such as loot boxes, and they must give all consumers a tool to switch those systems off. For minors, virtual currencies must even be disabled by default and may only be activated with parental approval. Paid-for loot boxes and pay-to-win or pay-to-progress mechanisms must not be offered to minors at all (Art. 14-16 DFA-P).
This section in particular has received significant criticism from gaming companies, who argue that limiting monetisation may in the end lead to fewer free-to-play games overall and would therefore be a disadvantage to consumers.
Under Article 17 DFA-P, traders whose digital products are designed to encourage, or can reasonably be foreseen to encourage, compulsive or excessive use must give consumers effective tools to switch off certain features. These include:
- a. autoplay (without effective and regular interruption),
- b. notifications unrelated to the user’s own activity,
- c. engagement streaks, and
- d. features that simulate interpersonal relations.
This provision in turn received criticism from consumer rights groups, who argue that by their nature, these types of features cannot be effectively regulated via off-switches, as consumers vulnerable to compulsive or excessive use would typically not use them. From an industry perspective, it will present a significant challenge to design games and other products in a way that allows for a separate switching off of individual features.
5. Digital contracts and AI agents
Online contracting is also to receive a new regime under the DFA.
In particular, a free trial shall only convert into a paid contract if the trader has sent a reminder and the consumer has expressly agreed (Art. 20 DFA-P). It remains to be seen whether this rule also covers trials with nominal amounts like one euro. Contracts lasting six months or longer that renew automatically require a reminder no earlier than one month and no later than fourteen days before renewal, or the consumer will be entitled to terminate without notice and free of charge. Contracts that have been extended for an indeterminate duration may be terminated at any time with no more than one month’s notice (Art. 21 DFA-P).
Moreover, for contracts that the consumer could conclude via an online interface, Article 23 DFA-P introduces an EU-wide online termination function labelled “terminate the contract here” or with a similarly unambiguous wording. As such a button is already required under German law (Section 312k Civil Code), many globally active companies may already be prepared for this change.
A more onerous impact could be associated with the right for consumers to communicate with a human in customer service, where customer service is provided at all (Art. 25 DFA-P). In a time in which many companies try to make use of AI for customer service, this requirement may prove a barrier. However, the requirement is only triggered upon the consumer’s request and “when other means are not effective”, making human support a means of last resort.
Article 26 DFA-P is an attempt to create rules for a phenomenon that is only now taking off, namely agentic shoppers. Traders that make AI agents available to consumers for contracting shall be required to let consumers set parameters such as maximum prices and decide which contracts they want to confirm. They must also disclose any payments or conflicts of interest. Interestingly, if automated systems are used both by the trader and the consumer, relevant information may be provided in machine-readable form only (Art. 27 DFA-P).
6. Commercial communication
Finally, the prohibition of unsolicited commercial communication via calling machines or electronic messages is to be moved from the ePrivacy Directive into the directly applicable DFA (Art. 28 DFA-P). Whether this will actually lead to more harmonisation in an already quite harmonised area or whether it will, as some commentators claim, weaken enforcement, remains to be seen.
III. Enforcement: Brussels joins the national authorities
A lot of reporting on the DFA focuses on the new role for the EU Commission. In case of widespread infringements with an EU dimension, the Commission is to receive the authority to investigate and impose fines up to 6% of the trader’s worldwide annual turnover (Art. 35(6) DFA-P; Art. 32 et seq., 43 CPC-R-P). It can also work together with the national market surveillance authorities (cf. Art. 39 CPC-R-P). However, companies with up to 250 employees, an annual turnover up to EUR 50 million or a balance sheet total of up to EUR 43 million are shielded from enforcement by the Commission (Art. 31 CPC-R-P).
That said, enforcement on the national level also becomes considerably more robust. National authorities shall be able to impose fines with a maximum amount of at least 4% of the trader’s annual turnover in the Member States concerned in coordinated CPC actions (Art. 35(3) DFA-P). For traders that fall within the scope of the DSA, the AI Act or the EU KIDS Act, the proposal assigns parts of the enforcement to the authorities under those acts.
Moreover, courts and authorities shall have the power to order traders to disclose evidence on the design, operation and impact of an online commercial practice. Claimants only need to show that an infringement is likely, or authorities need to have a reasonable suspicion. Courts and authorities may treat a failure to disclose as an indication that the practice is unfair (Art. 34 DFA-P).
Consumers shall also be entitled to remedies such as compensation, a price reduction or termination of the contract (Art. 32 DFA-P). Where a supplier causes an infringement, Article 36 DFA-P gives traders a right of recourse against that supplier.
IV. Outlook
The proposal attempts several things at once, often aiming straight at quality-of-life issues broadly recognised as nuisances or even harmful, but sometimes adopting very broad rules and categories that may prove onerous for companies falling within their scope.
The proposal still has a long way to go before becoming applicable law. Both in the European Parliament and the Council, it is likely to be the subject of contentious debates. The Commission expects consumer detriment to fall by EUR 13.7 billion a year, with recurring additional costs for businesses at EUR 678 million a year. These figures alone suggest the high stakes of the discussion. Even once adopted, the regulation is only to apply twelve months after its entry into force (Art. 40(2) DFA-P). Even if the legislative process moves quickly, the new rules are therefore unlikely to apply before the end of 2028.
Even so, companies should not wait. Many of the practices concerned are already open to challenge under the existing consumer protection law, and consumer protection authorities and organisations are likely to feel empowered by the draft DFA. Moreover, data protection authorities and digital services coordinators responsible for enforcing the DSA are likely to take the draft as inspiration. Finally, if adopted, certain rules will not be easy to implement, but may require a holistic change of strategy or product design.
Companies should therefore take stock of their online interfaces, monetisation models, influencer contracts, personalisation logic and subscription journeys, and they should document their design decisions (if that has not yet been done) as a basis for analysis if the DFA moves further along the legislative process. Companies should also follow this process and the legislative process of the EU KIDS Act closely, because even during a time of Omnibus simplification initiatives, the EU regulatory motor is still running.
Forward
