The European Commission today adopted its proposal for a Digital Fairness Act, a regulation that would replace the Unfair Commercial Practices Directive of 2005 and give the Commission its own power to investigate consumer law breaches and fine companies up to 6% of their worldwide annual turnover. The proposal, registered as COM(2026) 1100 final under procedure 2026/0356(COD), runs to 72 pages plus an 11-page annex. It was adopted together with a Simplification Directive, COM(2026) 1110 final, and a revision of the Consumer Protection Cooperation Regulation. According to the Commission's Digital Fairness Act page, the three texts together "represent the most significant upgrade of EU consumer protection legislation in over 20 years."

For advertisers, publishers and ad tech companies, the most direct change sits in Article 12. The Digital Services Act already stops online platforms from showing ads based on profiling to users they know are minors, or based on sensitive personal data. The Digital Fairness Act would apply the same prohibition to every other trader, and the recitals name providers of advertising services among them. Brands and agencies would carry legal responsibility for the influencers they pay. Ten new interface practices would be banned outright, subscription traps would face reminder and cancellation rules, and AI shopping agents would have to disclose when they are paid to suggest a purchase.

In Short

The European Commission today proposed a law that would ban a list of manipulative website designs, stop all companies from using profiling to target ads at children or at people's health, ethnicity or other sensitive traits, and require an online cancel button for contracts concluded online. It affects every business that sells to people in the EU, including ad tech companies, brands and agencies that pay influencers, game publishers and anyone offering AI shopping assistants. Brussels could fine companies up to 6% of their worldwide turnover in large EU-wide cases, but the European Parliament and the Council of the EU still have to agree the text, and the rules would only apply 12 months after the final law takes effect.

What the Commission adopted today

The package has three legal parts. The Digital Fairness Act itself is a regulation, which means it would apply directly in every Member State without national transposition. According to the explanatory memorandum, it "will replace 27 transposing regimes of the Member States" and turn the substance of Directive 2005/29/EC, the Unfair Commercial Practices Directive (UCPD), into directly applicable law. That conversion is also described as "a legal precondition for centralising consumer law enforcement in specific cases at Union level," because the Commission can only enforce regulations directly.

The second part, the Simplification Directive, amends the Consumer Rights Directive (2011/83/EU) and the ePrivacy Directive (2002/58/EC). The third is the revision of the Consumer Protection Cooperation (CPC) Regulation, COM(2026) 1120 final, which sets out when the Commission can step in.

Several documents were published alongside the proposals: an impact assessment report (SWD(2026) 1101 final), its executive summary (SWD(2026) 1102 final), a two-page factsheet and a Q&A from the Commission press service (QANDA/26/2408). All carry today's date. The timing did not go unnoticed. In a LinkedIn post published today, Christoph Busch, a professor at the University of Osnabrück and an affiliated fellow at Yale Law School, wrote that the package was "unveiled today (fittingly on Singles' Day, a big day for online shopping)."

Under Article 40 of the proposal, the regulation would enter into force 20 days after publication in the Official Journal and apply 12 months after that. The Simplification Directive gives Member States 12 months from its entry into force to transpose it. Article 39 requires the Commission to evaluate the regulation within 60 months of the date it starts to apply.

Where it came from

The proposal builds on the Fitness Check of EU consumer law on digital fairness, published as a staff working document on 3 October 2024, which evaluated the UCPD, the Consumer Rights Directive and the Unfair Contract Terms Directive over 2017 to 2023. According to the explanatory memorandum, the Fitness Check found the three directives "only partially effective since consumer complaints and detriment remain high, legal uncertainty and legal gaps persist, and there is risk of regulatory fragmentation and insufficient enforcement."

A public consultation ran from 17 July 2025 to 24 October 2025 and received 3,341 responses. One campaign accounted for 1,594 of them, all from consumers, and was analysed separately. Of the remaining 1,733 responses, 72% supported new binding EU rules on dark patterns, 70% on addictive design, 70% on specific features in digital products, 70% on unfair personalisation and 68% on influencer marketing, according to the proposal. The memorandum adds that "some businesses and business associations stressed the need to avoid overlaps, duplication and unnecessary regulatory complexity," and that support among SMEs was generally higher than among large companies and business associations.

The advertising industry had made its position known early. On 14 July 2025, IAB Europe and a coalition of advertising groups wrote to Executive Vice-President Henna Virkkunen and Commissioner Michael McGrath arguing that the UCPD, the DSA and the GDPR already covered the concerns behind the act and that enforcement should come before new rules.

The Regulatory Scrutiny Board gave the impact assessment a positive opinion with reservations on 3 July 2026. It asked the Commission to clarify how dark patterns, addictive design and unfair personalisation relate to each other, to define some measures more clearly, and to better reflect "some methodological shortcomings of quantifications, in particular of revenue effects for businesses." The memorandum says the report was updated to address these points.

Profiled ads to minors and sensitive data: the DSA rule extended to everyone

Article 12 of the proposal prohibits targeting advertisements "to a consumer based on profiling as defined in Article 4, point (4) of Regulation (EU) 2016/679" in two cases: by using personal data of the consumer "where the trader is aware with reasonable certainty that the consumer is a minor," and by using special categories of personal data under Article 9(1) of the GDPR, such as data revealing racial or ethnic origin, health or sexual orientation.

The article adds that compliance "shall not oblige traders to process additional personal data to assess whether the consumer is a minor." It does not apply to online platforms already covered by Section 3 of Chapter III of the Digital Services Act, which carries the equivalent rule for them.

Recital 58 explains why the Commission wants the rule to reach further than the DSA: "the dissemination of personalised online advertisements can involve a complex chain of actors beyond providers of online platforms." Recital 59 then names that chain. The prohibitions "should apply to all traders, including providers of advertising services, that target or facilitate the targeting of advertising, such as by selecting the advertising content, selecting the targeting and ad-delivery criteria, providing the data used for the targeting and delivery of an advertisement, providing the targeting techniques and ad-delivery techniques, and delivering and disseminating an advertisement."

That description covers demand-side platforms, data providers, ad networks and publishers that sell targeted inventory, though none of these terms appears in the text. The same recital extends the scope beyond banner ads. The ban "should also apply where personalised advertising takes the form of personalised content suggestions, product rankings and recommendations, and other types of promotional targeted messaging, including in natural language systems." That last phrase would appear to bring sponsored answers from AI chat assistants within reach of the rule.

In the Q&A, the Commission summarises the change in one line: "The DFA will extend these bans to all websites and apps."

What the impact assessment found

The impact assessment cites a study estimating that 85% of digital display ads are personalised. Researchers who examined about 40,000 ads with disclosure pages on 804 children's websites found that targeting was enabled for 68% of the ads accessed from the EU. In 2023, a data marketplace was found to hold 650,000 audience segments usable for targeting in the US and Europe, including segments that would allow conclusions about medical conditions and sexual orientation. In the consumer survey carried out for the Commission's supporting study, 74% of 10,560 respondents said they had experienced unfair personalisation in the previous 12 months.

A footnote gives a sense of what is at stake commercially. Based on a simulated revenue model, "a substantial share of advertising revenue on three major social media platforms in the US in 2022 was estimated to be derived from minors, approximately 30-40% depending on the platform."

The impact assessment considered a self-regulatory option first and dismissed it as having "a very limited impact." Its footnotes name the existing schemes it had in mind: the YourAdChoices Program of the Digital Advertising Alliance and IAB Europe's Transparency and Consent Framework. According to the report, "self-regulation and standardisation efforts are already ongoing, in particular in personalised advertising, but problematic practices continue."

On costs, the report says impacts per business would be most pronounced in digital content and entertainment services and in the "influencer and content-driven monetisation sector, probably due to the fact that their business model is based on revenue streams from advertising, including to youth." It puts the annual cost per company at between EUR 15 and EUR 41, depending on the option. SMEs reported smaller direct revenue losses "as many are less dependent on sophisticated behavioural advertising," though they face proportionally higher compliance costs, "possibly related to switching to alternative methods for delivering advertising."

What the final text left out

The impact assessment's preferred option on personalisation, labelled C3, went further than the legal text that was adopted. According to the executive summary, personalised advertising would be prohibited when targeting minors, when based on special categories of data, "or when based on information on the consumers' vulnerabilities." Article 12 contains only the first two. Vulnerability appears in the proposal only in Article 13, on pricing.

The explanatory memorandum also describes Article 12 as prohibiting such targeting "when this could cause harm to the consumer." The article itself contains no harm condition. The Commission has not explained either difference.

Personalised pricing

Article 13 bans personalising prices based on profiling "in a manner that is reasonably likely to cause harm to the consumer" where the trader is aware with reasonable certainty that the consumer is a minor, or is vulnerable "due to their age, credulity, disability, or any specific misfortune or circumstance of such gravity as to impair the consumer's judgment." Recital 60 says the ban would in most cases cover higher prices but could include lower prices that steer a consumer towards a harmful product. Student and senior discounts stay lawful, as does differentiation "based on lawful, relevant, objective and transparent factors, such as evidence-based insurance risk."

Influencer marketing: brands and agencies share the liability

Article 3(15) gives influencer marketing a legal definition for the first time: "a commercial practice whereby traders use their popularity among their audience to directly or indirectly promote products in exchange for payment." Recital 22 gives payment a broad meaning, covering "gifts, invitations, and any other payment in kind."

Under Article 11, disclosure must be "clear, prominent, and unambiguous," and must be made explicit "for each commercial communication, through the terms 'advertisement' or 'commercial collaboration'." On platforms covered by the DSA, influencers would have to use the platform's own disclosure function under Article 26(2) of that regulation. Recital 54 adds that the label should appear at the outset and stay for the duration of the content.

Influencers would be barred from directly exhorting minors to buy, from hiding commercial intent "in particular when the relevant communications are carried out by or feature minors," and from presenting products as suitable for minors when they are not. Influencer marketing of products that EU or national law prohibits from being advertised, and of dangerous products under the General Product Safety Regulation, would be prohibited.

The change with the widest commercial reach is in Article 11(6): "Any trader using influencer marketing services shall ensure contractually, or in the absence of a contract through other appropriate means, that the trader carrying out influencer marketing complies with the provisions of this Regulation." Recital 56 names the traders concerned as "companies selling branded products or advertising agencies," which "determine the subject matter and the incentives of such communications." They would be liable "irrespective of the type of payment granted to the influencer" and "irrespective of the degree of editorial freedom conferred to the influencer." A contract clause cannot be used to shift that liability onto the creator. Where products are only gifted, brands are expected to inform the influencer of the rules, check disclosure and, where needed, request correction or removal. The Q&A says it plainly: "Brands and agencies will have to ensure that influencers comply with their obligations."

One burden goes away. Under Article 7(4), traders that do not sell directly to consumers, "including in the context of influencer marketing," would no longer have to publish a geographical address in an invitation to purchase.

The impact assessment cites a 2023 sweep by the CPC network and academic studies finding that "around 75% - 95% of influencers may not be disclosing the commercial nature of advertising content." The Commission's sweep, published in February 2024, found that about 80% of influencers posting commercial content did not disclose it as advertising. Around one in five influencers in that sweep promoted unhealthy or hazardous products, including crypto trading and gambling, according to the impact assessment. National enforcers were already moving. Sweden's consumer agency, Konsumentverket, reported persistent disclosure failures in March 2026, after a spring 2025 operation on child-facing platforms produced 52 enforcement cases, and Finance Watch asked in September 2026 for the act to outlaw steering design features after finding that 34 of 59 finfluencer posts carried low-quality risk warnings.

The impact assessment's preferred option described the ban for minors as covering "high-risk financial products, sports betting or gambling." The legal text does not list product categories. It relies instead on existing advertising bans, product safety law and the prohibition on presenting products as suitable for minors.

Ten new banned designs, and five more banned practices

Article 10(1) states the general rule: traders "shall not design, organise or operate their online interfaces, including visual, auditory and other components thereof, in a manner that is likely to deceive or manipulate consumers, or in a manner that is likely to otherwise materially distort the economic behaviour of consumers."

A new Part III of Annex I lists ten dark patterns that would be unfair "in all circumstances," which means no case-by-case test of their effect would be needed. They are:

  • false claims about the availability or popularity of a product, or failing to disclose relevant qualifications about them (point 53);
  • persistently displaying availability or popularity statements "throughout the ordering process" to create an impression of scarcity (54);
  • default options the consumer must reject, or inferring consent to pay for an additional product, a different quantity or a different product (55);
  • presenting the option to decline a purchase, or to stop a supply, "as the wrong choice" (56);
  • creating the false impression that there is no option besides the prominently featured one (57);
  • repeatedly asking consumers to make or change a choice they have already made, where the law does not require it (58);
  • misleading or ambiguous language, "including by reversing the linguistic or framing logic within a list of choices, or using double negatives" (59);
  • presenting the price, the contract duration or automatic renewal "with less prominence than other items of material information" (60);
  • notifications falsely suggesting that another consumer, the trader or a third party has made contact, or that a matter needs attention (61);
  • making the steps to refuse, withdraw or change a choice "disproportionately more numerous, complex or time-consuming than is reasonably necessary" (62).

The Q&A illustrates the rules with examples: "Only 1 left", "5 other customers are interested in this!", "We're sad to see you go", and a button reading "I don't like good deals" to unsubscribe from a mailing list. Article 10(3) lets the Commission add or change entries by delegated act, subject to a two-month objection period for Parliament and the Council that can be extended by two months.

Part I of the annex, on misleading practices, also gains entries. The correlation table in Annex II maps 47 entries from the 2005 directive's blacklist to the new annex, which has 62. By PPC Land's count, 15 entries have no predecessor: the ten in Part III and five in Part I. Those five are price comparisons against a reference price that is not "a current price charged for the product by a clearly identified competitor on the market" (point 11), drip pricing (12), limited-time claims that do not state the duration of the offer (14), and two dropshipping practices (33 and 34): falsely implying a seller holds stock, and falsely implying consumers cannot exercise their rights because a third party fulfils the order.

The impact assessment reports that a 2022 mystery shopping exercise for the Commission found that "97% of popular websites and apps deploy at least one dark pattern." In the same consumer survey, 70% of 10,560 respondents said they had encountered at least one at least a few times a year. Among those who encountered them, 13% said they bought something they did not need. The report puts the resulting financial detriment at "at least EUR 2.71 billion per year." As part of the same package, the Simplification Directive deletes Article 16e of the Consumer Rights Directive, which covered dark patterns only in distance contracts for financial services, because the new horizontal rule makes it redundant.

Addictive design, loot boxes and virtual currencies

The definition of "transactional decision" in Article 3(6) now includes the decision to "continue using a product." Recital 21 gives an example: "the decision to enter a shop or to continue scrolling in a digital setting." That brings engagement time, not only purchases, within the scope of consumer law.

Article 17 requires traders whose products are designed, or "can reasonably be foreseen," to encourage compulsive or excessive use to provide "effective tools enabling them to disable, individually or all at once," four kinds of feature:

  • autoplay and "uninterrupted content consumption without effective and regular interruption moments";
  • notifications "not triggered by, or not directly related to, the consumer's interaction or activity on the service";
  • features that reward engagement at regular times or penalise consumers who fail to engage;
  • "features and system behaviours that encourage continued use by simulating interpersonal relations, such as persistent prompts to continue engaging with an automated system."

Recital 66 links the fourth item to AI companions and general conversational chatbots, which "may simulate interpersonal relations to incentivise prolonged use." Article 17 does not apply to traders covered by the relevant articles of the proposed EU KIDS Act "for practices concerning minors." The Commission adopted that proposal on 17 September 2026, setting 15 as the minimum age for autonomous social media accounts. The Commission can extend the Article 17 list by delegated act.

The Digital Fairness Act requires an off switch rather than a ban. Busch, in his post, summarised the rule this way: "The DFA provides that consumers can disable these features (Art. 17)." A comment beneath his post from Felix C. Methmann took the opposite view: "harmful engagement-maximising features remain legal, as long as users can switch them off. Consumer protection should not rely on the self-control of those already being manipulated."

The DSA already reaches some of these features on the largest platforms. The Commission issued preliminary findings against TikTok in February 2026 and against Meta's Instagram and Facebook on 10 July 2026 over infinite scroll, autoplay, push notifications and recommender systems. Recital 66 says nothing in the new regulation "should affect the application" of the DSA's rules on addictive design. Under Article 30(5), DSA and AI Act authorities, not consumer authorities, would enforce Article 17 for online platforms and for AI system providers.

Spending features

Articles 14 to 16 deal with what the impact assessment calls spending-maximising features. A trader selling paid-for virtual currencies would have to show the monetary value of the virtual items they buy, in the currency the consumer first paid in. Where products are directed at minors, or the trader knows with reasonable certainty that minors use them, virtual currencies must be "disabled by default for minors" and can be activated only with parental approval.

Paid loot boxes, defined as "paid-for variable reward systems," would require disclosure of the types of items available and "the probability of obtaining them." All consumers would get a tool to disable them, and minors could not be offered them at all. Article 16 bans "pay-to-progress and pay-to-win mechanisms" for minors. Social networks, video-sharing platforms, AI companions and general chatbots covered by the KIDS Act are carved out of some of these provisions.

According to the impact assessment, an ICPEN sweep found loot boxes in 46% of screened games, and 78% of those games used virtual currencies. An academic audit found loot boxes in 58% of the 100 top-grossing games on Google Play, 59% of the 100 top-grossing iPhone games and 36% of the 50 most-played games on Steam. Busch called this part of the package overdue: "Games have become a massive industry and have so far received too little attention under consumer law." Another commenter on the post, Boyan K., a legal director, wrote that on video games and minors "the draft does not nearly go far enough."

Pricing: tickets, queues and drip fees

Article 18 covers event tickets whose price can rise "due to the trader's actions or due to automated or algorithmic processes." The trader would have to show how many tickets in the category are available at the advertised price and the maximum price a consumer could pay. Resellers would have to display the original total price set by the organiser and, where applicable, the ticket category, row and seat. Under Article 19, any trader using a virtual queue would have to display the current price, updated in real time, say whether it can change during the wait, and state the maximum.

The European Parliament had gone further. In a resolution of 7 July 2026, cited in the impact assessment, it asked the Commission and Member States "to consider all regulatory options, including the prohibition of dynamic pricing at live sports and cultural events in the Digital Fairness Act." The proposal regulates the display of dynamic prices but does not ban them.

Drip pricing becomes a blacklisted practice under Annex I point 12: presenting a price without including, at the first stage at which pricing information is given, "all foreseeable fees, taxes, charges or other payments that the consumer will unavoidably incur." According to the impact assessment, past CPC sweeps found 10% to 39% of screened e-commerce traders using drip pricing, and a consumer association found management fees, typically added only at checkout, on 92% of 50 ticketing websites.

Subscriptions: reminders, a cancel button and a human

The contract provisions in Articles 20 to 25 would apply to contracts concluded through an online interface or other digital means.

Free trials (Article 20). Before a free trial ends, the trader must remind the consumer on a durable medium of the end date, the price, the duration and the conditions for terminating the paid contract. The contract continues on a paid basis only "if the consumer expressly agrees." If the reminder is not sent, or the consumer does not agree before the trial ends, "the consumer shall not be bound by the contract." Confirmation of the paid contract must follow within a week.

Renewals of contracts of six months or longer (Article 21). The reminder must arrive "no earlier than 1 month and no later than fourteen days" before the automatic extension. If it does not, the consumer can terminate free of charge at any time, with no notice period and nothing owed for the period after the extension. A contract extended for an indeterminate period can be ended at any time with "a maximum one-month notice period."

Shorter contracts (Article 22). For contracts under six months, the reminder must come at least one week before the extension that takes the total duration to six months, or before the tenth extension, whichever comes first.

The cancel button (Article 23). Any trader that lets consumers sign up online must offer an online termination function labelled "terminate the contract here," prominently displayed, followed by a confirmation button labelled "only with the words 'confirm the contract termination'." An acknowledgement must be sent within a week. Article 24 creates an equivalent "withdraw from contract here" function for the right of withdrawal, which moves into the act from Article 11a of the Consumer Rights Directive.

A human being (Article 25). A trader offering online customer service after a contract is concluded must provide "communication with a human being" on request "when other means are not effective."

The impact assessment cites a 2024 ICPEN sweep finding that 81% of traders used interface design that stopped consumers from turning off auto-renewal, and 70% gave no clear directions on how or when to cancel. In the consumer survey for the supporting study, 82% of 6,287 respondents had experienced at least one of these contract problems. The United Kingdom has been working on similar rules: its government confirmed in April 2026 subscription rules with two 14-day cooling-off windows, expected to commence in spring 2027.

Busch raised a gap in the free trial rules in his post. Article 3(13) defines a free trial as one with no payment "in funds," so a trial priced at a token amount may fall outside Article 20. "However, a clear rule is missing for trial offers that are not 'free' but for which the consumer pays a nominal fee (e.g. 1 euro for a trial month)," he wrote. "Can these contracts be converted into full-price contracts without a reminder and express agreement? Or does the anti-circumvention rule (Art. 29 DFA) perhaps apply here?" Article 29 bars traders from "any conduct that undermines effective compliance with their obligations in Chapter III," whether contractual, commercial or technical, or through "behavioural techniques or interface design."

AI shopping agents

Article 26 is the first EU consumer law provision written for AI agents that buy on a consumer's behalf. It uses the term "automated system," defined in Article 3(21) as software capable of "taking decisions producing legal effects for its user, including concluding contracts, without the need for human intervention."

Any trader that offers consumers such a system would have to make the consumer choose, on first use, between three settings: confirm every contract the agent proposes, confirm only certain contracts "based on specific criteria to be set by the consumer, including a maximum price and a time limit," or require no confirmation at all. Recital 78 gives examples of the criteria consumers should be able to set, such as excluding contracts above a set value or limiting the agent to specific traders.

For advertisers, the most consequential part is Article 26(4)(b). The agent "shall disclose any payment received by the traders making available to consumers automated systems for contracting for proposing a contract and any conflict of interest with the traders concerned by a proposed contract." Where there is such a payment or conflict, the consumer must confirm the contract, "independently of the choice expressed by the consumer." Recital 78 names the cases it has in mind: "a sponsored suggestion by the automated system" and "preferencing of that trader's products in the proposals made by the automated system." A paid placement inside an AI shopping agent could therefore never be bought automatically, even by a consumer who had chosen no confirmation at all.

Other provisions follow the same logic. Under Article 26(9), traders could not design their interfaces to force consumers to use an agent to access offers. Agents would pass the consumer's contact details to the seller. Traders and agent providers "may identify and authenticate themselves" using a European Business Wallet or a European Digital Identity Wallet. Article 27 lets traders supply pre-contractual information only in machine-readable form where both sides of a contract are automated. Financial services are excluded from Article 26.

Busch, whose 2025 paper on regulating agentic AI under the Digital Fairness Act is cited in the impact assessment, called this "the most interesting and innovative part of the DFA." He wrote: "If the future of online commerce belongs to AI shopping agents (such as Meta Muse), then it must be ensured that consumers retain control." On Article 26(4), he said the disclosure duty exists "so that AI agents do not become 'double agents'." He was less persuaded by the rest: "I find the rule on information obligations in agent-to-agent commerce (Art. 27) less convincing. But perhaps I just need to read it again more thoroughly..."

The questions Article 26 addresses are already arising in the market. A Muse instruction file analysed by State of Brand in October 2026 called it "imperative" that the agent's top five product picks come from well-known merchants, and Amazon blocked Muse from buying on its site in September 2026, citing among other things the agent's failure to identify itself. On 27 October 2026, Spain's data protection authority, the AEPD, published a guide built on the rule that the agent prepares and the person approves, the same principle Article 26 would turn into an obligation for providers.

The impact assessment estimates that 0.7% to 1.5% of EU enterprises, roughly 235,000 to 475,000 companies, already use AI solutions for contracting, and that the number could reach 260,000 to 570,000 within a decade. It puts the cost of the agent rules at EUR 33 million to EUR 65 million over ten years, plus EUR 11 million to EUR 22 million in one-off costs, against expected savings of EUR 1.2 billion to EUR 2.5 billion.

Email and SMS marketing move into consumer law

Article 28 moves the rules on unsolicited direct marketing from Article 13 of the ePrivacy Directive into the new regulation for business-to-consumer communications. Automated calls, SMS, MMS and email for direct marketing would require prior consent as defined in the GDPR. The existing exception for a trader's own similar products remains, provided consumers can object free of charge when their email address is collected and in every message. Every marketing email must carry a valid address for opt-out requests. Telefax is dropped because, according to recital 82, it "has lost its relevance as a means of communication in business to consumer relations."

The Simplification Directive adds a paragraph to Article 13 of the ePrivacy Directive so that its rules no longer apply to unsolicited marketing aimed at consumers. Member States could still allow live marketing calls to consumers who have not opted out, under Article 28(3). That provision is one of the matters excluded from the Commission's direct enforcement powers.

Enforcement: Brussels takes a direct role

Under Article 30(4), the Commission would have "powers to investigate and enforce compliance with this Regulation with regards to widespread infringements with a Union dimension," as defined in the revised CPC Regulation. According to the Q&A, the Commission could intervene "when a breach is likely to affect consumers in at least two-thirds of EU Member States, representing at least two-thirds of the EU population," and only where the company is not an SME. "If the Commission decides to launch proceedings, national authorities will have to stop investigating the same case," the Q&A adds.

Article 35(6) sets the ceiling: the Commission "may impose fines not exceeding 6% of the trader's worldwide annual turnover." For coordinated national actions, the maximum fine available must be at least 4% of the trader's annual turnover in the Member States concerned, or at least EUR 2 million where turnover figures are not available. The factsheet adds that non-EU businesses targeting EU consumers "will have to appoint a representative in the EU to cooperate with national authorities and the Commission." That obligation sits in the CPC revision, which was not among the published documents reviewed for this article.

Two procedural changes would make cases easier to bring. Article 34 lets courts and authorities, at the request of a claimant who shows the likelihood of an unfair online practice, require traders to disclose "relevant evidence in relation to the design, operation and impact on the behaviour of consumers of the relevant commercial practice," with protection for trade secrets. A failure to disclose may count as "a relevant element in establishing the unfairness" of the practice. The impact assessment expects this lighter burden of proof to help "especially in cases concerning personalised commercial practices." Article 36 gives a trader held liable a right of recourse against a commercial partner whose act or omission caused or contributed to the breach. That could matter in ad tech, where a publisher, an agency or a data provider may each have played a part in a targeting decision.

The DSA already gives the Commission a comparable role for the largest platforms. It fined Temu EUR 200 million under the DSA on 28 May 2026 and opened proceedings against Shein in February 2026. The explanatory memorandum cites parallel Commission and CPC network actions against Temu and Shein, covering "fake discounts, pressure selling, forced gamification" and fake reviews, as an example of how the DSA and consumer law work alongside each other.

The Simplification Directive

The Simplification Directive contains the burden reductions. It defines a "micro transaction" as an in-app purchase of digital content within an existing digital service contract with the same trader that costs no more than EUR 50 "or its equivalent in a virtual currency used by the trader." For these, traders would only have to give the main characteristics and the total price before purchase, rather than the full set of pre-contractual information.

For audio and video streaming subscriptions that start immediately, the 14-day withdrawal right with a pro-rata calculation of what the consumer owes is replaced by a one-month right to withdraw, with the consumer paying "the average price of the service for one month calculated on the basis of the full contract duration," and the trader continuing the service to the end of that month. Traders would no longer have to give withdrawal information where the consumer has agreed to immediate access to digital content and so loses the withdrawal right.

The directive also deletes the requirements to inform consumers about complaint-handling policies, after-sales services, commercial guarantees, codes of conduct and out-of-court redress where these are offered voluntarily. It removes Member States' option to impose extra information duties on online marketplaces, citing the fully harmonised DSA rules, and adds crypto-asset services to the definition of financial services. According to the memorandum, consumer-side stakeholders "were sceptical whether the simplification measures covered by the present proposal could be implemented without reducing consumer protection, while business stakeholders advocated the need for even further-going simplification."

The numbers behind the package

The impact assessment estimates the financial detriment to consumers from the practices covered at "at least EUR 10.3 billion" in 2026, rising to up to EUR 16.7 billion by 2035, excluding influencer marketing and contract problems. The Fitness Check had estimated EUR 7.9 billion, though on a narrower basis, after redress.

For the preferred option, the report projects:

  • a reduction in financial consumer detriment of EUR 88.4 billion over 2025 to 2035;
  • a reduction in monetised time loss of EUR 72.3 billion over ten years;
  • a combined annual reduction of EUR 13.7 billion, the figure the factsheet presents as "consumer savings";
  • annual recurrent costs for business of EUR 1.2 billion unadjusted, or EUR 678 million after adjusting for overlaps between measures;
  • net benefits for businesses of EUR 188 billion in net present value over ten years, or EUR 115.1 billion under a sensitivity analysis, with EUR 98.9 billion for SMEs;
  • direct enforcement costs for Member States of EUR 5 million to EUR 8 million a year across the EU-27.

The business figures rest on the expectation that revenue would shift from non-compliant to compliant companies, and the Regulatory Scrutiny Board's reservations were directed at exactly that quantification. The documents also contain two burden-reduction figures that are far apart. Both the impact assessment and the Simplification Directive say the quantified burden reduction measures "are expected to lead to EUR 197.5 billion overall savings in 10 years," while a later section of the impact assessment estimates the reduction in administrative burden at "EUR 50-100 million annually." The documents do not reconcile the two.

The impact assessment also sets the market context. It cites IAB Europe's AdEx Benchmark in putting Europe's digital advertising market at EUR 118.9 billion in 2024, "having nearly doubled since 2020," and expects the European subscription economy to grow from about EUR 114.0 billion in 2025 to about EUR 363.2 billion by 2035. The factsheet says "around 60% of EU consumers buy goods and services online"; the impact assessment, citing Eurostat, says 78% of internet users aged 16 to 74 shop online.

Not every part of the impact assessment's preferred option made it into the Digital Fairness Act. Some measures for minors, including age ratings for video games, a ban on attention-maximising features for minors on social media, and transparency of virtual currency prices on social networks and chatbots, were moved into the EU KIDS Act proposal.

Finance Watch: the gaps for investors

Finance Watch, a Brussels non-profit that describes itself as "an independent non-profit association dedicated to reforming finance in the interest of citizens," published its response today. It welcomed the proposals on dark patterns but said "considerable gaps remain for consumers accessing financial services online, even as the EU encourages more Europeans to invest their savings." The group set out four of them. Each corresponds to a provision in the text.

Investment risk is not on the blacklist. According to Finance Watch, the ten new dark patterns cover misleading language, fake notifications and obstacles to changing a choice, "but some prevalent tricks in financial services are not explicitly blacklisted; most worryingly, hiding investment risks." Part III of Annex I has no entry specific to financial products. Practices outside the list would still be judged case by case under the general rules on misleading omissions in Article 7.

Trading alerts may escape the off switch. Article 17 requires an opt-out, not a default setting, so addictive features "would remain unless consumers actively switch them off," Finance Watch said. It added that the requirement "may not even apply to trading alerts linked to investor holdings or activity." The text supports that reading: Article 17(1)(b) covers only notifications "not triggered by, or not directly related to, the consumer's interaction or activity on the service." Finance Watch's September study of 24 financial institutions' websites and apps found 19 instances of price notification features, "alerts which can prompt impulsive trades." The group cites research by the UK Financial Conduct Authority, dated 20 June 2024 and involving more than 9,000 consumers, in which push notifications increased the number of trades by 11% and the proportion of trades in risky investments by 8% compared with a control group.

Risky investments are not in the influencer ban. Article 11(5) bans influencer marketing of products that are "dangerous" under product safety law, which Finance Watch said "does not include risky investments in that dangerous product category, even though consumers can lose substantial savings." It noted that "France already prohibits influencer promotions of particularly risky financial products." In its study, 58% of 59 finfluencer posts across four EU countries failed to adequately disclose investment risks, and none of the 15 influencers was identified as holding a formal financial advisory licence or regulated credential. "Today's proposal may help viewers recognise promotions, but it does nothing to stop unqualified influencers from pushing risky products," the group said. The gap matches a difference noted earlier between the documents: the impact assessment's preferred option listed "high-risk financial products" among the products whose influencer marketing to minors would be banned, and recital 55 names "speculative instruments" as potentially harmful, but Article 11 itself names no financial products.

No human contact and no agent safeguards. Article 25, the right to reach a human being in customer service, "shall not apply to investment services" as defined in MiFID II, and Article 26(10) excludes financial services from the rules on AI agents that conclude contracts. Finance Watch said investors are "excluded from the proposed right to request a human being" and from the "new protections for consumers allowing AI to enter into contracts for them."

The text contains further carve-outs that the group did not list. Article 22(4) lets short-term investment contracts in financial instruments renew automatically without a reminder where the consumer has given explicit consent, and the virtual queue rules in Article 19 do not apply to orders on financial instruments. Under Article 2(8), Member States keep the right to impose stricter rules than the regulation on financial services and immovable property. In the other direction, the new withdrawal function in Article 24 expressly covers financial services contracts concluded online, and the general dark pattern prohibition in Article 10 replaces the narrower Article 16e of the Consumer Rights Directive.

Finance Watch tied the criticism to the Commission's push for households to invest more of their savings through the Savings and Investments Union and the Retail Investment Strategy. "The proposal takes encouraging steps on dark patterns. But there are worrying omissions in financial services throughout, a sector where consumer trust is already low, and people risk losing substantial savings," said Peter Norwood, Senior Research and Advocacy Officer at Finance Watch. "The Commission has recognised risks consumers face from addictive design and misleading influencer guidance, but the proposal often expects consumers to protect themselves. The onus should not be on the investors to switch off features that encourage compulsive use, or to judge whether an influencer knows what they are talking about." Under the proposals, he added, "investors could still be steered towards decisions that serve the seller's interest in generating trades and sales, above their own appetite for risk."

For financial advertisers, the result is mixed. Trading apps and brokers that pay finfluencers would face the same labelling and contractual liability as any other brand under Article 11, and the general dark pattern rules would apply to their onboarding and order flows. The investor-specific protections Finance Watch asked for are not in the proposal, so whether they are added depends on Parliament and the Council.

Why this matters for marketers

The Commission's own description of the adjustment is that large enterprises "need only to recalibrate design standards and monetisation strategies, shifting towards longer-term, reputation-driven models that reduce short-term flexibility but increase predictability and lower enforcement risk." For the advertising market, the practical reach is wider than that sentence suggests.

Article 12 would move the DSA's targeting rules from a handful of platform obligations into general consumer law, covering publishers' own sites, retail media networks, apps and the intermediaries that supply data and delivery. The proposal does not oblige anyone to process extra data to verify age, but under recital 29, whether a trader knows a product is used by minors "should be assessed having regard to objective indicators." Recital 30 gives customer accounts and age ratings as examples. Audience segments built on health-related data, or aimed at users a company knows to be minors, would fall under a rule the Commission could enforce directly in EU-wide cases.

Influencer compliance would move up the chain, from the creator to the brand and the agency. Conversion design would change too: scarcity counters, pre-ticked add-ons, confirmshaming and asymmetric opt-out flows are common in checkout optimisation, and the anti-circumvention clause in Article 29 is written to catch redesigns that achieve the same effect. A strike-through price against a manufacturer's recommended retail price would be blacklisted unless the reference is a current price charged by a clearly identified competitor.

For AI commerce, Article 26 would turn paid placement inside a shopping agent into a disclosed position that the buyer has to confirm. Privacy and consumer law would also move closer together. The impact assessment notes that the Digital Omnibus "proposes to centralise privacy settings when data are collected via cookies or similar technologies," a measure that the Council dropped from its compromise text on 18 June 2026, while direct marketing consent moves from the ePrivacy Directive into consumer law, where the Commission could enforce it in cross-border cases.

What happens next

The Digital Fairness Act and the Simplification Directive now go to the European Parliament and the Council under the ordinary legislative procedure. If both institutions adopt positions, the final text will be negotiated in trilogue. The European Data Protection Supervisor is to be consulted. The 12-month application period runs from entry into force, so the rules would apply at least a year after the final text is agreed and published.

The Commission's proposals are a starting position. The Parliament called for legislation on addictive design in December 2023 and, in July 2026, asked the Commission to consider banning dynamic pricing at live events, which the proposal does not do. The advertising industry argued in 2025 that existing law was enough. Busch, who said he would speak on agentic commerce at the EU Consumer Summit in Dublin next week, summarised his first reading: "The DFA addresses the right issues. But there is still room for improvement in the details."

Timeline

Summary

Who: The European Commission, which adopted the proposals, and the traders that sell to consumers in the EU, including advertisers, publishers, ad tech providers, brands and agencies that use influencers, game publishers, ticket sellers, subscription businesses and providers of AI shopping agents. Christoph Busch, a professor at the University of Osnabrück, published an early assessment on LinkedIn. Finance Watch, a non-profit focused on finance, said the proposal leaves investors exposed to trading alerts and risky finfluencer promotions.

What: A proposed Digital Fairness Act regulation that would replace the Unfair Commercial Practices Directive. It would ban ten dark patterns and five further misleading practices outright, extend the DSA's ban on profiling-based ads to minors and on ads based on sensitive data to all traders, make brands and agencies responsible for influencer compliance, require opt-outs for addictive design features, ban loot boxes and pay-to-win mechanics for minors, impose reminders, express consent and a cancel button for subscriptions, require AI shopping agents to disclose paid suggestions, and let the Commission fine companies up to 6% of worldwide turnover. A Simplification Directive lightens information duties for in-app purchases up to EUR 50 and for streaming subscriptions.

When: The proposals were adopted today, 11 November 2026. The regulation would apply 12 months after it enters into force, which follows agreement between the European Parliament and the Council and publication in the Official Journal.

Where: The European Union. The rules would apply to any trader targeting consumers in the EU, including companies established outside it.

Why: The Commission's 2024 Fitness Check found existing consumer law only partially effective online. The impact assessment estimates consumer financial detriment from the practices covered at EUR 10.3 billion in 2026, and the Commission says a single regulation with central enforcement would replace 27 national transpositions and allow faster action against large cross-border infringements.