For almost twenty years, the Unfair Commercial Practices Directive (UCPD) has been the foundation of EU consumer law. That era is coming to an end. The European Commission's proposal for a Digital Fairness Act (DFA) (COM(2026) 1100 final), formally presented on 11 November 2026, would repeal the UCPD and replace it with a directly applicable regulation. It would also add a new chapter of "digital fairness" rules on dark patterns, influencer marketing, personalisation, addictive design and subscriptions.
Despite its name, the DFA is not only about the digital world. As it proposes to replace the UCPD in its entirety, it would become the EU's single rulebook for all business-to-consumer commercial practices, online and offline. Combined with a parallel overhaul of the Consumer Protection Cooperation (CPC) Regulation, it would also give the Commission something it has never had in consumer law: the power to investigate and fine companies directly.
Below, we look at what the proposal does, why the Commission thinks it is needed, and what companies should be doing now.
What you need to know
- One rulebook, directly applicable: The DFA would replace 27 national transpositions of the UCPD with a single regulation covering offline and online B2C practices alike.
- The Commission becomes an enforcer: Together with the new CPC Regulation, which was also formally presented on 11 November 2026, the Commission could investigate "widespread infringements with a Union dimension" itself and impose fines of up to 6% of worldwide annual turnover. The Commission would step in only where a breach is likely to affect consumers in at least two-thirds of Member States, representing at least two-thirds of the EU population, and the trader is not an SME.
- New digital rules: Dark patterns, influencer marketing, personalised advertising and pricing, virtual currencies and loot boxes, addictive design, dynamic ticket pricing and ticket resale, subscriptions and AI shopping agents are all addressed.
Green claims move to Brussels too: The greenwashing rules introduced by the Empowering Consumers for the Green Transition Directive (EmpCo) are carried over into the DFA.
Narrow bans, broad safety net: Many new prohibitions target only minors or vulnerable consumers. Outside those groups, the general fairness clause still applies.
Evidence moves to the trader: Courts and authorities could order companies to disclose how an online practice is designed and how it affects consumer behaviour, and could draw adverse inferences from a refusal.
Why now? The Commission's case for change
The proposal builds on the Commission's 2024 Fitness Check of EU consumer law. That review concluded that the existing directives remain "relevant and necessary". It also found that, in digital markets, legal uncertainty, regulatory fragmentation and ineffective enforcement undermine them. Moreover, the UCPD was designed before the data and attention economy, influencer marketing, subscription models and in-app purchases.
In our view, the real driver of the DFA is enforcement. Certain national authorities, such as Italy's AGCM, have been at the forefront of consumer protection enforcement, including in the digital space and often with innovative theories of harm. Nevertheless, the proposal states plainly that, given evolving business models, enforcement by Member States alone "is no longer sufficient". Because the Commission can enforce only directly applicable EU law, converting the UCPD into a regulation is described as a "legal precondition" for centralised enforcement. Using a regulation is what makes Brussels-level enforcement possible.
The Commission puts the reduction in consumer detriment expected as a result of the DFA proposals at EUR 88.4 billion over 2025–2035. It estimates recurrent business costs at around EUR 1.2 billion a year, or EUR 678 million once overlaps between measures are adjusted for.
Interplay with the wider regulatory rulebook
The DFA sits within a crowded digital rulebook. The DFA presents itself as a horizontal "safety net" that complements sector-specific digital legislation rather than duplicating it. It is without prejudice to the GDPR, the DMA, the DSA, the AI Act, the AVMSD and the proposed EU KIDS Act, and more specific EU rules prevail where there is a conflict, i.e. where the specific rule leaves the trader no margin for discretion. In practice, companies should expect the regimes to apply side by side.
The DFA is without prejudice to EU competition rules. However, the Commission's investigative toolkit, the 6% worldwide turnover cap and the coordination with the DSA and DMA bring consumer enforcement much closer to the antitrust model. Companies should expect cross-fertilisation of theories of harm, for example on self-preferencing in AI agents and on ranking transparency.
Not just digital: the DFA and offline practices
The DFA repeals the UCPD in its entirety and covers "fair business-to-consumer commercial practices in the offline and digital single market". Accordingly, the first two chapters of the draft DFA broadly carry over the familiar UCPD architecture: scope, definitions, the general prohibition and professional diligence test, misleading actions and omissions, and aggressive practices. Similarly, the list of practices banned under the UCPD is retained in Annex I. While much attention will therefore be dedicated to the new digital protections, it is important to note that the DFA will also regulate offline practices.
The digital rules in brief
A specific section of the proposed DFA focuses on "Digital-Fairness" rules. This section is complemented by new specific blacklisted practices included in Annex I.
Dark patterns. Art. 10 provides that online interfaces must not be designed, organised or operated in a way that is likely to deceive or manipulate consumers or otherwise materially distort their behaviour. Annex I sets out dark patterns that are banned in all circumstances, and the Commission may extend that list by delegated act. The list of dark patterns proposed to be added as banned practices in Annex I includes:
- fake notifications suggesting that someone has contacted the consumer or that a matter needs their attention;
- persistent requests to reconsider a choice already made;
- "confirm shaming" and misleading or ambiguous wording, including suggesting that a prominently displayed option is the only one available;
- making it disproportionately difficult to refuse, withdraw or change a choice; and
- displaying price, contract duration or automatic-renewal terms less prominently than other material information.
Outside the list in Annex I, the proposal also addresses other important dark patterns, including a first displayed price that does not include all foreseeable and unavoidable charges (a ban on "drip pricing"), limited-time offers that do not state their duration, and persistent scarcity messages during checkout ("urgency claims"). It also bans pre-ticked add-ons, fake reviews and the extrapolation of "likes" to other content, undisclosed paid ranking, and reference-price comparisons based on mere estimated or recommended prices, such as the manufacturer's recommended retail price.
Influencer marketing. Art. 11 mandates that every commercial communication must be labelled "advertisement" or "commercial collaboration" (on DSA platforms, the disclosure must be made through the platform's own functionality). Influencers may not urge minors directly to buy, conceal the commercial nature of content or present products as suitable for minors when they are not. In line with precedents at national level (such as those of the AGCM), brands and agencies disseminating commercial communications by means of influencer marketing must ensure compliance with the DFA, and may not seek to exclude their own liability with regard to the influencer.
Personalised advertising and pricing. Arts. 12–13 provide that profiling-based advertising may not be targeted at consumers known with reasonable certainty to be minors, and may not use special categories of personal data (such as health or ethnic origin) at all. Personalised prices may not harm minors or consumers known to be vulnerable.
Spending-maximising and addictive design. Arts. 14–17 proceed to regulate various categories of digital content and design that are particularly relevant to video games. This is an area currently under scrutiny by the EU's CPC Network and the AGCM in the context of coordinated investigations against video game publishers:
- Virtual currencies (Art. 14): items must show their real-money value. For products directed at, or known to be used by, minors, paid-for currencies must be off by default and can be activated only with a guardian's approval.
- Loot boxes (Art. 15): traders must disclose the odds and give every consumer a tool to disable loot boxes. Paid-for loot boxes may not be offered to minors.
- Pay-to-win and pay-to-progress (Art. 16): prohibited for minors.
- Addictive design (Art. 17): consumers must be able to switch off autoplay and infinite content, notifications unrelated to their own activity, streaks and penalties for not engaging, and features that simulate interpersonal relationships (such as persistent prompts from a chatbot). The Commission may extend this list.
Event ticket pricing. Arts. 18–19 address pricing for event tickets, including dynamic pricing and ticket reselling. For event tickets whose price can rise because of the trader's actions or algorithms, the trader must disclose how many tickets are available at the advertised price and the maximum price. On the secondary market for event tickets, ticket resellers must clearly display the original total price charged by the event organiser and, where applicable, the ticket category, row and seat number. In virtual queues, the trader must show the price in real time and the maximum price where the price may vary while the consumer is in the queue. However, demand-based dynamic pricing is not banned, despite calls from MEPs for a prohibition. Lastly, traders are prohibited from reselling tickets that they have acquired by using bots that enabled them to circumvent limitations placed on the number of purchasable tickets.
Digital contracts. This is another significant part of the proposal, particularly for subscription businesses, streaming and gaming services, and any sales model built on free trials and automatic renewals. In short, the DFA seeks to tackle the "easy to join, hard to leave" problem and the risk that consumers end up in paid contracts without realising it.
- Free trials and automatic renewals (Arts. 20–22). Silent free-to-paid conversions and unannounced renewals could already be challenged as misleading omissions or aggressive practices under the UCPD (including onerous barriers to terminating a contract, now Art. 9(d)), as unfair terms under the Unfair Contract Terms Directive, or under the Consumer Rights Directive's ban on extra payments without express consent. The DFA proposes to replace this patchwork with specific obligations. Traders must remind the consumer before a free trial ends, and the consumer must expressly agree to continue on a paid basis; otherwise the consumer is not bound. For contracts of six months or more, a reminder is due between one month and 14 days before renewal. For shorter contracts, such as monthly game passes, the reminder is due before the renewal that reaches six months or the tenth renewal, whichever comes first. If a reminder is missed, the consumer can terminate free of charge, and contracts renewed indefinitely can be ended on one month's notice.
- Termination and withdrawal buttons (Arts. 23–24). The withdrawal button is not new: the Consumer Rights Directive already requires an online function to exercise the right of withdrawal, and the DFA restates it with standard labels ("withdraw from contract here"). What is new is a general "terminate the contract here" button wherever contracts can be concluded online, usable throughout the life of the contract, followed by an acknowledgement within a week. Leaving must be no harder than joining.
- A human in customer service (Art. 25). This is a new right, but a modest one: consumers may ask for a human only after the contract is concluded and when other means, such as chatbots, are not effective. Email or messaging will suffice, and investment services are excluded.
AI agents. Arts. 26–27 provide an entirely new set of specific rules in respect of contracts entered into through automatic (or agentic) systems. Existing consumer law continues to apply when consumers use automated systems, but the DFA adds specific rules. Traders offering contracting agents - automated systems that can be used by consumers to conclude and perform contracts on the consumers' behalf - must let consumers choose, on first use, whether to confirm all, some (for example, below a price cap) or no contracts. Agents must disclose any payment received or conflict of interest, such as preferencing a trader's products, and in that case the consumer must always confirm. The agent conflict-of-interest rule is, in substance, a transparency answer to self-preferencing. Traders cannot require consumers to use an agent. Conversely, where both sides contract only through automated systems, the Consumer Rights Directive's pre-contractual information duties are lightened.
A focus on protecting minors or vulnerable consumers
A clear theme of many of the new prohibitions introduced by the DFA is a focus on protecting minors and vulnerable consumers. Many of the new prohibitions only bite where the trader is "aware with reasonable certainty" that the consumer is a minor or vulnerable, and where harm is "reasonably likely". Art. 13 is a good example. Personalised pricing for ordinary adult consumers is not banned as such. The draft DFA also narrows who counts as vulnerable: while a leaked draft utilised an open-ended reference to "personal circumstances", that has been replaced by "any specific misfortune or circumstance of such gravity as to impair the consumer's judgment". Discounts that benefit consumers, such as student or senior rebates, are expressly preserved, as is differentiation based on lawful, objective and transparent factors such as insurance risk. Similarly, profiling-based advertising to adults using non-sensitive data remains lawful, addictive features may stay on by default for adults provided they can be switched off, and dynamic ticket pricing is regulated through transparency rather than banned.
There is an important caveat. Falling outside a specific rule is not a safe harbour. The proposal is clear that a practice may still be unfair under the general clause prohibiting misleading and aggressive practices, or the anti-circumvention provision, which prohibits any conduct, whether contractual, technical or design-based, that undermines compliance with the digital-fairness obligations. Note, however, that exploiting a vulnerability is now an aggressive-practice factor only where the trader is aware of it, not merely where it could reasonably foresee it (Art. 9(c)).
Green claims: greenwashing goes to Brussels?
As we explained in our recent article on the new EU greenwashing rules, the EmpCo Directive was required to be implemented by Member States by 27 September 2026. Through amendments to the existing UCPD, it introduced per se bans on generic environmental claims, stricter rules for forward-looking claims, and new controls on sustainability labels.
Six weeks later, the DFA proposes to absorb those rules into the new regulation and would give the Commission the ability to enforce these rules. The draft DFA carries over the EmpCo rules largely as they stand. For companies that have just completed an EmpCo compliance programme, this is reassuring: the substance does not change. What changes is who may enforce it, and how hard.
The gaming investigations: the DFA in practice
As noted, several of the new provisions proposed in the DFA are targeted at the video game sector.
There is already enforcement activity in this space, but the DFA indicates increased scrutiny in future. On 30 September 2026, the CPC Network announced coordinated actions against a number of video game publishers. The current actions are brought under the UCPD, and run through national authorities, coordinated through the CPC. The DFA proposal codifies the core of the March 2025 CPC Key Principles, which the CPC Network, in coordination with the Commission, adopted to provide practical guidance on the application of relevant EU consumer protection rules to practices involving in-game virtual currencies. Once the DFA enters into force, much of the guidance in the CPC's Key Principles would essentially become binding at EU level (albeit that certain national authorities, such as Italy's AGCM, are already very active in this space). In two respects, however, the DFA is narrower than the CPC Network's current enforcement position: the trigger for the minors' rules, and the absence of express bans on multiple currencies and bundles. Commitments in the current proceedings should therefore be designed to be "DFA-proof", because they are likely to set the de facto EU standard. Any commitments given in the current proceedings should take that into account arguably before the DFA is enforced.
Enforcement: a competition-style toolkit
For those of us with experience of EU competition law, the new enforcement model will feel familiar. The Commission would act against the largest EU-wide cases involving non-SMEs, with powers and penalties that echo those available to the regulator under antitrust law, and national authorities would have to stop investigating the same case. National authorities would handle the rest. Commission decisions would bind national authorities dealing with the same matter. The proposal also brings in AI Act authorities to enforce the addictive-design rule against providers and deployers of AI systems, alongside DSA authorities for online platforms.
Two features deserve particular attention. First, under Art. 34, courts and authorities could order traders to disclose evidence on how an online practice is designed, operates and affects consumer behaviour, subject to proportionality and protection of trade secrets. A refusal can lead to penalties and may count against the trader. Second, the threat of fines of up to 6% of worldwide turnover changes the risk calculation for consumer law at board level.
Traders have a right of recourse against suppliers, such as interface or algorithm vendors, whose conduct caused or contributed to the infringement (free open-source software is excluded). This principle likely applies in all circumstances where a trader has relied on data from a supplier, e.g. in cases involving greenwashing.
UK consumer rules
A likely comparator regime to the proposed DFA will be the UK's Digital Markets, Competition and Consumers Act (DMCCA), which similarly sought to consolidate existing consumer rights legislation while also introducing important new protections for consumers in the digital sphere and enhanced regulatory enforcement.
Firstly, and similar to the Commission's direct enforcement role under the proposed DFA, the DMCCA empowered the CMA to directly enforce consumer law through administrative proceedings. Both regimes accordingly also provide for new fining rules, with the proposed DFA enabling the Commission to levy fines of up to 6% of worldwide annual turnover, and the DMCCA enabling the CMA to impose fines of up to 10% of global turnover on companies and up to £300,000 on individuals. In doing so, both regimes bring the respective regulators' consumer protection powers into line with their competition law roles.
Secondly, and like the proposed DFA's repeal and replacement of the UCPD, the DMCCA revoked the previous rules in relation to unfair commercial practices and restated them in primary legislation.
Lastly, in the process of reframing the existing sets of legislation, both regimes also used the opportunity to introduce new and notable consumer protections in the digital sphere. Both regimes therefore target similar potentially infringing conduct: fake reviews, influencer marketing, drip pricing, subscription contracts and cancellation rights, dark patterns, and dynamic pricing. However, the DFA may be going even further by also providing targeted rules in respect of addictive and spending-maximising designs, such as virtual currencies and loot boxes, and rules on the use of AI agents.
Our discussion of the UK's consumer enforcement powers under the DMCCA is available here.
Conclusions
The DFA will not apply until 12 months after it enters into force, and the text will likely change in the course of a legislative process which is expected to take some time. The direction of travel is clear, however, in particular the more significant role for the Commission. Key steps companies should be taking now include:
- Audit interfaces: review sign-up, checkout, cancellation and consent flows against the proposed dark-pattern blacklist, with a focus on asymmetric choices, nagging prompts, fake urgency and drip pricing.
- Map minors and vulnerable consumers: identify products directed at, or known to be used by, minors, and test personalisation and pricing for effects on vulnerable groups.
- Rebuild the subscription lifecycle: plan for trial-conversion consent, renewal reminders, a termination button and access to human support.
- Treat green claims as an EU-level risk: keep the EmpCo evidence files up to date, and prioritise claims, labels and brand names used across most Member States by large companies, which are the most likely targets for Commission enforcement.
- Re-paper contracts: update influencer, agency, ad-tech, software and supplier contracts with compliance warranties, audit rights and indemnities that reflect the new right of recourse.
- Prepare for Commission investigations: extend dawn-raid, document-retention and privilege protocols from competition law to consumer law.
- Engage in the debate: dynamic pricing, personalisation and the scope of Commission powers are likely to be contested in the Parliament and the Council.
Treating consumer-law compliance, both online and offline, as an ongoing governance exercise rather than a one-off project will put companies in the best position when the DFA, and the Commission, arrive.
Authors: Christopher Eberhardt, Partner; Gabriele Accardo, Partner; Michael Zymler, Senior Expertise Lawyer.
Additional thanks: Edvin Morell, Trainee Solicitor.
