Today, 11 November 2026, the European Commission presented its proposal for a Digital Fairness Act (DFA), announced by Commissioner Michael McGrath. It is the most significant reform of EU consumer law in almost twenty years. The proposal turns the Unfair Commercial Practices Directive into a directly applicable Regulation. It also adds a new chapter of rules on digital fairness: dark patterns, addictive design, influencer marketing, personalisation, in-game purchases, subscriptions and AI agents that conclude contracts for consumers.

The proposal now goes to the European Parliament and the Council, and its content may still change. Once adopted, it would apply 12 months after its entry into force. Companies that sell online to consumers in the EU should start assessing its impact now, because many of the new rules affect the design of interfaces and contract flows, and those take time to change.

From a directive to a regulation

The DFA repeals Directive 2005/29/EC. Instead of 27 national transpositions, a single text would apply in all Member States, as it already does for the GDPR and the Digital Services Act.

The core of the old framework remains: the general prohibition of unfair practices, misleading actions and omissions, aggressive practices and the blacklist of practices that are unfair in all circumstances. Much of the Commission’s 2021 guidance on the UCPD is now written into the text. The notion of vulnerability is also adjusted. It now covers consumers who are particularly vulnerable because of disability, age, credulity or “any specific misfortune or circumstance of such gravity as to impair the consumer’s judgment”, such as financial distress or addiction. Traders are not required to process additional personal data to assess whether a consumer is vulnerable. The recitals also recognise that, online, even the average consumer may have limited capacity to process information because of information overload or limited digital literacy.

Dark patterns

Article 10 prohibits traders from designing, organising or operating their online interfaces in a way that is likely to deceive or manipulate consumers, or otherwise materially distort their economic behaviour. The prohibition covers visual, auditory and other components of the interface.

A new list of dark patterns that are unfair in all circumstances is added to Annex I. The Commission can update it by delegated act. An anti-circumvention clause (Article 29) prevents traders from achieving the same result through contractual, technical or behavioural techniques or interface design.

In practice, cookie banners, checkout flows, cancellation paths, upselling screens and default settings will need a fresh review against the new list.

Addictive design

Under Article 17, traders whose digital products are designed in a manner intended, or reasonably foreseeable, to encourage compulsive or excessive use must give consumers easy access to effective tools to disable, one by one or all at once:

• autoplay and uninterrupted content consumption without regular breaks;
• notifications not triggered by the consumer’s own activity;
• features that reward regular engagement or penalise missed sessions, such as streaks;
• features that simulate interpersonal relations, such as persistent prompts to keep talking to an automated system.

The last item clearly targets AI companions and conversational systems. The proposal requires opt-out tools rather than protective defaults. Article 17 does not apply to practices concerning minors covered by the proposed EU Kids Act, nor to certain educational and scientific services.

Influencer marketing

Article 11 requires the commercial intent of each communication to be disclosed clearly, using the terms “advertisement” or “commercial collaboration”. On online platforms, the disclosure must use the platform’s DSA functionality.

Influencers may not directly urge minors to buy products, or hide commercial intent, in particular in content featuring minors. They may not promote products that cannot be advertised under EU or national law, or unsafe products. Brands must ensure, contractually or by other means, that the influencers they work with comply.

Personalised advertising and pricing

Article 12 extends to all traders the DSA ban on profiling-based advertising aimed at minors and on profiling-based advertising using sensitive personal data, such as data revealing health or ethnic origin. Under the DSA, these bans apply only to online platforms. The recitals clarify that the prohibitions also cover personalised content suggestions, product rankings and recommendations, including in natural language systems.

Article 13 prohibits personalised pricing based on profiling that is likely to harm a consumer whom the trader knows with reasonable certainty to be a minor or vulnerable. Traders are not required to process additional personal data to identify minors or vulnerable consumers.

Games: virtual currencies, loot boxes and pay-to-win

• Virtual currencies (Art. 14): traders must show the real monetary value of items bought with virtual currency. For minors, paid virtual currencies must be disabled by default and activated only with parental approval.
• Loot boxes (Art. 15): consumers must be told the possible contents and the probability of obtaining them, and given tools to disable paid loot boxes. They may not be offered to minors.
• Pay-to-win (Art. 16): pay-to-progress and pay-to-win mechanisms are prohibited for minors.

Several of these rules give way to the proposed EU Kids Act for the services it covers, such as social media and video-sharing platforms.

Subscriptions and online contracts

For many businesses, this will be the most operational part of the proposal.

• Free trials (Art. 20): before the trial ends, the trader must send a reminder on a durable medium. The consumer is not bound by a paid contract unless they expressly agree to continue.
• Automatic renewals (Arts 21–22): reminders are required before contracts renew automatically. If no reminder is sent, the consumer can terminate free of charge.
• Termination function (Art. 23): contracts concluded online must be terminable online, with a clearly labelled function (“confirm the contract termination”) and an acknowledgement of receipt.
• Withdrawal function (Art. 24): a “withdraw from contract here” function must be available throughout the withdrawal period, including for financial services.
• Human contact (Art. 25): in post-sale online customer service, consumers can ask to speak with a human being when other means are not effective.
• AI agents (Arts 26–27): traders that offer automated systems able to conclude contracts on the consumer’s behalf must let consumers choose, on first use, whether to confirm every contract, only some contracts within set limits such as a maximum price, or none.
• Unsolicited communications (Art. 28): direct marketing by email, SMS or automated calls requires prior consent. The existing exception for similar products sold to one’s own customers remains.

The proposal also introduces transparency rules on event tickets and virtual queues (Arts 18–19), including an obligation for resellers to display the original price charged by the event organiser and, where applicable, the seat.

Enforcement and evidence

Article 34 allows national courts and authorities to order traders to disclose evidence on the design, operation and impact on consumer behaviour of an online practice. A failure to disclose may be taken into account in finding the practice unfair. This applies both in enforcement proceedings and in consumers’ remedy actions.

Fines for widespread infringements must reach at least 4% of the trader’s turnover in the Member States concerned, or at least EUR 2 million where turnover data is not available. In cases it investigates itself, the Commission could impose fines of up to 6% of worldwide annual turnover.

How the DFA fits with other rules

The DFA works as a safety net: specific EU rules, such as the DSA, the GDPR and the proposed EU Kids Act, prevail where they regulate the same aspect. Enforcement is also allocated across authorities. The rules on virtual currencies, loot boxes and pay-to-win are supervised by the authorities competent under the EU Kids Act for the services it covers. The addictive design rule is enforced by the DSA authorities for online platforms and by the AI Act authorities for providers and deployers of AI systems. In practice, the same interface may have to be assessed under several instruments, and different authorities may be competent depending on the type of service.

What companies should do now

1. Map the consumer journeys where design influences decisions: sign-up, checkout, consent, upselling and cancellation.
2. Review subscriptions: free trials, renewal reminders, the online termination and withdrawal functions, and customer-service escalation to a human.
3. Check personalisation: profiling-based ads and prices, especially where minors or vulnerable consumers may be reached.
4. Review influencer contracts to include disclosure and compliance obligations.
5. For games and apps used by minors: virtual currencies, loot boxes and progression mechanics.
6. Document design choices, including metrics and A/B tests. Under Article 34, you may have to explain how your interface works and what effect it has.

The proposal will change during the legislative procedure, but its direction is clear. The design of digital services is becoming a matter of legal compliance, not only of user experience.

‍