Digital Fairness Act: the European Commission’s proposal to rewire the digital customer protection rulebook

For consumer-facing businesses, the proposal would recast the wider framework for B2C practices, with new rules applying to practices before, during, and after a transaction, including those of traders established outside the EU targeting EU consumers.

It would also mark a significant shift in consumer protection enforcement, with the commission itself gaining powers to investigate certain large-scale infringements directly and impose substantial fines. The practical question is how those changes would work together across the customer digital journey.

To whom will the DFA apply?

The DFA will apply to a wide range of actors, including online retailers, travel and ticketing businesses, B2C online platforms and marketplaces, app developers and video game publishers, subscription businesses, including streaming and other digital services, and influencers, brands and advertising agencies engaged in commercial promotions.

From a territorial perspective, the act will also apply businesses operating outside the EU but targeting consumers in the EU.

What does this mean in practice?

Digital fairness embedded “by-design”

The DFA would replace the Unfair Commercial Practices Directive with a directly applicable Regulation, retaining its general framework and adding digital-specific rules. Its general rules would continue to cover unfair business-to-consumer practices online and offline, including by non-EU traders targeting EU consumers. The main changes fall into six areas:

• Interfaces and pricing: An express dark-pattern ban and blacklist would target manipulative design, including false scarcity claims. Pricing rules would address drip pricing and misleading pricing comparisons, with additional transparency for dynamically priced event tickets and virtual queues.
• Personalization: Profiling-based advertising using special-category personal data or targeting consumers known with reasonable certainty to be minors would be prohibited, extending protections beyond platforms covered by the Digital Services Act. A separate rule would prohibit profiling-based pricing reasonably likely to harm consumers known with reasonable certainty to be minors, or vulnerable.
• Influencer marketing: Commercial content would require clear, prominent disclosure. Brands and agencies using influencers would also have to secure compliance through contracts or other appropriate measures, rather than leaving responsibility solely with the influencer.
• Addictive design and in-app spending: Adult consumers would be able to disable specified features encouraging excessive use, such as autoplay, unprompted notifications, streaks and simulated relationships. The proposal would also require real-money-value disclosures for purchases using paid-for virtual currencies, and clearer reward probabilities, with additional restrictions protecting minors and carve-outs for services covered by corresponding EU KIDS Act provisions.
• Subscriptions and cancellation: Free trials would require a reminder and express agreement before converting to paid contracts, alongside renewal reminders for qualifying subscriptions. Traders contracting online would have to provide an online termination and withdrawal function, and consumers could terminate an automatically extended contract at any time on short notice.
• Automated commerce and customer service: Consumers using AI shopping agents would control purchase-confirmation settings; payments to the agent provider or conflicts of interest would trigger disclosure and confirmation. These contracting rules would exclude financial services. Traders providing online post-contract customer service would have to offer human assistance on request where other means are not effective, excluding investment services.

Stronger enforcement

The CPC proposal would give the commission direct investigation and sanctioning powers for specified large-scale infringements, with fines of up to 6% of worldwide annual turnover for intentional or negligent substantive breaches within that framework. Micro, small and medium-sized traders would be excluded from this direct-enforcement regime, while national authorities would retain an important role.

Targeted simplification

The accompanying directive would amend the Consumer Rights and ePrivacy Directives, including reducing precontractual information requirements for qualifying digital-content microtransactions and changing withdrawal rules for qualifying audio and video subscriptions. Unsolicited B2C marketing rules would move from ePrivacy into the DFA. This is targeted reform, not a general relaxation of consumer protection.

The package would also sit alongside existing data protection, online safety and AI rules, creating an additional layer of rules against which businesses will have to assess their operations.

What happens next?

The proposals will now pass to the European Parliament and Council for negotiation under the ordinary legislative procedure, a process that takes around 17 months on average and during which the texts may change. As proposed, the DFA would apply 12 months after its entry into force. This gives businesses time to anticipate which proposed requirements could affect planned products and redesigns, and to bring legal, product and marketing teams into the same discussion early.