Digital Fairness Act: the EU’s new consumer protection rulebook takes shape

On 11 November 2026, the European Commission (Commission) published its proposal for the Digital Fairness Act (DFA). This would, for the first time, establish a directly applicable Regulation on fair B2C commercial practices both offline and online.

Having concluded in the Digital Fairness Fitness Check that EU consumer law is only partially effective in the digital environment (see our earlier blog post here), the DFA proposal responds two years later with new rules on dark patterns, influencer marketing, subscription contracts, addictive design and online profiling, particularly where consumer vulnerabilities may be exploited.

The DFA would be the most comprehensive revision of EU fair-trading rules since the Unfair Commercial Practices Directive (UCPD) was adopted in 2005. It would repeal and replace the UCPD and form part of the broader EU Consumer Package, which includes a revision of the Consumer Protection Cooperation (CPC) Regulation and a proposal for a Directive on simplification of Union consumer protection rules, amending the Consumer Rights Directive and the ePrivacy Directive. It would represent a fundamental shift in consumer protection enforcement, with the Commission itself gaining the power to investigate certain cases directly and impose substantial fines.

Despite its name, the proposal would introduce rules that apply both online and offline, thereby recasting the wider framework for B2C practices. In this sense, the “Digital” Fairness Act is something of a misnomer, not least because the proposal does not itself define “digital fairness”.

Taken together, this EU Consumer Package marks a significant overhaul of the EU consumer protection framework, both in terms of the substantive rules and how they will be enforced. In this blog post, we unpack the key elements of this proposal and what they could mean for businesses.

From Directive to Regulation: repealing the UCPD and introducing a uniform EU-wide fairness regime

Of the three Directives reviewed in the Fitness Check, the UCPD is the one most affected. The DFA would repeal it and replace 27 national regimes transposing the UCPD with a single, directly applicable Regulation. The Consumer Rights Directive would be amended through a separate simplification Directive, while the Unfair Contract Terms Directive seems to remain unaffected. The Regulation would retain the UCPD’s broad reach, applying to commercial practices before, during and after a transaction and to traders targeting EU consumers, irrespective of its place of establishment or size. A business’s size and economic capacity would, however, be taken into account when setting penalties.

Chapters I and II of the DFA largely carry over the existing UCPD framework: the general prohibition of misleading and aggressive practices, and the blacklist of practices that are unfair in all circumstances (Annex I), which would be expanded to include new items on reference prices, drip pricing and dropshipping. The proposal updates the concept of the “average consumer”, expressly allowing cognitive biases and information overload online to be taken into account. The concept of “vulnerable consumer” is also broadened beyond age, credulity and disability to cover “any specific misfortune or circumstances of such gravity as to impair the consumer’s judgment”, such as financial distress. This could result in a more demanding fairness assessment in practice, particularly for businesses that are active in the digital sphere.

According to the explanatory memorandum, the proposal introduces a “general fairness-by-design obligation.” This concept can be traced back to the Fitness Check consultation, which floated such a duty requiring traders to consider consumer protection at every stage of product or service development, from advertising through to after-sales. The precise contours of this general obligation remain to be seen, particularly as the proposal does not link it to specific process requirements. The closest existing analogue is the “professional diligence” standard under the UCPD, although several stakeholders considered it too vague to be operational in the digital context. Nevertheless, a “fairness by design” approach signals that consumer protection should be integrated into business practices and product design, not added as a compliance layer afterwards. The Commission appears to translate this approach into specific obligations in Chapter III on “Digital Fairness”, within a Regulation that applies more broadly to unfair commercial practices both online and offline.

Significantly, the move from a Directive to a Regulation removes the scope for diverging national transposition and interpretation. Within its B2C scope, the DFA would set the rules exhaustively, with limited room for Member States to apply stricter rules in specified areas (such as unsolicited visits to a consumer’s home or more restrictive requirements for financial services and immovable property).

What is new: adding a new chapter on digital fairness

Despite giving the Regulation its name, Chapter III (Articles 10 to 29) is the only truly “digital” part of the DFA. “Digital fairness” is not defined as such in the proposal, while the Fitness Check used this term as shorthand for ensuring a high level of consumer protection under Article 169 TFEU.

The DFA appears to give the concept a more specific function, using it to frame the targeted rules in Chapter III rather than as an overarching standard for the Regulation as a whole. Those rules cover:

• dark patterns (Article 10) and influencer marketing (Article 11);
• personalized advertising and pricing, in particular where minors or vulnerable consumers are concerned (Articles 12 and 13);
• in-app currencies, loot boxes and pay-to-win mechanics (Articles 14 to 16);
• addictive design features such as autoplay and engagement-driven notifications, applying to all consumers, not only minors, subject to carve-outs for businesses and services already covered by the EU KIDS Act (Article 17);
• dynamic pricing, resale price transparency and virtual queues in event ticketing (Articles 18 and 19);
• free trials, automatic renewals, and online cancellation and withdrawal functions (Articles 20 to 24), as well as access to a human in customer service where other means are not effective (Article 25);
• the use of automated systems, including AI agents, to conclude contracts on consumers' behalf (Articles 26 and 27); and
• unsolicited commercial communications by email, text message and phone (Article 28), which are currently governed by the ePrivacy Directive.

An anti-circumvention clause (Article 29) would prevent businesses from undermining these obligations through contractual, commercial, technical or design choices.

These rules are considerably more prescriptive than the principle-based approach of the UCPD. Some, such as the transparency requirements for event tickets or the reminders before free trials convert into paid subscriptions, prescribe in detail what information must be given, when and how. While these specific obligations reduce the scope for diverging interpretation, they are less flexible and at risk of becoming quickly outdated if they remain static in the final version.

For added flexibility, the Commission would have far-reaching powers to change the scope of certain aspects of the Regulation. By way of delegated acts, it could define what counts as unfair in key areas, by effectively expanding the list of dark patterns prohibited in all circumstances (Article 10(3)) and the list of addictive design features that consumers must be able to switch off (Article 17(2)). These powers would be conferred for an indeterminate period, subject only to the European Parliament’s and the Council’s right to object or revoke the delegation.

Equally notable is what the proposal does not do. Personalized pricing would not be banned as such: the prohibition only applies where pricing is based on profiling, is likely to cause harm and concerns consumers known to be minors or vulnerable. Similarly, profiling-based advertising would only be prohibited where the trader is aware with “reasonable certainty” that the consumer is a minor or where the targeting uses special categories of personal data under Article 9(1) of the General Data Protection Regulation (GDPR). These prohibitions largely mirror Articles 26(3) and 28(2) of the Digital Services Act (DSA) and do not apply to providers of online platforms already subject to those DSA rules. Instead, they target the wider advertising chain, including advertisers and ad tech providers, as well as smaller platforms that fall outside the DSA's advertising rules. Specific transparency rules on dynamic pricing appear to be limited to event ticketing only, which mirrors the enforcement trend in the US and UK.

A fundamental shift in enforcement: the Commission steps in

The change of legal form from a Directive to a Regulation is also a strategic choice for the centralized consumer enforcement that is envisaged in the EU Consumer Package, with the Regulation being a precondition for giving the Commission direct investigatory and enforcement powers.

Through a proposed revision to the CPC Regulation, the Commission would obtain a significantly expanded role in consumer protection enforcement. The Commission would be able to investigate cases concerning the DFA directly, as well as those concerning the Geo-Blocking Regulation, the Portability Regulation, and passenger rights rules, if the potential breach affects at least two-thirds of EU Member States, together accounting for at least two-thirds of the EU population (except where the infringing company is an SME). National authorities would also be prevented from adopting decisions that run counter to a Commission decision on the same matter.

Interestingly, responsibility for certain provisions would be allocated to authorities under other regimes. The minor-specific rules on in-app currencies, loot boxes and pay-to-win mechanics would be enforced by the authorities designated under the EU KIDS Act for businesses within its scope (a new Commission proposal which we analyzed in detail here). The addictive design rules would be enforced by the Digital Services Coordinators against providers of online platforms (for details on the addictive design rules see our analysis here). Alongside increased EU-level consumer enforcement, there is also overlap between the national authorities responsible for enforcing the DFA and other digital, safety and consumer protection rules.

At national level, the penalty provisions follow the familiar model of EU digital legislation such as the DSA, GDPR, AI Act and the Digital Markets Act (DMA). They set out criteria for determining fines, such as the nature, gravity and duration of the infringement, previous infringements and financial benefits gained. In coordinated cross-border actions, maximum fines would have to be at least 4% of turnover in the Member States concerned. Taken together, these changes mark a clear shift towards stricter consumer law enforcement.

Interaction with other EU regimes

The DFA would sit alongside an already crowded EU digital rulebook, including the DSA, DMA, AI Act, GDPR, the forthcoming EU KIDS Act and the Audiovisual Media Services Directive (AVMSD). It applies “without prejudice” to those instruments, with Recital 9 providing that a specific rule prevails only where the two obligations cannot coexist.

In practice, however, overlaps are inevitable. Article 25 DSA already prohibits manipulative interfaces, while Article 31 DSA requires online marketplaces to design interfaces that facilitate compliance with EU consumer law. The DFA would introduce comparable but broader rules extending beyond platform intermediation. It is unclear whether lawful profiling under the GDPR could constitute an unfair commercial practice under the DFA, and how the DFA will interact with existing DMA rules on user choice, switching, and contract termination.

There are concerns that these overlaps may create the very legal uncertainty that the DFA seeks to reduce. CCIA Europe, for example, has already observed that many practices targeted by the DFA are covered by existing EU legislation and specifically cautioned against duplicative rules on dark patterns and addictive design. The challenge will therefore be not only determining which rule takes precedence, but also navigating enforcement regimes that approach fairness and consumer protection from different angles.

What this means for businesses

The proposal is at an early stage and is likely to change during the legislative process. Even so, businesses serving EU consumers need to:

• Assess where the proposal would bite: Identify the consumer-facing journeys most likely to be affected, such as subscription and cancellation flows, pricing displays, personalization, in-app monetization and influencer marketing, and how far they already reflect existing requirements under EU and national consumer law and the DSA.
• Keep design choices well documented: Interface design is already a focus of enforcement. The proposed disclosure obligations and easier burden of proof would make it even more important to be able to explain how interfaces work and why.
• Use the window to engage: Key questions, from the scope of the rules on minors to the Commission’s delegated powers, remain open and will be shaped in Parliament and Council. Businesses that identify their concerns early will be best placed to contribute to the debate.

Outlook

The proposal will now be negotiated by the European Parliament and the Council under the ordinary legislative procedure. Once adopted, the draft envisages that the Regulation would apply 12 months after its entry into force – providing a window for businesses to review interfaces, subscription journeys and marketing practices across the EU. Businesses across sectors from gaming and social media to streaming and e-commerce will need to follow these interlinked workstreams closely.

The DFA will define (and sometimes change) the framework for B2C engagement for all businesses operating in the EU. There is a lot to unpack. Stay tuned for our blog series with deep dives into specific areas addressed by the Digital Fairness Act (accessible via our DFA client toolkit). For an overview of how the practices addressed by the DFA map against existing EU law, see our EU Digital Fairness Dashboard (request access here).

At Freshfields, we advise businesses across the full spectrum of competition, data protection and digital consumer regulation. Our cross-disciplinary approach brings together antitrust, privacy, data, and consumer expertise to identify the implications for your business. If you would like integrated advice across these areas, including the DFA, please reach out to the authors or your usual Freshfields contact.