@lena.trains ADVERTISEMENT
Commercial collaboration with GlowFuel. My go-to drink after long runs.
A new EU regulation that aims to give you the same protection when you shop or scroll online as in a physical store. It targets manipulative design, subscription traps, addictive features, hidden fees and unfair tactics aimed at children.
The core EU rulebook on unfair business practices dates from 2005. A 2024 "fitness check" by the Commission found the law still broadly works, but leaves gaps for tricks that live inside app and website design.
About 60% of people in the EU buy goods or services online.
Online shoppers are over 60% more likely to hit a problem than people shopping offline.
Online: about 1.6 times the offline rate Offline: baselineThe 2025 consultation drew 3,341 replies. Setting aside one large organised campaign, 72% of the rest supported binding EU rules on dark patterns. Consumer groups were in favour. Most business groups preferred better enforcement of existing law.
The 2024 fitness check put the harm from problematic online practices at €7.9 billion a year, and called that a conservative estimate. Younger consumers are hit hardest.
A directive has to be copied into 27 national laws. A regulation applies the same way everywhere, and countries generally can't add stricter national rules on top. Despite its name, it also covers offline sales.
A "dark pattern" is a design that nudges you into a choice you wouldn't otherwise make. Today, regulators often have to prove harm case by case. Under the DFA, the ten practices below would be unfair in all circumstances. The Commission could add new ones later by delegated act, and every business gets a general duty of fairness by design.
A typical checkout. Tap "Show traps" to see what the DFA would ban.
Fairness by designBusinesses must take consumer protection into account when designing how they sell.
Manipulative interfaces Art. 10A general ban on deceptive or manipulative design, plus ten always-banned practices in Annex I.
Drip pricingUnavoidable fees that only show up at the last step.
Misleading price comparisonsCrossed-out or "% off" reference prices that aren't a real, current competitor price.
Misleading claims by dropshippers
Spam without consent Art. 28No automated calls, texts or marketing emails without prior consent. Existing customers can still get emails about similar products, with an easy opt-out. These rules move over from the ePrivacy Directive.
For the first time, EU consumer law names features that are intended, or can reasonably be expected, to encourage compulsive or excessive use Art. 17. Apps would have to give you easy controls to switch them off, one by one or all at once. Continuing to use a service now also counts as a "transactional decision", so engagement tricks fall under consumer law Art. 3(3).
Switch off autoplayThe next video no longer starts by itself.
Switch off uninterrupted consumptionInfinite scroll and endless feeds get a stopping point.
Switch off engagement notifications"You haven't opened the app in 2 days!"
Switch off streaksRewards for daily use, or penalties for missing a day.
Switch off simulated relationshipsFeatures that pretend to be a friend to keep you coming back.
The features stay on unless you turn them off. Consumer group BEUC had asked for them to be off by default. For social networks, video platforms and AI chatbots used by minors, separate rules in the proposed EU KIDS Act apply.
Free trials that quietly become paid plans, renewals you forgot about, and cancel buttons hidden three menus deep are the most common complaints. The DFA tackles each one.
No silent trial-to-paid switch Art. 20A free trial can only turn paid after a reminder and your express agreement.
Renewal reminders Arts. 21–22If the business forgets to remind you, you can cancel free of charge. A contract that renews indefinitely can be ended at any time with at most one month's notice.
A clearly labelled cancel button Arts. 23–24Online functions to end a contract or withdraw from it.
A human when you need one Art. 25After you've bought, online customer service must offer a person on request when other channels aren't working (excluding investment services).
Simpler rules for businessesA companion directive trims the information duties for repeat in-app purchases and tidies up withdrawal rules for streaming subscriptions.
Games and apps often hide real money behind gems and coins, and sell randomised rewards that work like slot machines. The proposal draws hard lines for children and adds transparency for everyone.
Gems with no price in euros, and chest odds you can't see.
Paid loot boxes banned for minors Art. 15For everyone else: item types and drop odds must be disclosed, with a tool to disable loot boxes.
Pay-to-win and pay-to-progress banned for minors Art. 16
Virtual currency shows real money Art. 14The euro value of in-game items must be shown. For minors, virtual currencies are off by default unless a parent approves.
No profiling-based ads to children Art. 12(a)Where the business knows with reasonable certainty the user is a minor. Online platforms already face the same ban under the Digital Services Act.
No harmful personalised prices for minors Art. 13
Influencers would have to label commercial content with the words "advertisement" or "commercial collaboration". Responsibility also extends to the businesses behind a campaign, who must make sure the influencer complies Art. 11.
Commercial collaboration with GlowFuel. My go-to drink after long runs.
Clear disclosureClear, prominent wording instead of a buried hashtag. On platforms, the built-in ad-disclosure tool must be used.
Brands and agencies accountableThrough contracts or other means, they must ensure the influencer follows the rules, and can't contract out of their own liability.
Limits on influencer content aimed at minorsNo direct "go buy this" appeals to minors, no hidden ads, and no presenting products as suitable for kids when they aren't.
No promoting dangerous or ad-banned products
From concert tickets in a virtual queue to prices tailored to your profile, the DFA asks businesses to be upfront about what something really costs and why.
In any virtual queue, the current price must be shown live with the maximum it can reach Art. 19. For event tickets whose price can rise, sellers must also say how many are left at the advertised price Art. 18. Dynamic pricing itself stays legal.
Compare at €199 Our price €99
Crossing out a reference price, or advertising "50% off" against it, is always unfair unless that reference is a current price charged by a clearly identified competitor Annex I, point 11.
As AI assistants start booking and buying on people's behalf, the DFA adds rules for these automated contracting tools Art. 26.
You choose the approval levelOn first use, you pick one of three settings: approve everything, approve only what falls outside limits you set (such as a maximum price), or approve nothing.
Sponsored suggestions disclosedAgents must reveal payments and conflicts of interest behind a recommendation, and you must approve those purchases yourself, whatever your settings.
No forcing you through a chatbot Art. 26(9)A business can't make an automated system the only way to access or complete a purchase (financial services excluded).
The Commission estimates recurring costs for businesses of about €678 million a year once overlaps with existing duties are stripped out (€1.2 billion before), against €13.7 billion a year in consumer benefit.
Tick what your business already does. Anything left unticked is where to look first. Skip the ones that don't apply to you.
A quick orientation based on the proposal as published, not a legal assessment. Your ticks stay in this page: nothing is saved or sent anywhere.
The most the European Commission could fine a company in cases it investigates itself Art. 35. The same ceiling as the Digital Services Act.
In coordinated cross-border cases, each country's top fine must be at least 4% of the company's turnover in the countries concerned, or €2 million if turnover is unknown. Countries set the actual levels.
Each country's consumer authority stays the main enforcer, as today. Competitors and consumer organisations can also bring cases Art. 30.
A parallel revision of the Consumer Protection Cooperation (CPC) Regulation would let the Commission investigate directly when a breach affects at least two-thirds of member states and two-thirds of the EU population. Small and medium-sized firms are excepted.
Digital Services Act authorities would enforce the addictive-design rule for online platforms, AI Act authorities for AI systems, and EU KIDS Act authorities the game rules for minors on services that Act covers.
Courts and authorities can order a company to hand over evidence on how its design works and affects behaviour Art. 34. Refusing can count against it, though the burden of proof doesn't flip automatically. Harmed consumers can claim compensation, a price cut or an end to the contract Art. 32.
The proposal is published, but nothing changes for consumers yet. Parliament and the Council (the member states) must agree a final text first.
Commission finds EU consumer law broadly works but has gaps online.
3,341 replies. Consumer groups ask for new rules, business groups for better enforcement of existing ones.
Announces the DFA and the CPC enforcement revision.
Ursula von der Leyen confirms the DFA for autumn.
A separate law on minors' safety online. The DFA is written to dovetail with it.
Presented by Commissioner Michael McGrath (COM(2026) 1100).
European Parliament and Council each adopt positions, then negotiate a final text. MEPs may add amendments.
The regulation would apply 12 months after it enters into force Art. 40. Lawyers expect 2028 if talks go smoothly, and the Commission must review the law five years after that.
Several EU laws already touch dark patterns, targeted ads and addictive design. The Commission's argument is that each one covers only a slice: a type of company, a technology, or a kind of data. Consumer law is the one layer that covers every business. Critics answer that more layers mean more regulators looking at the same screen.
The Digital Services Act bans manipulative interfaces DSA Art. 25, but only on online platforms, with exemptions for small firms. GDPR reaches design only where personal data is processed, such as consent screens. The AI Act bans manipulative AI only above a high harm threshold.
A ban that applies to every trader, including ordinary web shops, apps and games, plus ten practices that are always unfair Art. 10.
Open question: the DSA ban stays on the books. A recital says it steps back where the DFA applies, but legal scholars say the dividing line is unclear.
On online platforms, the DSA bans profiling-based ads aimed at minors DSA Art. 28(2) and ads based on sensitive data DSA Art. 26(3). GDPR restricts the use of sensitive data in the first place GDPR Art. 9.
The same two bans for everyone else Art. 12. Platforms already under the DSA rules are carved out, so they aren't covered twice. The DFA borrows GDPR's definitions of profiling and sensitive data.
Open question: can profiling that is lawful under GDPR still be an unfair practice under the DFA? Law firm Freshfields flags this as unsettled.
The Commission is already using the DSA here: in February 2026 it issued preliminary findings that TikTok's design breached that law. The proposed EU KIDS Act targets minors on social, video and chatbot services.
Off switches for all users, adults included, on any digital product Art. 17. Enforcement is split: DSA authorities for platforms, AI Act authorities for AI systems, consumer authorities for the rest.
Open question: the KIDS Act restricts variable rewards on social and video platforms but not in online games, which fall to the DFA. Parliament's research service warns this may cause confusion.
The EU KIDS Act, proposed on 17 September 2026, sets safety and age-appropriate design duties for services used by minors. It is also still a proposal.
The spending rules: loot boxes, pay-to-win and virtual currency Arts. 14–16. Where a service falls under the KIDS Act, that Act's authorities enforce them.
Open question: digital-rights group EDRi warns that protections tied to age could push services toward more age verification. The DFA says traders need not collect extra data to work out someone's age.
The e-Commerce Directive requires commercial communications to be identifiable. The Audiovisual Media Services Directive, now under revision, regulates advertising in audiovisual content.
Fixed wording for the label, and responsibility for the business that hires the influencer Art. 11.
The 2002 ePrivacy Directive, written into 27 national laws.
The consumer-marketing rules move into the DFA Art. 28, so they apply directly. Consent must meet the GDPR standard.
The AI Act regulates AI systems by risk level and bans the most manipulative uses.
Consumer rules that apply whether or not AI is involved, plus specific duties for systems that conclude contracts for you Arts. 26–27.
The Consumer Rights Directive gives a 14-day withdrawal right but no general right to cancel as easily as you signed up. The Digital Markets Act has its own rules on user choice, switching and ending contracts, for gatekeepers only.
Reminder, consent and cancel-button rules for every trader Arts. 20–24. The Consumer Rights Directive stays, with some duties trimmed by a companion directive.
Open question: how the DFA's cancellation rules interact with the DMA's is not spelled out.
The DFA applies "without prejudice" to the GDPR, DSA, DMA, AI Act, audiovisual rules and the KIDS Act. In practice both sets of rules apply side by side. The more specific law wins only where a business cannot comply with both at once (Recital 9).
The proposal landed in the middle of two camps. Industry groups say existing laws already cover most of this and should be enforced first. Consumer groups and many MEPs say the proposal leaves too much of the work to users. Both sides will now lobby Parliament and the member states.
Sceptics: A March 2026 joint industry statement asked the Commission to "pause and reset". DOT Europe says a practice that existing rules cover "should not be regulated or enforced a second time". MEP Aura Salla questions whether Europe needs another digital regulation and warns about competitiveness.
Supporters: BEUC says the DSA and AI Act are too narrow in scope to do the job. A March 2026 civil-society call argued that enforcement alone is not enough.
Common ground: Even CCIA accepts that one EU-wide regulation might reduce differences between countries. And academics who want stronger protection agree with industry on one point: the bigger problem so far has been weak enforcement, not missing bans.
The proposal: Autoplay, endless feeds and streaks stay on until the user turns them off.
Not enough: BEUC and EDRi wanted these features off by default. Green MEP Kim van Sparrentak called the opt-out approach "a historic mistake". Socialist MEP Alex Agius Saliba regrets that addictive design is not on the banned list.
Too much: CCIA says addictive design is already being handled under the DSA and the proposed KIDS Act.
Too much: CCIA calls the result "an enforcement maze": consumer, data-protection and market-surveillance authorities, plus the Commission, could all look at the same practice under different laws.
The Commission: The text hands some rules to the regulators already in charge (DSA, AI Act, KIDS Act) and exempts platforms from ad bans they already face. Its cost estimate is already adjusted for overlaps.
The proposal: The "average consumer" test now accounts for cognitive biases and information overload. "Vulnerable" widens beyond age and disability to personal circumstances that impair judgment, such as financial distress.
Too much: CCIA calls this vague and warns that spotting vulnerability could push services to monitor users more, which sits badly with GDPR's data-minimisation rule.
The text: Traders are not required to process extra personal data to work out who is a minor or vulnerable.
The proposal: Transparency for event tickets and virtual queues. Personalised prices are banned only where likely to harm minors or vulnerable people.
Not enough: Parliament asked the Commission in July 2026 to consider banning dynamic pricing at live sports and cultural events. Euroconsumers wants it banned in non-competitive markets such as live entertainment.
Not enough: Outside Commission-led cases, countries set the level. Academics writing in Tech Policy Press point to a €10 million Italian fine under today's rules as a sign of how low that can be, and want clearer compensation benchmarks.
Too much: BusinessEurope objects to the new enforcement powers and to the evidence rules, and wants every new obligation backed by evidence.
Free trials: ITI warns that asking for fresh consent before a trial converts could interrupt services people already agreed to.
Nagging ban: CCIA says it could catch useful prompts, such as reminders to turn on two-step login. The text exempts prompts that are legally necessary.
Age checks: EDRi warns that age-dependent protections could lead to more age verification.
Start-ups: Germany's Startup Association says the act must not make scaling in Europe more expensive.
Finance: Finance Watch says the dark-pattern rules lack ambition for people investing online. Several DFA rules exclude financial or investment services.
Future-proofing: the Commission can add new dark patterns and addictive features by delegated act, but academics note it cannot update the rest of the blacklist that way.
The name: lawyers and academics both note the act never defines "digital fairness" and reaches well beyond digital.