Inside the EU’s planned Digital Fairness Act: digital design, subscription traps, and influencer marketing

For any business selling to European consumers online, everyday commercial decisions may soon be subject to new rules from Brussels. Following a review of whether EU consumer law remains fit for the digital environment, the European Commission is preparing updated legislation. A draft of the long-awaited Digital Fairness Act is expected on 11 November 2026, and it could bring new requirements for online interface design, subscriptions and influencer marketing. With the Act unlikely to take effect before the end of 2028, and with industry already questioning whether yet another layer of regulation is needed, businesses still have time to prepare and help shape the final text. 

Background

The Digital Fairness Act (DFA) has been long anticipated. In 2020, the European Commission (EC) signalled in its New Consumer Agenda that it would examine whether additional legislation was needed to ensure equal fairness online and offline. A public consultation followed in 2022, culminating in the October 2024 publication of the Fitness Check of EU Consumer and Marketing Law (Fitness Check) – a comprehensive assessment of whether existing EU consumer law remains adequate for the digital environment. The Fitness Check evaluated three core EU consumer protection Directives: the Unfair Commercial Practices Directive (UCPD), the Consumer Rights Directive (CRD), and the Unfair Contract Terms Directive (UCTD). It concluded that the existing framework was not sufficiently effective in tackling current and emerging consumer harms. 

The political impetus for dedicated legislation crystallised in September 2024 when EC President Ursula von der Leyen wrote to Justice Commissioner Michael McGrath requesting a Digital Fairness Act to enhance consumer protection online. Since then, the DFA has attracted considerable engagement and debate from industry associations, businesses, consumer groups, national regulators, and legal practitioners. 

A draft legislative proposal is expected on 11 November 2026. The EC has not communicated a formal timeline, but we do not currently expect the DFA to be in force before the end of 2028 at the earliest.

What form is the DFA expected to take?

It is not yet confirmed whether the DFA will take the form of a standalone legislative instrument or targeted amendments to existing directives such as the UCPD, CRD and UCTD. There is precedent for both approaches: the Omnibus Directive successfully updated the existing consumer protection directives through targeted amendments, while the Digital Services Act (DSA) and Digital Markets Act (DMA) introduced standalone regulations for digital-specific rules. 

The choice of instrument will have practical implications. A regulation would be directly applicable in all Member States without the need for national transposition, enabling uniform rules but leaving less flexibility to adapt provisions. In contrast, a directive would require each Member State to transpose the new rules into national law within a set deadline and may allow greater room for national divergence.

Key areas the DFA is expected to address

Whilst uncertainty remains until the draft legislation is published, the Fitness Check identified a number of topics likely to be in scope, including the main topics set out below, plus: addictive design features; loot boxes and in-game currencies; personalised pricing and data-driven targeting; unfair contract terms in digital contexts; protection for minors from harmful digital practices; and broader questions of consumer vulnerability and digital asymmetry. 

1. Harmful online choice architecture: tackling manipulative design 

Harmful online choice architecture, sometimes referred to as “dark patterns”, is likely to be a central focus of the DFA. The Fitness Check defines dark patterns as “unfair commercial practices deployed through the structure, design or functionalities of digital interfaces or system architecture that can influence consumers to take decisions they would not have taken otherwise”. A behavioural study referenced in the Fitness Check found that 97% of the most popular websites and apps used by EU consumers deployed at least one such pattern. 

Enforcement action so far has been largely based on the UCPD, which already prohibits certain dark patterns (such as false urgency claims), with others requiring case-by-case assessment of consumer harm to determine whether they represent prohibited commercial practices. The DSA also includes a prohibition on deceptive or manipulative online designs, but it only applies to online platforms and does not apply to practices “covered by” the UCPD, making its relevance to consumer-facing platforms unclear.

The Fitness Check found that 62% of stakeholders supported clearer and stronger protections against dark patterns. Suggestions included expanding the UCPD’s list of prohibited practices, introducing a general prohibition on deploying dark patterns, and imposing a "fairness by design" duty on traders. 

2. Subscription traps and difficult cancellations

The Fitness Check highlighted common problems with online subscription contracts, including difficult cancellation processes, unexpected automatic renewals and free trial conversions, and price increases. It concluded that EU consumer law is not effective at addressing these problems and noted that some Member States have introduced national laws to fill the gaps, creating a lack of harmonisation. Any new DFA rules for subscriptions might include easy cancellation mechanisms (potentially building on Directive (EU) 2023/2673, which introduced a withdrawal function requirement for distance contracts), and requirements to provide consumers with renewal reminders and for consumers to give express consent before a free trial converts into a paid subscription.

3. Influencer marketing and social commerce

The Fitness Check highlights a 2024 sweep of 576 influencers by EU consumer protection authorities, which found that nearly all posted commercial content, but only 20% systematically disclosed it as such, just 40% made disclosures immediately visible, and 38% did not use platform-provided disclosure tools. There is also legal uncertainty about the responsibilities of other actors, such as brands and agencies. Several Member States, including France and Italy, have already adopted national rules, and the DFA is expected to harmonise these at EU level.

4. AI chatbots and the right to human contact

The Fitness Check noted that while AI chatbots can help traders communicate with consumers more efficiently, their default or exclusive use could hinder consumers from exercising their rights (for example, if getting human support is difficult or impossible). As a remedy, the DFA might give consumers the right to contact a human when AI chatbots are used for complaints and enquiries.

5. Automated contracting and agentic commerce

The Fitness Check addresses the emerging area of automated contracting, noting that new technologies such as AI-powered virtual assistants and smart devices increasingly enable contracts to be concluded and performed without human intervention, with varying levels of autonomy. It flags consumer risks including loss of control over purchasing decisions, unintended purchases, and lack of transparency, and concludes that EU consumer law does not currently provide any specific protections to consumers using automation tools. 

Since the Fitness Check’s publication in October 2024, interest in agentic commerce – the use of AI agents to find, compare and even buy products – has grown among businesses and consumers alike, as have associated consumer protection law concerns. Some commentators have called for the DFA to regulate agentic commerce, whereas others believe that such regulation would be premature given the industry’s evolving state and the fact that most EU consumers are not yet using AI to buy products on their behalf. 

Navigating an increasingly complex regulatory landscape

The DFA will sit alongside an already extensive EU regulatory framework, including the UCPD, CRD, UCTD, the General Data Protection Regulation (GDPR), the DSA, the DMA, and the EU AI Act. It will likely add to the compliance challenge faced by consumer-facing businesses in the EU, which must increasingly navigate complex, overlapping laws.

The DFA is also expected to be published alongside a revision of the Consumer Protection Cooperation (CPC) Regulation, which governs cross-border enforcement among national authorities. Changes to the CPC framework could materially shape how DFA obligations are enforced in practice, including national authorities’ powers and how EU-wide enforcement is coordinated. They could also allow the EC to take direct enforcement action, which it cannot currently do in the consumer protection space.

A divided debate: is the DFA needed?

The DFA has already attracted significant political engagement from various stakeholders, despite no draft legislation having been published, and opinion on its need is divided. 

Proponents point to the purported harms identified in the Fitness Check, the high prevalence of dark patterns across popular digital services, and the need for greater legal certainty. Some consider the application of principle-based rules like the UCPD unclear in digital contexts.

Critics cite regulatory fatigue and the compliance burden: the EU has enacted numerous complex digital initiatives in recent years (the DSA, DMA, and EU AI Act), with more to come, including the recently published draft EU KIDS Act (see our article here). For example, Poland has reportedly questioned the necessity of the DFA, arguing that the EU should first ensure full and effective use of existing instruments before adding a new regulatory layer, and a joint industry letter from March 2026 noted that additional layers of regulation could create overlap and legal uncertainty. Critics also argue that the primary challenge is enforcement of existing rules. For example, this European Tech Alliance video from October 2026 called for better enforcement of the existing rules and a level playing field. 

What should businesses do now?

Although the DFA is not yet in draft form, consumer-facing businesses operating in the EU should monitor for its publication and then consider its potential impact. Businesses may well wish to advocate for changes to the draft so that the final version appropriately balances important consumer protection considerations with legitimate business interests, the need to avoid inadvertent consumer harm, and practical constraints (such as technical limitations).