EU Digital Fairness Act: Business-to-consumer protection in an online era

The European Commission is preparing to expand the EU’s digital rulebook with a new Digital Fairness Act (DFA). An early draft of the new legislation offers a preview of Brussels’ next move on consumer protection and online platform regulation. The direction is clear: fairness is becoming a product-design requirement.

From fitness check to rulebook

The EU already has an extensive consumer protection rule book, including measures such as the Unfair Commercial Practices Directive (UCPD). However, the Commission’s July 2025 call for evidence identified the need to update that framework for a digital age and address concerns about “dark patterns”, addictive design and unfair personalisation. 

The DFA is intended to address these perceived shortcomings. It largely preserves the framework in the UCPD, while expanding its scope to specifically address online activities. Like much of the EU’s new digital rulebook, it also takes the form of a Regulation to enhance the Digital Single Market and avoid any national variations that might arise from the use of a Directive.

“Dark patterns” - A new form of unfair commercial practice

The proposal largely replicates the existing general UCPD prohibitions on unfair, misleading and aggressive practices.

This will be supplemented by a new horizontal prohibition on “dark patterns”. It draws on the existing test for unfair commercial practices – a dark pattern is defined as the design or operation of an online interface in a manner likely to deceive or manipulate consumers or otherwise materially distort their economic behaviour. The DFA also contains an expandable blacklist in Annex 1 with a range of examples such as scarcity pressure, nagging, misleading choices and disproportionate friction when refusing or changing a choice. 

This also addresses the awkward DSA interface, which excludes practices covered by UCPD or the GDPR. The DFA therefore aims to bolster the consumer-law route for dark patterns. Clearer prohibitions, however, do not necessarily mean simpler boundary-drawing for businesses. 

The EU KIDS Act – An expansion pack 

One surprising aspect of the DFA is its broad protection for minors, despite the fact that the recently proposed EU KIDS Act already contains extensive measures in this sense. The DFA nonetheless expands on these protections through, among other things:

• Personalised pricing: This is banned where it is likely to harm the minor.

• Personalised advertising: Traders will be banned from targeting advertising at minors using profiling.

• Virtual currencies: There will be a default switch-off for paid-for virtual currencies for minors.

• Pay to win: There will be a ban on pay-to-win/pay-to-progress mechanisms for minors.

• Loot boxes: Paid for loot boxes and other variable reward mechanisms should not be offered to minors. 

Adults also obtain some protection on these issues, though to a much lesser extent. There are also targeted KIDS Act carve-outs which complicate the analysis and means businesses must map both texts instead of choosing between them.

GDPR overlaps and special category data advertising 

The DFA extends restrictions on profiling-based advertising beyond platforms already covered by the DSA. 

Importantly, it bans the use of special category data for personalised advertising where there is a reasonable likelihood of harm. While conceptually simple, the practical effect is potentially uncertain given the very broad reach of data revealing sensitive characteristics. To add uncertainty to the picture, EU legislators are, in parallel, discussing a reform of the personal data definition and the use of special categories of data for AI in the context of the draft Digital Omnibus. This all makes the question of what constitutes a “reasonable likelihood of harm” a key one.

The DFA also contains rules on unsolicited commercial communications, such as sending SMS or emails for direct marketing purposes. This appears to largely replicate the existing rules in the ePrivacy Directive with the repeal of those rules to feature in a separate instrument.

AI purchasing bots 

One notable innovation in the DFA is its introduction of specific rules for AI purchasing bots used by consumers. While the DFA does not directly alter national contract law to allow agentic commerce, it does create a consumer-law architecture to facilitate AI purchasing bots. This reflects both the growing use of this technology and the complex questions it raises about whether, and to what extent, such bots can form contracts on a consumer’s behalf.

Under these rules, providers of automated systems used to conclude and perform contracts on a consumer’s behalf must provide adjustable contracting parameters and explicit choices over purchase confirmation. Payments and conflicts of interest would trigger disclosure and confirmation safeguards. These provisions do not apply to financial services.

Other consumer protection measures

Beyond that, the DFA also addresses a range of other consumer protection measures. These include:

• Addictive design: The Commission is already active in this area by, for example, reviewing if issues of addictive design have been properly assessed by VLOPs under the Digital Services Act. Now all traders would have to give consumers tools to disable features in digital products, such as autoplay, uninterrupted feeds, engagement penalties and simulated relationships. 

• The right to speak to a human: Where a trader provides online customer service after the contract is concluded, the consumer can ask to communicate with a human being, not a bot.

• Influencer marketing: There are new transparency requirements for influencer marketing and specific protection for minors.

• Free trials, renewals and termination: New transparency and notification requirements will apply to contracts with free trial periods and renewal mechanisms. Traders must also provide online termination functionality in their online interface.

National (and Commission) regulation 

National authorities and courts will be responsible for enforcement. Consumers are also entitled to a remedy, including compensation. Where there is a widespread infringement with a Union dimension, the Commission can also intervene.

Evidence-disclosure powers reach into design, operation and behavioural impact; withholding evidence can count against traders. Consumer remedies and Commission fines of up to 6% of worldwide annual turnover raise the stakes. 

Legislative timeline 

The draft DFA will be subject to a likely lengthy legislative procedure, where both the European Parliament and the Council of the EU will have a say in how the final text is shaped. EU governments, in particular, may be wary of losing control over national implementation under a Regulation and of the Commission’s powers to amend the DFA through secondary legislation. 

Adoption might not come before the end of 2027, and the current draft suggests there will then be a further 12 months prior to its implementation.

What should you do now?

The DFA adds another piece to an increasingly complex digital jigsaw imposing even more obligations, with scattered enforcement from national consumer authorities, the Commission and private litigants. Harmonising the substance of the law using a Regulation may not deliver a single supervisory door. 

Much of the focus under the DFA will be on the online interface analysis, though businesses will need to also carefully consider the overlap with other parts of the EU digital package. To understand where the draft could change your product roadmap or enforcement exposure, get in touch with our team.