Digital Fairness Act – Implementation Obligations Companies Need to Prepare For

Electronic commerce and digital services are subject to an increasingly dense regulatory framework. With the Digital Services Act, the Digital Markets Act and the AI Act, the EU legislator has created several cross-sectoral legislative instruments in recent years. These primarily address platforms, market power and technological risks, but already contain a prohibition of manipulative design of online interfaces under Art. 25 DSA. By contrast, the cross-sectoral consumer protection framework comprising the Unfair Commercial Practices Directive (UCPD), the Consumer Rights Directive (CRD) and the Unfair Contract Terms Directive (UCTD) has remained largely untouched. This is where the planned Digital Fairness Act (DFA) comes in. The Commission’s objective is to adapt existing consumer protection requirements to the conditions of digital markets. According to the Commission’s Work Programme for 2026, a legislative proposal is planned for the fourth quarter of 2026. A concrete draft has not yet been presented. Nevertheless, it is advisable for companies with digital B2C offerings to engage with the potential requirements at an early stage.

Initial indications of the likely regulatory priorities can be derived in particular from the underlying Fitness Check, the feedback received from the completed public consultation, and the Commission’s ongoing impact assessment. This article provides an overview of the background and potential content of the DFA and identifies the action items that may arise for affected companies.

I. Background to the Digital Fairness Act

The starting point for the planned Digital Fairness Act is the question of whether existing European consumer protection law still adequately accounts for the particularities of digital business models. A key basis for this is the Fitness Check published by the Commission in October 2024. The examination focused in particular on the Unfair Commercial Practices Directive (UCPD), the Consumer Rights Directive (CRD) and the Unfair Contract Terms Directive (UCTD). The Commission concluded that the existing requirements, due to their principle-based and technology-neutral design, are fundamentally applicable to digital scenarios as well. At the same time, however, gaps have emerged with regard to newer business models and problematic digital practices, as well as deficits in the consistent enforcement of existing rules (we reported in Data Protection Update No. 211).

Following this review, a public consultation including a Call for Evidence was launched on 17 July 2025. The original deadline of 9 October 2025 was extended to 24 October 2025. A total of 4,324 valid responses were received, which the Commission has evaluated. The Commission’s impact assessment is currently still ongoing. The responses received highlighted in particular the differing interests of the stakeholders concerned. From a consumer protection perspective, there is a need for further requirements regarding, for example, manipulative purchasing incentives, non-transparent pricing and the protection of vulnerable consumer groups. The European umbrella organisation BEUC and the Federation of German Consumer Organisations (VZBV) have accordingly advocated an ambitious design of the DFA.

By contrast, the games industry, among others, warns against additional regulation. Providers of free-to-play games such as Supercell and InnoGames see the risk that further requirements could undermine the economic viability of advertising-funded business models without creating corresponding added value for consumers. Among other things, it is criticised that the additional display of real-money prices for virtual items would not necessarily lead to greater transparency but could rather create artificial benchmarks. Furthermore, an existing enforcement deficit is pointed out: what matters is not so much the creation of further regulations but rather their consistent enforcement vis-à-vis all market participants, especially providers from third countries.

II. Expected Regulatory Content

The specific requirements that the Digital Fairness Act will contain cannot yet be conclusively assessed. However, indications of the potential design can be derived from the Commission’s Work Programme and the deficits identified in the Fitness Check. The focus is accordingly on four main thematic areas: manipulative design elements, lack of transparency in personalised offers, product design aimed at maximising usage time or spending, and influencer marketing. In addition, it is emerging that the Commission intends to review certain information obligations for companies and, where appropriate, simplify or reduce them.

Particularly concrete is the discussion around so-called dark patterns. These are design elements that can induce or push consumers into decisions they would not have made without the specific design. Examples include pre-selected paid add-on services, artificially created time pressure through countdown displays, or cancellation processes that are significantly more complex than the preceding contract conclusion. Such practices are already captured under existing law, namely through Art. 25 DSA as well as through Sections 3(2) and 4a of the German Unfair Competition Act (UWG), with the requirements of Art. 25 DSA feeding into the UCPD as a standard of professional diligence. The Higher Regional Court of Bamberg, in its final judgment of 5 February 2025 (Case No. 3 UKl 11/24 e), concerning the promotion of ticket insurance during the ordering process, held that the combination of “framing”, “nagging” and a misleadingly labelled rejection button violated Art. 25(1) DSA and Sections 3(2) and 4a(1) sentence 2 no. 3 UWG, whereas the isolated colour highlighting of the offer was not sufficient for this purpose. The DFA will need to provide, above all, concretisation and delineation from the DSA. It could provide more specific criteria and thus greater legal certainty.

The implications would be cross-sectoral and would in principle affect all digital offerings involving consumer contact, from online shops to booking platforms to subscription services.

A further regulatory focus is likely to be the transparency of data-driven personalisation. Where prices, product recommendations or the presentation of offers are adjusted based on individual user behaviour, the DFA could oblige companies to more clearly disclose these practices. Such requirements would particularly affect providers that use algorithmic systems for pricing or personalisation. This applies, for example, to e-commerce, the travel and mobility sector, and comparison and intermediary portals.

The discussion about product design deliberately aimed at maximising usage time or increasing spending has also gained importance. The focus is particularly on digital mechanisms that influence user behaviour or increase willingness to spend. A particularly illustrative example is the use of virtual currencies in computer games. Consumer advocates criticise that the conversion of real money into virtual currencies such as coins or gems can obscure the actual price of content. Multi-tiered currency systems and package sizes not aligned with the price of individual content items can further amplify this effect. In addition to game and app providers, social networks and streaming services could also be affected by corresponding regulations, insofar as they use comparable voucher, tipping or payment systems. A particular focus is on the protection of minors, who account for a significant portion of the users of such offerings.

Further possible regulatory areas concern influencer marketing and the transparency of corresponding advertising measures. In addition, requirements can be expected to ensure simple and easily accessible cancellation of digital contracts. At the same time, the DFA could aim to harmonise existing information obligations and reduce them in certain areas in order to relieve companies of unnecessary or redundant requirements.

The potential scope of the DFA is thus broadly defined. What matters is not membership in a particular sector but rather the specific design of the digital interaction with consumers. In addition to e-commerce and platform operators, those potentially affected therefore include, among others, software-as-a-service providers, financial and insurance companies with digital distribution channels, and companies using data-driven online marketing.

A further point concerns enforcement. In 2026, the Commission is reviewing the CPC Regulation. Under discussion are, in particular, centralised investigation and enforcement powers at EU level, which could enable more consistent prosecution of cross-border infringements. For companies, this means that substantive new rules and strengthened enforcement structures need to be considered together.

III. Recommendations for Action

Even without a draft in hand, sensible preparations can already be made. An initial step would be to take stock of one’s own digital consumer interfaces. Companies should assess at which points selection, consent and cancellation processes are designed in a way that could later be classified as pressuring or misleading. Particular attention should be paid to order flows, cookie banners and the question of whether a subscription can be terminated just as easily as it can be concluded.

In addition, companies should identify and document where in their offerings personalisation based on personal data occurs, whether in pricing, recommendations or placements. The purpose and criteria of this personalisation should be documented and reviewed as to whether they can be presented to consumers in a comprehensible manner. This regularly requires cooperation between legal, IT and product departments.

Companies with gaming, app or community offerings should additionally assess at an early stage the extent to which their monetisation and engagement mechanisms need to be evaluated from the perspective of addictive design, paying particular attention to the protection of younger users.

Finally, it is advisable to follow the further legislative process and to make use of existing opportunities for participation. Since an enhancement of enforcement instruments, particularly the CPC network and collective enforcement mechanisms, is to be expected, early and structured engagement not only provides legal certainty but can also create a competitive advantage.

IV. Conclusion

The Digital Fairness Act is still at the beginning of the legislative process. The consultation has been completed, the Commission’s impact assessment is ongoing, and the proposal is expected for the fourth quarter of 2026. The general direction is thus foreseeable. For companies, the DFA does not represent a complete overhaul of consumer protection law but rather a tangible concretisation of existing obligations in areas where, until now, general clauses and the standards of Art. 25 DSA applied.

Those who review their digital processes, interfaces and data-driven offerings at an early stage can use the time remaining until the expected proposal to identify adjustment needs and implement them without time pressure.

This article was created in collaboration with our student employee Emily Bernklau.