How the Digital Fairness Act could change online business

Article 10 would prohibit online interfaces likely to deceive or manipulate consumers or materially distort their economic behaviour. Annex 1 to the DFA lists 10 dark patterns that are considered unfair in all circumstances (and are therefore automatically prohibited), including making false claims about the availability or popularity of a product, persistent scarcity messages during the ordering process, presenting refusal of an invitation to purchase as the wrong choice, and making changes to a choice disproportionately difficult. While such practices are already likely to be considered unfair under existing consumer regulations (both in the EU and in the UK), the DFA proposes the specific prohibition of these commonly used dark patterns.  

Article 11 would require influencer ads to make the commercial intent of communications clear by carrying a clear and prominent disclosure using the terms ‘advertisement’ or ‘commercial collaboration’. Brands and agencies using influencer services would have to secure compliance through contracts or, where there is no contract, other appropriate means. Of note, this would bring EU requirements broadly in line with the UK’s CAP Code, which requires a prominent ‘Ad’ (or similar) label to be included in influencer ads, and makes clear that brands and influencers share responsibility for compliance with this requirement.

Articles 12 and 13 would restrict profiling-based advertising and pricing. Advertising using sensitive personal data, or personal data of minors (where the business is aware with reasonable certainty that the consumer is a minor), would be prohibited, with an exclusion for platforms already covered by the relevant Digital Services Act rules. Harmful personalised pricing would also be prohibited where the business knows with reasonable certainty that a consumer is a minor or is vulnerable for one of the reasons specified by Article 13.  By contrast, in the UK, the ICO’s Children’s Code expects profiling to be off by default unless there is a compelling reason, taking account of the child’s best interests, and requires safeguards against harm. It does not ban all profiling of minors, and because it is only a Code, it cannot impose legal obligations on businesses.

Articles 14–16 affect in-game monetisation mechanics.

• Article 14 would require monetary values, or estimated monetary values, for items bought using paid-for virtual currencies, and also requires businesses to disable paid-for virtual currencies by default for minors and activated only upon parent/guardian approval (where the product is directed at minors, or the trader is aware 'with reasonable certainty’ that the product is used by minors)    
• Article 15 addresses paid-for ’variable reward systems’, which would include loot boxes, gacha or similar mechanics. It prohibits the offering of such mechanics to minors, and also requires traders to inform consumers about the types of items available (and probability of obtaining them), as well as enabling consumers to disable paid-for variable reward systems if they wish.
• Article 16 prohibits the offering of pay-to-progress/pay-to-win mechanisms to minors (again, where a trader’s products are directed at minors, or where the trader is aware ‘with reasonable certainty’ that the product is used by minors).

The restrictions imposed on the offering of these mechanics to minors go significantly beyond anything in current existing consumer regulation in either the EU or the UK, and will have significant consequences for the way games businesses monetise their products, especially in mobile games where free-to-play is by far the dominant monetisation method. Together with the EU KIDS Act, these requirements may also fast-track the implementation of age assurance across the market.  

Article 17 would require businesses whose digital products intentionally or foreseeably encourage compulsive or excessive use to provide tools to disable specified features, individually or all at once. The specified features include autoplay/uninterrupted content consumption, notifications that are not triggered by/related to the consumer’s activity, features that encourage regular engagement, (including through penalties where users fail to engage regularly), and prompts simulating ‘interpersonal relations’ to encourage continued use.  

The adoption of restrictions relating to so-called addictive design in the DFA has been anticipated since its conception, and these requirements do not come as a surprise,  but they do go further than any existing EU (or UK) consumer law, and specifically tackle very common user engagement mechanics, which will have a particularly significant impact on many mobile games and other apps.

In addition to a carve out for businesses subject to similar requirements under the proposed EU KIDS Act in respect of minors, these requirements will not apply to educational services, or services operated for scientific research/development.

The DFA's recitals explain that existing protection under ePD against unsolicited direct marketing is highly relevant to consumers and should therefore be “integrate[d] … into the Union consumer law framework”. The proposed Directive simplifying EU consumer regulations disapplies Article 13 of the ePD to B2C communications, which will now be governed by Article 28 of the DFA. The DFA would require prior consent for direct marketing by email, SMS, MMS and automated calls, subject to an exception for marketing a business’s own similar products by email following their ‘sale or supply’, provided consumers are given an easy, free opt-out at collection and in each subsequent message if they have not initially refused.  

The DFA seeks to address ‘subscription traps’ by introducing reminder notices, and by requiring businesses to provide a prominent online termination option for contracts concluded online.  Different reminder timetables would apply to contracts lasting six months or more and to shorter (e.g. monthly) contracts. For contracts starting with free trials, businesses would need to send a reminder and obtain the consumer’s express agreement before the contract becomes paid.   

Subscriptions are also soon to be subject to strict new requirements in the UK, with the  DMCCA’s enacted subscription framework, due to begin on 1 January 2027, providing for reminder notices at regular intervals, cooling off rights, and easy online cancellation requirements (among other things).  Any business reviewing their subscription contract model in light of the DMCCA’s requirements may also want to take the DFA’s proposals into account at the same time when setting up the necessary backend processes.

Articles 18 and 19 would introduce more specific pricing disclosures. For event tickets whose prices may increase, businesses would have to state how many tickets in the relevant category are available at the advertised price and the maximum price a consumer may pay. Resale listings would need the original total ticket price and, where applicable, seat details. Businesses using virtual queues would have to display the current price, update it in real time and disclose whether it may change and any maximum price. The virtual queue rules would extend beyond ticket sales, with an exception only for financial instrument orders.

Article 25 would require businesses providing online customer service after a contract is concluded to make a human available on request ‘when other means are not effective’. Any online business relying on customer service chatbots would need a route to human support (with a carve out only for investment services).

Article 26 would introduce controls for systems that enter into contracts on a consumer’s behalf. Consumers would have to choose whether to approve every contract, only contracts meeting specified criteria, or none before being bound. They would need tools to change that choice at any time. Payments for proposing a contract and conflicts of interest would have to be disclosed, with consumer confirmation required for the affected contract regardless of the consumer’s earlier choice. Businesses could not require consumers to use automated systems to access or complete purchases on their online interfaces. Again, financial services would be excluded.

The DFA is still a proposal, but the fact that it has been drafted based on public consultation, and is part of a broader approach across the EU (and UK) towards strengthening consumer protections, may encourage European authorities to implement it without material changes. If brought into force as drafted, it would mean significant changes to the way businesses design their online services, as well as the ways in which they monetise their products.  Businesses that review their customer journeys now will be better placed if and when the new regime takes shape.  Trade associations for the industries most affected, such as Video Games Europe, will no doubt continue their efforts to moderate some of the proposed changes.