Digital Fairness Act: the European Commission proposes a regulation on digital fairness

SÉRVULO PUBLICATIONS 13 Nov 2026

On 11 November 2026, the European Commission presented the Proposal for a Regulation of the European Parliament and of the Council on digital fairness—the Digital Fairness Act.

The Proposal aims to bring about a far-reaching reform of European law on unfair commercial practices and, if adopted, will establish a new compliance standard for companies operating in the digital ecosystem, with a direct impact on interface design, monetisation, advertising and contract management.

 

I. Background

Directive 2005/29/EC (the Unfair Commercial Practices Directive, or ‘UCPD’) is one of the pillars of the European consumer protection acquis, but it was designed for a market that predated the data and attention economy, influencer marketing, personalisation, digital subscription services and in-app purchases.

The most recent regulations published – the Digital Services Act (‘DSA’), the Digital Markets Act (‘DMA’) and the Artificial Intelligence Act (‘AI Act’) – were not designed to cover all harmful commercial practices, focusing instead on specific types of operators (such as online platforms) and technologies.

The Digital Fairness Act aims to address these gaps, acting as a horizontal safety net, without prejudice to the specific regimes that apply.

The proposal has two components:

Firstly, it proposes to convert the substantive law on unfair commercial practices from a directive into a directly applicable regulation, replacing the national transposition regimes. The possibility for the Commission to investigate and sanction certain infringements directly is linked to the proposal for a new CPC Regulation, COM(2026) 1120 final.

Secondly, it proposes new substantive rules on dark patterns, influencer marketing, unfair personalisation, spending maximisation practices, add-on design, pricing and fairness in digital contracts.

The need for this intervention stems from a combination of general principles that are difficult to put into practice, divergent interpretations amongst Member States, and fragmented enforcement, which has left compliant businesses without predictability and consumers without effective protection against practices that operate on the scale and at the speed of the digital world.

 

II. SCOPE AND APPLICATION

The Proposal provides for the application of the Regulation to businesses’ commercial practices vis-à-vis consumers (B2C) before, during and after a commercial transaction relating to a product (Article 2(1)). Despite its title, its scope is not exclusively digital: it covers both offline and on e practices, whilst maintaining the general framework of the UCPD, to which a Chapter III dedicated to digital fairness has been added.

Addressees: Any natural or legal person acting for purposes relating to their commercial, industrial, craft or professional activity, as well as anyone acting in their name or on their behalf.

Unlike the DSA, the Proposal does not distinguish on the basis of size or business model, covering, amongst others:

• e-commerce operators, online marketplaces and product comparison or search services;
• providers of applications, video games and digital services featuring virtual currencies, loot boxes or pay-to-win mechanisms (Articles 14 to 16);
• any professional who designs or operates digital products likely to encourage compulsive or excessive use, including social media, video-sharing platforms, streaming services and conversational AI systems (Article 17);
• businesses engaged in influencer marketing (Article 11(1) to (5)) and, in an innovative move, any professional who uses influencer marketing services — for example, brands and advertising agencies — who shall be responsible for ensuring, by contract or, in the absence thereof, by other appropriate means, that the professional carrying out that activity complies with the Regulation (Article 11(6) and recital 56);
• advertisers and advertising service providers who carry out or facilitate the targeting of advertisements (Article 12 and recital 59);
• ticketing operators and operators of virtual queuing systems (Articles 18 and 19);
• providers of subscription contracts, free trial periods and automatic renewal concluded online (Articles 20 to 23);
• professionals who provide automated contracting systems, including AI agents, acting on behalf of the consumer (Articles 26 and 27).

The proposed scope also covers traders established outside the Union who target consumers in the EU, as is the case under the UCPD.

 

III. OBLIGATIONS SET OUT IN THE PROPOSAL 

3.1. Dark patterns

Traders must not design, organise or operate online interfaces, including visual and auditory components, in a way that is likely to deceive, manipulate or substantially distort the economic behaviour of consumers (Article 10(1)). The list of dark patterns that are unfair in all circumstances is set out in Part III of Annex I to the proposed Regulation (paragraph 2) and may be amended by a delegated act (paragraph 3).

3.2. Influencer marketing

• Clear, prominent and unambiguous disclosure of the commercial intent of each communication, using the terms ‘advertisement’ or ‘commercial collaboration’ (paragraph 1), through the mechanism set out in Article 26(2) of the DSA on online platforms (paragraph 2).
• Prohibition on directly urging minors to buy or persuading adults to buy, on concealing the commercial purpose (in particular where the communication involves minors) and on suggesting that a product is suitable for minors when it is not (paragraph 3).
• Prohibition on influencer marketing of products whose advertising is prohibited under Union or national law (paragraph 4) or which are dangerous within the meaning of Regulation (EU) 2023/988 (paragraph 5).
• The duty of any trader using influencer marketing services to ensure, by contract or, in the absence thereof, by other appropriate means, that the trader carrying out that activity complies with the Regulation (paragraph 6).

 

3.3. Unfair personalisation

The targeting of advertisements based on profiling (Article 4(4) of the GDPR) is prohibited where the trader knows, with reasonable certainty, that the consumer is a minor, or where it is based on special categories of data referred to in Article 9(1) of the GDPR (Article 12). It is also prohibited to personalise prices on the basis of profiling, where this is reasonably likely to cause harm, where the trader knows, with reasonable certainty, that the consumer is a minor or is vulnerable due to their age, credulity, disability or any circumstance affecting their judgement (Article 13). None of these prohibitions requires the processing of additional personal data.

 

3.4. Practices aimed at maximising expenditure

• Paid virtual currencies: indication of the monetary value, actual or estimated, of the items purchased, in the currency of the first purchase, subject to the services covered by the disclosure obligation under Article 13(1) of the proposed EU KIDS Act (Article 14(1)). Where the product is aimed at minors or the provider knows, with reasonable certainty, that it is used by minors, it must be disabled by default and may only be enabled with parental consent (paragraph 2).
• Paid randomised reward systems, including loot boxes: information on the items available and the probability of obtaining them (Article 15(1)), tools to disable them (paragraph 2) and a ban on offering them to minors (paragraph 3), without prejudice to the provisions of the EU KIDS Act.
• Prohibition of ‘pay-to-progress’ and ‘pay-to-win’ mechanisms where the product is aimed at minors or the provider knows, with reasonable certainty, that it is used by minors (Article 16).

 

3.5. Addictive design (Article 17)

Businesses whose digital products are intended to, or may reasonably encourage, compulsive or excessive use must allow users to disable, individually or collectively: (a) automatic playback and uninterrupted consumption without effective breaks; (b) notifications not triggered by the consumer’s activity; (c) incentives for regular use, including penalties for non-use (e.g. streaks); and (d) the simulation of interpersonal relationships (Article 17(1)).

 

3.6. Price transparency (Articles 18 and 19)

Dynamically priced tickets: the number of tickets at the advertised price and the maximum price (Article 18(1)); resale: the organiser’s original price and, where applicable, category, queue and seat (paragraph 2). Virtual queues: indication of the current price in real time, any price changes and the maximum price, at the entrance and throughout the time spent in the queue, except where orders for financial instruments are being executed (Article 19).

 

3.7. Digital contracts

• Free trial periods: a notice on a durable medium, provided in good time, indicating the expiry date, price, duration and conditions of termination (Article 20(1)), and confirmation of acceptance of the paid contract within a maximum of one week (paragraph 3).
• Automatic renewal: a reminder between one month and fourteen days in advance for contracts of six months or more (Article 21(1) and (2)), and up to one week before the renewal that brings the total to six months or the tenth renewal, whichever occurs first, for shorter contracts (Article 22(1)).
• An online termination function (‘terminate the contract here’) where the trader offers the possibility of concluding contracts via an online interface, even if the specific contract was concluded by other means, with confirmation of receipt on a durable medium without undue delay and, at the latest, within one week (Article 23).  This function differs from the right of free withdrawal provided for in Article 24, which applies to distance contracts concluded via an online interface, including financial services where such a right exists under Directive 2011/83/EU.
• Where the trader provides post-contractual customer support online, communication with a human being must be made available at the consumer’s request if other means are not effective; investment services are excluded (Article 25).
• Automated systems used to conclude and perform contracts on behalf of the consumer, excluding the financial services referred to in Article 26: tools for setting parameters, choice of confirmation level on first use, disclosure of payments and conflicts of interest, and a prohibition on imposing their use (Article 26); pre-contractual information in machine-readable format in contracts concluded exclusively between automated systems (Article 27).

 

3.8. Unsolicited communications and anti-circumvention (Articles 28 and 29)

Article 28 proposes to reorganise and specify, in the B2C context, the rules on direct marketing already set out in the ePrivacy Directive. It provides for prior consent within the meaning of the GDPR for automated calls, SMS, MMS or email, with the exception of emails to existing customers regarding similar products from the same provider, with the option to opt out easily and free of charge from data collection and in each message.

 

IV. Enforcement and sanctions

Courts and authorities may require the disclosure of evidence regarding the design, operation and impact of online practices, provided there are sufficient facts and evidence to support the likelihood of an unfair practice or a reasonable suspicion on the part of the authority. Disclosure must be necessary and proportionate, with protection afforded, in particular, to trade secrets; failure to disclose may be assessed in conjunction with the other evidence and circumstances (Article 34).

In coordinated proceedings under the CPC Regulation, the maximum fines are at least 4 per cent of turnover in the Member States concerned or, in the absence of such information, at least EUR 2 million (Article 35(3) and (4)). The proposal also provides for Commission fines of up to 6 per cent of annual worldwide turnover for infringements investigated under Chapter III of the proposed new CPC Regulation, in conjunction with the adoption of that reform (paragraph 6). Article 36 provides for a right to seek redress against third parties with whom traders or businesses held liable for unfair commercial practices have a commercial relationship, where their acts or omissions have given rise to or contributed to the trader’s liability.

 

V. Consumer rights provided for in the proposal

The Proposal provides for the following consumer rights, with a particular focus on relations with businesses selling digital goods or services. It includes new rights and incorporates rights already provided for in the European acquis, such as the right to online withdrawal and individual remedies:

Right	Content	Provision
No obligation to continue after the trial period	The consumer is not bound by the paid contract if they have not received the reminder or have not expressly agreed to continue before the end of the free period.	Article 20(2)
Termination free of charge due to lack of a reminder	In the absence of a reminder, the consumer may terminate the contract without notice or cost during the periods specified: in Article 21, from the date of extension until the date the notice was sent; in Article 22, from the date on which the notice was due until termination or the date it was sent.	Articles 21(3) and 22(3)
Termination of contracts renewed for an indefinite period	The right to terminate the contract at any time, free of charge, with the maximum notice period that may be imposed by the trader being one month, subject to any costs relating to the supply of the product during the notice period.	Article 21(4)
Online termination	Where the trader offers the possibility of concluding contracts via an online interface, the right to terminate the contract via an online function, even if it was concluded by other means.	Article 23
Online right of withdrawal	Exercise of an existing right of free termination, in distance contracts concluded via an online interface, through a dedicated function; it shall be deemed timely if submitted within the time limit.	Article 24(1) and (6)
Human contact	Where post-contractual online customer support is provided, the right to communicate with a human being, at the consumer’s request, if other means are not effective. Investment services are excluded.	Article 25
Control of add-on features and loot boxes	The right to disable autoplay, notifications, streaks, simulated interpersonal relationships and paid variable reward systems.	Articles 15(2) and 17(1)
Control of automated agents	The right to define and amend, at any time, the parameters of automated systems that conclude and perform contracts on their behalf, and to be informed of conflicts of interest. Financial services are excluded.	Article 26(1), (2) and (4)
Individual remedies	Compensation and, where relevant, a price reduction or termination of the contract, without prejudice to other remedies provided for under Union or national law.	Article 32

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The individual remedies set out in Article 32 reiterate and consolidate the regime introduced into the UCPD by Directive (EU) 2019/2161, and it is proposed that they be applied directly through the Regulation.

 

VI. NEXT STEPS AND RECOMMENDATIONS

The Proposal is subject to the ordinary legislative procedure in the European Parliament and the Council and does not, for the time being, create any binding obligations. In the proposed wording of Article 40, entry into force will take place on the twentieth day following publication in the Official Journal; the implementation period is also set out in square brackets as 12 months after entry into force, subject to confirmation in the final text. The obligations, rights and powers described in this information should be understood as proposed content, without prejudice to the rules already in force that are expressly indicated.

We recommend that the companies and professionals concerned begin immediately with: (i) an audit of interfaces, subscription and cancellation processes; (ii) mapping engagement and monetisation features, with particular attention to minors; (iii) reviewing contracts with influencers, agencies and technology providers, including clauses on the right of recourse; and (iv) coordinating with compliance programmes for the GDPR, DSA, AI Act and the future KIDS Act.

 

Ana Ferreira Neves | afn@servulo.com

Rodrigo Barreiros Ferreira | rbf@servulo.com