The proposal could have significant implications for how businesses design digital products, personalise offers, manage subscriptions and engage with consumers. It also signals stronger EU-level enforcement, with proposed Commission fines of up to 6% of worldwide annual turnover for infringements investigated under the revised Consumer Protection Cooperation framework.
Which businesses could be affected?
Despite its name, the DFA would not be limited to digital services or large technology companies. The proposal would repeal the 2005 Unfair Commercial Practices Directive (UCPD) and replace it with a directly applicable Regulation. It retains the core rules of the UCPD and adds an additional layer of provisions that specifically address digital commercial practices.
Retailers, subscription providers, game developers, ticket sellers, brands, influencers and businesses using automated sales or customer-service tools should therefore consider which requirements could affect them. The obligations would vary depending on their activities and features.
The DFA is intended to work alongside the Digital Services Act (DSA), the GDPR, the Digital Markets Act, the AI Act and the proposed EU KIDS Act, among other instruments. It includes specific exclusions and rules to manage overlap, so businesses would need to assess these instruments together rather than treat the DFA as a stand-alone framework.
What would change?
Clearer rules on dark patterns and addictive design
Businesses would be prohibited from designing or operating online interfaces in ways likely to deceive or manipulate consumers or materially distort their economic choices. Additionally, a blacklist of prohibited dark patterns would be maintained, with the Commission receiving delegated powers to update the list as practices evolve.
Where digital products are designed, or can reasonably be expected, to encourage compulsive or excessive use, businesses would need to provide easy-to-access, effective tools to disable specified features, individually or together. These include certain autoplay and uninterrupted content features, notifications unrelated to user activity, engagement rewards or penalties, and prompts that simulate personal relationships to encourage continued use. Specific overlap rules and exclusions would apply in relation to the proposed EU KIDS Act.
More responsibility across the influencer marketing chain
Influencers would need to identify each commercial communication clearly and prominently using ‘advertisement’ or ‘commercial collaboration’. On platforms covered by the DSA, they would also need to use the platform’s advertising disclosure functionality.
Brands and other businesses using influencer services would have to secure compliance through contracts or, where there is no contract, other appropriate measures. The proposal also includes additional protections for minors: influencers could not directly exhort minors to buy products or persuade adults to buy them, or create the impression that a product is appropriate for minors when it is not. Influencer marketing of dangerous products, and of products whose advertising is prohibited under EU or national law, would also be prohibited.
Limits on personalised advertising and pricing
The proposal would extend restrictions on profiling-based advertising beyond the DSA framework. Businesses would be prohibited from targeting advertisements based on profiling using a consumer’s personal data where they know with reasonable certainty that the consumer is a minor. Targeting advertisements based on profiling using GDPR special-category data would also be prohibited, without a separate requirement that the advertising be reasonably likely to cause harm. These DFA provisions would not apply to online platform providers already subject to Section 3 of Chapter III of the DSA.
Personalised pricing based on profiling would be prohibited where it is reasonably likely to cause harm and the business knows with reasonable certainty that the consumer is either a minor or vulnerable due to age, credulity, disability, or a specific misfortune or circumstance serious enough to impair their judgment. Beneficial differentiation, such as student or senior discounts, is not intended to be caught by this restriction. Neither provision would require businesses to process additional personal data to assess whether a consumer is a minor or, for pricing, vulnerable.
New safeguards for in-app spending
Businesses offering paid-for virtual currencies for purchases of their own virtual items or other products would need to show the corresponding real-money value, or estimated value, of those products in the currency used to acquire the first virtual currency. A specific exclusion would apply to providers subject to the corresponding disclosure obligation under the proposed EU KIDS Act.
Where products are directed at minors, or the business knows with reasonable certainty that they are used by minors, paid-for virtual currencies would have to be disabled by default for minors and could only be activated with parental or guardian approval.
The proposal also introduces specific rules for loot boxes and other paid-for variable reward systems. Businesses would have to disclose the possible rewards and the probability of obtaining them, and provide easily accessible, effective tools to disable the systems. Where products are directed at minors, or the business knows with reasonable certainty that they are used by minors, minors could not be offered paid-for variable reward systems or pay-to-win and pay-to-progress mechanisms. Specific overlap rules would apply to certain providers covered by the proposed EU KIDS Act.
Greater transparency on dynamic pricing and virtual queues
For event tickets whose prices may increase through a business’s actions or automated or algorithmic processes, businesses would have to disclose the number of tickets in the relevant category available at the advertised price and the maximum possible price. Ticket resellers would also have to display the original total price charged by the event organiser and, where applicable, the ticket category, row and seat number.
Businesses using virtual queues would need to show consumers the current price, whether it may change while they wait and, where it may change, the maximum price. The current price would have to be updated in real time throughout the waiting period. These requirements would not be limited to ticketing, but would exclude the execution of orders on financial instruments.
Clearer subscriptions, easier cancellation and access to human support
The proposal would strengthen consumer control over subscriptions and automatic renewals in contracts concluded online or by other digital means.
For contracts with free trials, businesses would have to send a reminder on a durable medium within a reasonable period before the trial ends and obtain the consumer’s express agreement before the end of the trial to continue on a paid basis. If either requirement is not met, the consumer would not be bound by the contract. Businesses would also have to confirm the consumer’s agreement on a durable medium without undue delay and within one week.
For continuous-supply contracts lasting six months or longer, businesses would have to send an automatic-renewal reminder between one month and fourteen days before renewal. For shorter contracts, a reminder would be due at least one week before the renewal that brings the initial or subsequent extension period to six months, or the tenth renewal, whichever occurs first. A specific exception would apply to certain short-term investment contracts.
Failure to send the required renewal reminder would give consumers rights to terminate without notice or charges during the relevant period. Long-term contracts renewed for an indefinite period could be terminated at any time on no more than one month’s notice, with charges limited to supply during that notice period.
Where a business allows contracts to be concluded through an online interface, consumers would also have to be able to terminate contracts using a prominently displayed, easily accessible online function, regardless of how the contract was originally concluded. The proposal also sets out requirements for an online withdrawal function. These functions concern the exercise of termination or withdrawal rights, rather than creating a general right to end any contract at any time.
Consumers using online after-sales support would be entitled to communicate with a human on request when other means are not effective, subject to a specific exception for investment services.
Consumer control over AI agents and automated transactions
The proposal also addresses the growing use of AI agents and other automated systems that can conclude and perform contracts on behalf of consumers. Consumers would have to retain control over these systems, including by expressly choosing on first use whether to approve all contracts, only contracts meeting specified criteria, or allow contracts without prior confirmation. They could change their choices and parameters at any time.
Providers would have to disclose payments received for proposing a contract and conflicts of interest with the business concerned. In those cases, the consumer would have to confirm the contract regardless of their general approval settings. Businesses could not require consumers to use automated systems to access or conclude transactions through their online interfaces. These consumer-control provisions would not apply to financial services.
At the same time, the proposal would simplify certain information requirements where contracts are concluded entirely through automated systems, including by allowing specified pre-contractual information to be provided only in a commonly used machine-readable format. Consumers would still have to receive a contract confirmation on a durable medium in plain and intelligible language.
Rules on unsolicited marketing brought into the consumer framework
The proposal would also bring rules on unsolicited direct marketing into the consumer protection framework. Automated calls, SMS, MMS and email marketing would generally require prior consent. An exception would allow email marketing of a business’s own similar products to existing customers, subject to an easy, free opportunity to object when contact details are collected and in each message. For marketing calls involving human intervention, Member States could provide for an opt-out regime instead of prior consent.
Stronger enforcement and evidence requirements
Under the proposed framework, the Commission would be able to investigate and enforce certain widespread infringements with a Union dimension through the revised Consumer Protection Cooperation framework. For infringements it investigates under that framework, fines could reach 6% of worldwide annual turnover. Specific supervisory arrangements linked to the DSA, the AI Act and the proposed EU KIDS Act would also apply to certain addictive-design and minors’ spending protections.
National courts and authorities would also gain specific powers to require evidence about the design, operation and consumer impact of online practices, subject to evidential thresholds, necessity, proportionality and protection of trade secrets. Businesses should therefore be ready to explain not only what their interfaces say, but how they work.
The proposal would also give businesses held liable for unfair online practices a right of recourse against commercial partners whose acts or omissions caused or contributed to that liability. This could be relevant to arrangements with third-party interface or software providers.
What can businesses do now?
While the DFA remains a proposal, potentially affected businesses can begin to identify where it may interact with their existing services. Practical steps include:
- Review customer journeys: identify where the proposal could affect advertising, sign-up, subscriptions, cancellation and customer support.
- Assess digital design and monetisation features: consider potentially manipulative or addictive features, virtual currencies and random-reward mechanisms, including defaults and parental controls for minors.
- Map personalisation and influencer activities: understand how data is used for advertising and pricing, and review existing influencer arrangements and direct-marketing practices.
- Identify potential implementation needs: consider which systems, interfaces and internal processes may need to change, including the arrangements with suppliers responsible for relevant features.
What happens next?
The European Parliament and the Council of the European Union will consider the proposal through the ordinary legislative procedure.
Legislative negotiations are likely to focus on how the proposed DFA will fit with existing EU digital legislation and how far the new rules should go. Personalisation, addictive design and AI-enabled contracting are likely to attract particular attention, alongside the decision to replace the UCPD with a Regulation and to strengthen EU-level enforcement. More broadly, the debate is expected to reflect differences between calls for stronger protections and concerns about complexity and regulatory overlap.
The proposal envisages entry into force on the twentieth day following publication of the adopted Regulation in the Official Journal of the European Union, and application 12 months after entry into force. The 12-month application period remains in square brackets in Article 40(2) and is not a confirmed implementation deadline. The timetable remains subject to the legislative negotiations.
For businesses, the immediate priority is to identify which proposed changes could require product or operational work and follow the negotiations closely.
