EU proposes Digital Fairness Act: 10 dark patterns banned, fines up to 6% of turnover

01Ten dark patterns banned outright, and drip pricing with them

Article 10 bans designing, organising or operating an online interface “in a manner that is likely to deceive or manipulate consumers, or in a manner that is likely to otherwise materially distort” what they buy. Part III of Annex I then lists ten dark patterns that are unfair in all circumstances, which the proposal’s recitals define as unfair “without a case-by-case assessment”. The Commission can add to the list by delegated act, subject to objection by Parliament or Council.³⁴ The Commission’s own examples are “Only 1 left”, “5 other customers are interested in this!”, “We’re sad to see you go” and a button reading “I don’t like good deals”.²

Elsewhere in the same annex, a price shown at the first step must include “all foreseeable fees, taxes, charges or other payments” the shopper cannot avoid, which ends drip pricing. A crossed-out price or a “save 40%” badge may no longer be measured against a manufacturer’s recommended price: the reference must be a current price of the same product charged by a clearly identified competitor (a shop’s own price cuts stay under the existing price-indication rules).³⁴

Design teams get switches too: adults must be able to turn off autoplay, unrelated notifications and streak-style rewards. Games must show the money value of virtual-currency prices and the odds in paid loot boxes; for minors, loot boxes and pay-to-win are banned.³

02A cancel button labelled ‘terminate the contract here’

The subscription rules apply to contracts concluded online. A free trial no longer slides into a paid plan by default: if the trader has not sent the reminder, or the consumer has not expressly agreed to pay before the trial ends, “the consumer shall not be bound by the contract”. A missed renewal reminder works the same way: the consumer may leave free of charge at any time until the reminder is sent, and pays nothing for the period after the renewal.³

Cancelling is a function, not a phone call. Wherever a contract can be signed online, the trader must offer an online termination function, “irrespective of the manner in which the contract was concluded”, labelled “terminate the contract here” and confirmed by a button reading “confirm the contract termination”. The text does not use the phrase “as easy as signing up”; it bans making the steps to refuse or withdraw a choice “disproportionately more numerous, complex or time-consuming than is reasonably necessary”.³⁴

The right to a human is narrower than the press release’s summary. It applies to online customer service after a contract is made, “upon request of the consumer and when other means are not effective”, and not to investment services.³ A companion directive changes the 14-day right of withdrawal for audio and video subscriptions into a right to cancel during the first month, paying that month in full.⁶

03When an AI agent buys, and whose prices may be personal

The press release speaks of AI agents; the text says “automated systems” that conclude contracts on a consumer’s behalf. Article 26 puts the duties on the trader that offers the agent to consumers. On first use the consumer must choose one of three settings: confirm every purchase, confirm only purchases matching rules they set (“including a maximum price and a time limit”), or confirm nothing. The agent must disclose any payment it receives for proposing a deal, and any conflict of interest, and then ask for confirmation whatever the setting. A shop may not make an agent the only way in. Financial services are excluded.³

Personalisation is narrowed in two articles. Article 12 bars any trader from targeting ads by profiling a consumer it knows “with reasonable certainty” to be a minor, or by using the special categories of personal data in the GDPR, such as health or ethnic origin. The Digital Services Act already bans both for online platforms; the proposal extends the ban “to all websites and apps”.²³ Article 13 bars personalised prices “reasonably likely to cause harm” to a known minor or a consumer known to be vulnerable through age, credulity, disability or misfortune. Neither article obliges a trader to collect more data to find out.³

04Up to 6% of worldwide turnover, when Brussels takes the case

The 6% ceiling sits in the companion revision of the Consumer Protection Cooperation Regulation and is mirrored in Article 35 of the Act. The Commission may fine “not exceeding 6% of the trader’s worldwide annual turnover”, but only in cases it takes itself: a breach likely to harm consumers in at least two-thirds of member states, accounting for at least two-thirds of the EU’s population, by a company that is not a small or medium-sized enterprise. When it opens such a case, national authorities stop investigating the same one.²³⁵ The 6% matches the Digital Services Act’s ceiling for the largest platforms, sits above the GDPR’s 4% (or €20m, if higher) and below the Digital Markets Act’s 10% for gatekeepers.⁹¹⁰¹¹

The Commission could also fine up to 1% of turnover for obstructing an investigation, impose periodic penalties of up to 5% of average daily worldwide income, make test purchases and inspect premises. National cases keep today’s floor: after a coordinated action, the maximum fine must be at least 4% of turnover in the countries concerned, or at least €2 million where turnover is unknown.³⁵

The ceiling is a share of turnover, not profit. Non-EU traders selling to EU consumers would also have to name a legal representative in the EU and publish its contact details on their website.⁵ Today’s network of national authorities has run more than 30 coordinated actions since 2020.¹

05€13.7bn a year for consumers, and a year to comply after adoption

The impact assessment puts the harm from these practices at “at least 10.3 billion EUR in 2026 and up to EUR 16.7 billion in 2035”, and says businesses “are hesitant about any new legislation; however support is noticeably higher among SMEs”.³⁸

The positions were set before the text. DIGITALEUROPE, which represents digital companies, argued in May 2025 that a new act “would merely duplicate existing regulations” and that the EU should enforce the laws it has.¹² BEUC, the European consumer organisation, asked in December 2025 for addictive features to be off by default and for paid loot boxes and premium virtual currencies to be banned.¹³ The proposal does neither for adults: it gives them switches and price labels, and keeps the bans for minors.³

The proposal now goes to the European Parliament and the Council under the ordinary legislative procedure (file 2026/0356 (COD)), and both must agree the same text. As a regulation it needs no national transposition: it enters into force 20 days after publication in the Official Journal and applies 12 months later, as would the enforcement regulation.³⁵ No adoption date is set. Three things to watch: whether the 6% ceiling and the two-thirds threshold survive Parliament and Council, whether the list of ten dark patterns grows in negotiation, and whether the opt-outs for adults become defaults, as BEUC asked.