---
title: "EU proposes Digital Fairness Act: 10 dark patterns banned, fines up to 6% of turnover"
summary: "What the European Commission proposed on 11 November for checkouts, subscriptions, AI agents that buy and personalised ads, who can fine 6% of worldwide turnover, and what Indian sellers must watch."
url: https://www.thetechbag.com/blog/eu-digital-fairness-act-dark-patterns-6-percent-fines
format: Analysis
desk: "Data & privacy"
region: Global
published: 2026-11-12
facts_checked: 2026-11-12
author: TechBag (The TechBag Journal)
tags: ["Digital Fairness Act","EU dark patterns ban","subscription cancellation rules","EU consumer law 2027","subscription cancellation law","EU consumer law fines","European Commission","dark patterns","subscription traps","free trials","drip pricing","right to a human","AI agents","agentic commerce","personalised pricing","loot boxes","Unfair Commercial Practices Directive","CPC Regulation","Digital Services Act","GDPR","CCPA dark patterns guidelines","Consumer Protection Act 2019"]
cover: https://www.thetechbag.com/blog/covers/eu-digital-fairness-act-dark-patterns-6-percent-fines.png
---

# EU proposes Digital Fairness Act: 10 dark patterns banned, fines up to 6% of turnover

*What the European Commission proposed on 11 November for checkouts, subscriptions, AI agents that buy and personalised ads, who can fine 6% of worldwide turnover, and what Indian sellers must watch.*

Analysis · Data & privacy · By TechBag · Published 2026-11-12 · Facts checked 2026-11-12 · Canonical: https://www.thetechbag.com/blog/eu-digital-fairness-act-dark-patterns-6-percent-fines

The short version

1. The European Commission proposed a Digital Fairness Act on 11 November: one regulation for all 27 member states that bans ten dark patterns outright, among them false “only 1 left” claims, pre-ticked extras and “no thanks” buttons that shame, and adds drip pricing to the list of practices banned in all circumstances.[1][4]
2. Subscriptions change most: a reminder and an express “yes” before a free trial turns paid, reminders before renewals, a cancel function labelled “terminate the contract here”, and a right to reach a human. AI agents that buy must let the consumer set limits and must disclose paid placements.[3]
3. The Commission could fine up to 6% of a company’s worldwide annual turnover in cases that reach two-thirds of member states, and puts consumers’ saving at up to €13.7bn a year. Parliament and Council now negotiate the text; it would apply 12 months after it enters into force.[1][3][5][7]

EU law has banned misleading and aggressive selling since 2005, through a directive that each member state wrote into its own law. The proposal replaces that directive with a single regulation and adds rules written for screens: checkout pages, subscriptions, in-game currencies, influencers and software that shops on a person’s behalf. We read the proposal, its annex, the enforcement regulation that comes with it and the impact assessment to answer four questions: what a checkout or subscription page must do differently, what changes when an AI agent buys, who can fine whom and how much, and what an Indian company selling to Europeans should watch.

## Ten dark patterns banned outright, and drip pricing with them

Article 10 bans designing, organising or operating an online interface “in a manner that is likely to deceive or manipulate consumers, or in a manner that is likely to otherwise materially distort” what they buy. Part III of Annex I then lists ten dark patterns that are unfair in all circumstances, which the proposal’s recitals define as unfair “without a case-by-case assessment”. The Commission can add to the list by delegated act, subject to objection by Parliament or Council.[3][4] The Commission’s own examples are “Only 1 left”, “5 other customers are interested in this!”, “We’re sad to see you go” and a button reading “I don’t like good deals”.[2]

Elsewhere in the same annex, a price shown at the first step must include “all foreseeable fees, taxes, charges or other payments” the shopper cannot avoid, which ends drip pricing. A crossed-out price or a “save 40%” badge may no longer be measured against a manufacturer’s recommended price: the reference must be a current price of the same product charged by a clearly identified competitor (a shop’s own price cuts stay under the existing price-indication rules).[3][4]

**Figure: What a checkout may no longer do, and what it shows instead**

*Practices listed as unfair in all circumstances in Annex I of the proposed Digital Fairness Act, 11 November 2026*

Banned in all circumstances

- “Only 1 left” or “5 people are viewing this” when it is not true, or repeated through the order (points 53, 54)
- Pre-ticked insurance or extras the shopper must untick (point 55)
- A decline button worded as the wrong choice: “I don’t like good deals” (point 56)
- Fees that appear only at the last step (point 12)
- Price, duration or auto-renewal in smaller print than other terms (point 60)
- Asking again after the shopper has said no (point 58)

What the page shows instead

- Scarcity or popularity only when true, with its qualifications stated
- Empty boxes: extras added only by the shopper
- A neutral decline, worded as plainly as accept, with no double negatives (point 59)
- The full price at the first step, every unavoidable fee included
- Price and renewal terms as prominent as anything else on the page
- Refusing or changing a choice takes no more steps than needed (point 62)

Source: European Commission, DFA proposal, Annex I points 12, 53 to 62; Q&A · as of 12 November 2026

TechBag countAnnex I grows to 62 banned practices, 15 of them new

We matched the proposal’s correlation table against its Annex I: 47 of the 62 practices carry over from the 2005 directive as amended, and 15 are new. They are the ten dark patterns (points 53 to 62), drip pricing (12), fake reference-price comparisons (11), time-limited offers that do not state the duration (14) and two dropshipping practices (33, 34).[4]

Design teams get switches too: adults must be able to turn off autoplay, unrelated notifications and streak-style rewards. Games must show the money value of virtual-currency prices and the odds in paid loot boxes; for minors, loot boxes and pay-to-win are banned.[3]

## A cancel button labelled ‘terminate the contract here’

The subscription rules apply to contracts concluded online. A free trial no longer slides into a paid plan by default: if the trader has not sent the reminder, or the consumer has not expressly agreed to pay before the trial ends, “the consumer shall not be bound by the contract”. A missed renewal reminder works the same way: the consumer may leave free of charge at any time until the reminder is sent, and pays nothing for the period after the renewal.[3]

Cancelling is a function, not a phone call. Wherever a contract can be signed online, the trader must offer an online termination function, “irrespective of the manner in which the contract was concluded”, labelled “terminate the contract here” and confirmed by a button reading “confirm the contract termination”. The text does not use the phrase “as easy as signing up”; it bans making the steps to refuse or withdraw a choice “disproportionately more numerous, complex or time-consuming than is reasonably necessary”.[3][4]

**Figure: Six points where a subscription page must change**

*Duties on a trader selling a subscription online under the proposed Digital Fairness Act, Articles 20 to 25, 11 November 2026*

Step 1 of 6

Sign-up

Price, contract length and auto-renewal shown as prominently as any other term; no pre-ticked add-ons (Annex I points 55, 60).

Source: European Commission, DFA proposal, Articles 20 to 25 and Annex I · as of 12 November 2026

The right to a human is narrower than the press release’s summary. It applies to online customer service after a contract is made, “upon request of the consumer and when other means are not effective”, and not to investment services.[3] A companion directive changes the 14-day right of withdrawal for audio and video subscriptions into a right to cancel during the first month, paying that month in full.[6]

Our viewWhat a subscription business would change first

The trial-to-paid step carries the sharpest consequence in the text: without a reminder and an express yes, there is no paid contract. A team selling subscriptions to EU consumers would start with that email and its consent record, then the labelled cancel function, then the renewal calendar for plans of six months or more.

## When an AI agent buys, and whose prices may be personal

The press release speaks of AI agents; the text says “automated systems” that conclude contracts on a consumer’s behalf. Article 26 puts the duties on the trader that offers the agent to consumers. On first use the consumer must choose one of three settings: confirm every purchase, confirm only purchases matching rules they set (“including a maximum price and a time limit”), or confirm nothing. The agent must disclose any payment it receives for proposing a deal, and any conflict of interest, and then ask for confirmation whatever the setting. A shop may not make an agent the only way in. Financial services are excluded.[3]

**Figure: An agent may buy without asking only if the consumer chose that, and never on a paid placement**

*Duties on a trader offering an automated system that contracts for consumers, Article 26 of the proposed Digital Fairness Act, 11 November 2026*

1. 01First useThe consumer picks: confirm all, confirm by rules (a price cap, a time limit), or none. The choice is confirmed on a durable medium and can change at any time.
2. 02Before buyingWhere the consumer confirms, the agent shows the main terms: the seller, the product, the total price, delivery and withdrawal rights.
3. 03Paid or conflictedAny payment to the agent’s provider or conflict of interest is disclosed, and the consumer must confirm that purchase, whatever the setting.
4. 04After buyingThe seller sends a confirmation of the contract in plain language. Agent-to-agent contracts may carry the pre-contract terms in machine-readable form.

Source: European Commission, DFA proposal, Articles 26 and 27 · as of 12 November 2026

Personalisation is narrowed in two articles. Article 12 bars any trader from targeting ads by profiling a consumer it knows “with reasonable certainty” to be a minor, or by using the special categories of personal data in the GDPR, such as health or ethnic origin. The Digital Services Act already bans both for online platforms; the proposal extends the ban “to all websites and apps”.[2][3] Article 13 bars personalised prices “reasonably likely to cause harm” to a known minor or a consumer known to be vulnerable through age, credulity, disability or misfortune. Neither article obliges a trader to collect more data to find out.[3]

## Up to 6% of worldwide turnover, when Brussels takes the case

The 6% ceiling sits in the companion revision of the Consumer Protection Cooperation Regulation and is mirrored in Article 35 of the Act. The Commission may fine “not exceeding 6% of the trader’s worldwide annual turnover”, but only in cases it takes itself: a breach likely to harm consumers in at least two-thirds of member states, accounting for at least two-thirds of the EU’s population, by a company that is not a small or medium-sized enterprise. When it opens such a case, national authorities stop investigating the same one.[2][3][5] The 6% matches the Digital Services Act’s ceiling for the largest platforms, sits above the GDPR’s 4% (or €20m, if higher) and below the Digital Markets Act’s 10% for gatekeepers.[9][10][11]

The Commission could also fine up to 1% of turnover for obstructing an investigation, impose periodic penalties of up to 5% of average daily worldwide income, make test purchases and inspect premises. National cases keep today’s floor: after a coordinated action, the maximum fine must be at least 4% of turnover in the countries concerned, or at least €2 million where turnover is unknown.[3][5]

**Figure: Consumer law's ceiling would match the DSA's 6%, above the GDPR's 4%**

*Maximum fine as a share of annual turnover, by EU law, as written on 12 November 2026*

Digital Markets Act, gatekeepers

10%

Digital Fairness Act, Commission cases

proposed

6%

Digital Services Act, largest platforms

6%

GDPR

4%

Consumer law, national coordinated cases

at least

4%

|  | Value (%) |
| --- | --- |
| Digital Markets Act, gatekeepers | 10 |
| Digital Fairness Act, Commission cases | 6 |
| Digital Services Act, largest platforms | 6 |
| GDPR | 4 |
| Consumer law, national coordinated cases | 4 |

Source: DFA proposal Art. 35; CPC revision Art. 43; DSA Art. 74; GDPR Art. 83(5); DMA Art. 30 · as of 12 November 2026 · Bases differ: national consumer fines use turnover in the member states concerned and set a floor for the maximum; the GDPR uses €20m where higher

The ceiling is a share of turnover, not profit. Non-EU traders selling to EU consumers would also have to name a legal representative in the EU and publish its contact details on their website.[5] Today’s network of national authorities has run more than 30 coordinated actions since 2020.[1]

## €13.7bn a year for consumers, and a year to comply after adoption

€13.7bn

a year saved by EU consumers, in money and time, the Commission estimates

Against yearly business costs of €1.2bn, or €678m once overlaps between measures are removed.

The impact assessment puts the harm from these practices at “at least 10.3 billion EUR in 2026 and up to EUR 16.7 billion in 2035”, and says businesses “are hesitant about any new legislation; however support is noticeably higher among SMEs”.[3][8]

The positions were set before the text. DIGITALEUROPE, which represents digital companies, argued in May 2025 that a new act “would merely duplicate existing regulations” and that the EU should enforce the laws it has.[12] BEUC, the European consumer organisation, asked in December 2025 for addictive features to be off by default and for paid loot boxes and premium virtual currencies to be banned.[13] The proposal does neither for adults: it gives them switches and price labels, and keeps the bans for minors.[3]

**Figure: Three years from Parliament's first call to the Commission's text**

*Steps to the Digital Fairness Act proposal, December 2023 to November 2026*

| Date | Event | Detail |
| --- | --- | --- |
| 12 Dec 2023 | Parliament: act on addictive design | Resolution on addictive design of online services. |
| 3 Oct 2024 | Fitness Check finds gaps | Commission review of three consumer directives, 2017 to 2023. |
| 19 Nov 2025 | 2030 Consumer Agenda | The Commission announces the Digital Fairness Act. |
| 26 Nov 2025 | Parliament: protect minors online | Resolution on the protection of minors online. |
| 26 Feb 2026 | Council: close the gaps | Conclusions on the 2030 Consumer Agenda. |
| 11 Nov 2026 | Proposal published | Digital Fairness Act, CPC revision and simplification directive. |

Source: DFA proposal, explanatory memorandum and footnotes; Commission press release · as of 12 November 2026

The proposal now goes to the European Parliament and the Council under the ordinary legislative procedure (file 2026/0356 (COD)), and both must agree the same text. As a regulation it needs no national transposition: it enters into force 20 days after publication in the Official Journal and applies 12 months later, as would the enforcement regulation.[3][5] No adoption date is set. Three things to watch: whether the 6% ceiling and the two-thirds threshold survive Parliament and Council, whether the list of ten dark patterns grows in negotiation, and whether the opt-outs for adults become defaults, as BEUC asked.

India already bans 13 dark patterns; a seller to Europe must meet both lists

India’s Central Consumer Protection Authority (CCPA) notified its Dark Patterns Guidelines on 30 November 2023 under the Consumer Protection Act, 2019. They apply to platforms “systematically offering goods or services in India”, advertisers and sellers, and name 13 patterns: false urgency, basket sneaking, confirm shaming, forced action, subscription trap, interface interference, bait and switch, drip pricing, disguised advertisement, nagging, trick question, SaaS billing and rogue malware.[14] Most have an EU twin. India’s subscription trap covers cancellation that is “impossible or a complex and lengthy process”, and its SaaS billing gives as an example “no notification is given to the user when free trial is converted to paid”. The Guidelines say their illustrations are guidance, not a binding interpretation.[14]

What India’s text does not have: a rule that a trial without consent creates no paid contract, a labelled cancel function, a general right to reach a human (TRAI’s [human minimum covers telecom complaints](https://www.thetechbag.com/blog/trai-ai-agents-telecom-complaints-16-hours-human) only), rules for buying agents, or a ban on harmful personalised prices. Targeted advertising aimed at children is barred by section 9(3) of the Digital Personal Data Protection Act from 13 May 2027.[18][19]

Enforcement has begun at a smaller scale. On 3 June 2026 the CCPA fined PhysicsWallah ₹5 lakh for a pre-selected ₹10 donation and McAfee ₹1 lakh for a renewal screen offering “Renew Now” or “Accept Risk”.[15] The Act caps a penalty for a misleading advertisement at ₹10 lakh, ₹50 lakh for a repeat (section 21).[16] From 1 January 2027 the amended E-Commerce Rules require every e-commerce entity to self-audit for dark patterns each year and display a certificate.[17]

For an Indian company with EU customers, the EU rules apply to any trader targeting consumers in the EU, wherever it is established, and a Commission fine would be reckoned on worldwide turnover, Indian revenue included.[3][5] Nothing binds until the act is adopted and its 12 months run, but the design work can start now: unticked boxes, a trial-end reminder with an explicit yes, a labelled cancel function, and an EU legal representative named on the site.

How we did this

Figures as of 12 November 2026, 8:30pm IST

Every rule here is from the Commission’s texts of 11 November, read in full: the proposal and its annexes, the CPC revision, the simplification directive, the press release, Q&A, factsheet and impact-assessment summary. It is a proposal and can change. The 6% ceiling is on worldwide annual turnover, as the texts state, not on profit; it applies only to cases the Commission itself takes under the CPC revision. The €13.7bn and the cost figures are the Commission’s estimates. Our counts: the ten dark patterns are points 53 to 62 of Annex I; the 15 new practices are the Annex I points with no entry in the proposal’s correlation table. The fine chart compares ceilings as written; the bases differ. The E-Commerce amendment’s date is from the gazette as read for TechBag’s retail obligations register.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [European Commission press release IP/26/2407 on the Digital Fairness Act](https://ec.europa.eu/commission/presscorner/detail/en/ip_26_2407) — 11 November 2026
2. [European Commission, Questions and answers on the Consumer Package](https://ec.europa.eu/commission/presscorner/detail/en/qanda_26_2408) — 11 November 2026
3. [Proposal for a Digital Fairness Act, COM(2026) 1100 final](https://commission.europa.eu/document/0575d59f-554f-4a9e-b54b-e6b717175809_en) — 11 November 2026 Memorandum, recitals, Articles 10 to 40.
4. [Annexes to the Digital Fairness Act proposal (Annex I, correlation table)](https://commission.europa.eu/document/download/a0539d90-2758-48e5-9010-1e856030d166_en?filename=Annexes%20to%20the%20Proposal%20for%20a%20Digital%20Fairness%20Act.pdf) — 11 November 2026
5. [Proposal to revise the CPC Regulation, COM(2026) 1120 final](https://commission.europa.eu/document/9c63e001-7dae-4d07-90ff-3efb4961490b_en) — 11 November 2026 Articles 3, 31, 32, 43, 44, 59.
6. [Proposal for a simplification directive, COM(2026) 1110 final](https://commission.europa.eu/document/f3b0c009-d27e-45e2-b253-e291f7d9254f_en) — 11 November 2026
7. [European Commission, Consumer Package factsheet](https://commission.europa.eu/document/2c5615a6-a7e7-4503-a3d1-4d78bec51ab0_en) — November 2026
8. [Executive summary of the impact assessment, SWD(2026) 1102 final](https://commission.europa.eu/document/download/92b7a7b4-5813-4147-91dd-f40b9f240b49_en?filename=Executive%20summary%20of%20the%20Impact%20Assessment%20report.pdf) — 11 November 2026
9. [Regulation (EU) 2022/2065 (Digital Services Act), Article 74](https://eur-lex.europa.eu/eli/reg/2022/2065/oj) — 19 October 2022
10. [Regulation (EU) 2016/679 (GDPR), Article 83(5)](https://eur-lex.europa.eu/eli/reg/2016/679/oj) — 27 April 2016
11. [Regulation (EU) 2022/1925 (Digital Markets Act), Article 30](https://eur-lex.europa.eu/eli/reg/2022/1925/oj) — 14 September 2022
12. [DIGITALEUROPE, Digital Fairness Act: new laws or better enforcement?](https://cdn.digitaleurope.org/uploads/2025/05/Digital-Fairness-Act-paper-May-2025.pdf) — 8 May 2025
13. [BEUC, Towards the Digital Fairness Act](https://www.beuc.eu/sites/default/files/publications/BEUC-X-2025-110_Towards_the_Digital_Fairness_Act.pdf) — 2 December 2025
14. [CCPA, Guidelines for Prevention and Regulation of Dark Patterns, 2023](https://ccpa.doca.gov.in/files/The%20Guidelines%20for%20Prevention%20and%20Regulation%20of%20Dark%20Patterns,%202023_1732707717.pdf) — 30 November 2023
15. [PIB, CCPA acts against dark patterns on digital platforms (2268302)](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2268302) — 3 June 2026
16. [Consumer Protection Act, 2019, sections 18 and 21](https://egazette.gov.in/WriteReadData/2019/210422.pdf) — 9 August 2019
17. [Consumer Protection (E-Commerce) (Amendment) Rules, 2026, rule 4(15)](https://egazette.gov.in/WriteReadData/2026/276125.pdf) — 9 September 2026 In force 1 January 2027.
18. [Digital Personal Data Protection Act, 2023, section 9(3)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) — 11 August 2023
19. [MeitY, DPDP framework (most duties from 13 May 2027)](https://www.meity.gov.in/data-protection-framework) — 13 November 2025

**Disclosure.** TechBag is a software reseller: it earns when companies buy through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [AI agents booked 4 Uber rides and about 500 orders in a week of 320 million trips](https://www.thetechbag.com/blog/uber-ai-agents-4-rides-500-orders) — How small buying through an AI agent still is: AI agents booked 4 Uber rides and about 500 orders in a week of 320 million trips.

Go deeper on TechBag

- [Retail obligations in India](https://www.thetechbag.com/industries/retail/obligations) — the CCPA Dark Patterns Guidelines and the E-Commerce Rules, with dates
- [OneTrust Consent & Preferences](https://www.thetechbag.com/onetrust/onetrust-consent-preferences) — consent records of the kind a trial-to-paid yes would need
- [Data security & privacy guides](https://www.thetechbag.com/browse/data-security-privacy) — the categories behind consent, privacy and data rights