On 11 November 2026, the European Commission published a consumer law package comprising three proposals: a Digital Fairness Act (“DFA”), a Directive simplifying certain consumer protection rules (“Simplification Directive”) and a new Consumer Protection Cooperation Regulation (“New CPC Regulation”). The DFA sets out the new substantive rules, the Simplification Directive trims existing ones, and the New CPC Regulation strengthens enforcement. Here is what the package would mean in practice for businesses and consumers.
The scenarios below are illustrative and modelled on practices that consumers and authorities already face today.
The situation: A fashion app shows “Offer ends in 4:59”, pre-ticks add-ons in the basket and greys out the decline button.
| Today | Under the DFA |
|---|---|
| The authority or the consumer must show, on a case-by-case basis, that the practice is misleading or aggressive. |
|
Why it matters: For practices on the list, traders can no longer argue that the average consumer was not affected and user experience design becomes a compliance matter.
The situation: An influencer with a teenage audience promotes a supplement with a hashtag buried in the caption, under a contract arranged by the brand’s agency.
| Today | Under the DFA |
|---|---|
| Liability for hidden advertising rests mainly on the influencer, under the general UCPD principles. |
|
Why it matters: Brands and agencies become responsible for compliance along the chain and compliance clauses in every influencer contract are therefore to be expected.
The situations:
| Today | Under the DFA |
|---|---|
| The ban on profiled ads to minors in the Digital Services Act (Regulation (EU) 2022/2065, “DSA”) applies only to online platforms, and personalised pricing is not specifically regulated. |
|
Why it matters: Ad-tech chains and pricing algorithms will need safeguards against targeting minors and against exploiting vulnerability.
The situations:
| Today | Under the DFA |
|---|---|
| There are no specific rules, and each practice is assessed under general commercial unfairness principles. |
|
Why it matters: Monetisation models aimed at children must be redesigned.
The situation: A short-video app combines infinite scroll, autoplay and daily “streak” rewards.
| Today | Under the DFA |
|---|---|
| There is no legal obligation to offer an off switch. | Adult consumers must be able to switch off features that encourage compulsive or excessive use (traders covered by the EU KIDS Act rules on minors are excluded), and the EU Commission can update the list of such features. |
Why it matters: Wellbeing tools become mandatory product features.
The situations:
| Today | Under the DFA |
|---|---|
| Disclosure is limited to general price information rules. |
|
Why it matters: Fans know the price ceiling before they commit, and bait pricing loses its effect.
The situations:
| Today | Under the DFA and the Simplification Directive |
|---|---|
| The trial usually converts automatically. Cancellation hurdles are challenged on a case-by-case basis as aggressive practices. |
|
Why it matters: Subscription traps stop generating revenue. Renewal and cancellation journeys must be rebuilt.
The situation: A consumer instructs an AI assistant to book a train ticket under EUR 50, and the assistant contracts with the rail operator’s booking bot.
| Today | Under the DFA |
|---|---|
| Consumer law is not designed for machine-to-machine contracting. |
|
Why it matters: This is a first EU framework for agentic commerce, with lighter formalities and new safeguards.
The situation: A reseller sends promotional SMS messages to people who never opted in, and its call centre cold calls them.
| Today | Under the DFA and the Simplification Directive |
|---|---|
|
The Directive 2002/58/EC (“ePrivacy Directive”) distinguishes three scenarios: (i) new contacts: direct marketing by automatic calling machines, fax or e-mail requires the recipient’s prior consent (opt-in); (ii) existing customers: a business that obtained a customer’s e-mail details when selling a product or service may use them to market its own similar products without prior consent, provided the customer can object free of charge when the details are collected and, in each message, (opt-out); and (iii) other channels (such as calls made by a person): each Member State chooses between opt-in and opt-out. Each Member State has transposed these rules with its own nuances, and they are mainly enforced by privacy and telecoms regulators. |
|
Why it matters: Marketing spam moves into EU consumer law so that consumers, consumer authorities, consumer associations and potentially the EU Commission can act directly and coherently against it.
The situation: A global marketplace uses fake discounts and forced gamification in all 27 Member States.
| Today | Under the DFA and the New CPC Regulation |
|---|---|
| National authorities coordinate under the Consumer Protection Cooperation Regulation (Regulation (EU) 2017/2394, “CPC Regulation”). In coordinated actions, UCPD requires Member States to provide for maximum fines of at least 4% of the trader’s annual turnover in the Member States concerned. |
|
Why it matters: Large (non-SME) traders face EU-level enforcement, while SMEs remain subject to national enforcement only and all traders gain recourse against their business partners, such as software suppliers.
| Legal text | Effect of the proposal |
|---|---|
| Directive 2005/29/EC (UCPD) | Repealed. Its general provisions, misleading and aggressive practices rules and blacklist are carried over into the DFA. The financial services, immovable property and doorstep-selling derogations are kept. |
| Consumer Rights Directive 2011/83/EU (CRD) | The DFA adds new rules on trials, renewals and cancellation and lightens formalities for fully automated contracts. The Simplification Directive also removes the dark-pattern rule for financial services and the withdrawal function, both moved into the DFA, deletes certain information duties, simplifies micro transactions and creates a one-month cancellation right for streaming subscriptions. |
| Directive 2002/58/EC (ePrivacy) | Protection against unsolicited direct marketing to consumers moves into the DFA. |
| Regulation (EU) 2022/2065 (DSA) | The ban on profiled ads to minors and on ads using sensitive data is extended to traders other than online platforms. The DSA prevails in case of conflict on specific aspects. |
| CPC Regulation (EU) 2017/2394 | To be repealed by the New CPC Regulation, which gives the EU Commission direct enforcement powers, sets time limits for coordinated actions, requires non-EU traders targeting EU consumers to appoint an EU legal representative and amends the passenger rights and geo-blocking regulations. |
No immediate compliance action is required as the package is only at proposal stage, and its content may change significantly before adoption. Businesses with consumer-facing digital activities may nonetheless wish to monitor the negotiations and identify at an early stage the features most likely to be affected (dark patterns, subscriptions, personalisation, in-game monetisation, influencer marketing…), so that any future redesign can be planned well ahead.
The three proposals now proceed through the ordinary legislative procedure, under which they must be negotiated and adopted by the European Parliament and the Council. Given the scope and political sensitivity of the package, adoption is unlikely to be quick. The EU Commission’s indicative timeline for the New CPC Regulation points to adoption in 2027 and application in 2028/2029, while the Simplification Directive would have to be transposed within 12 months of its entry into force. The DFA will set its own date of application in the final text. Stay tuned for further developments!