MLex reported on 23 September 2026 that the European Commission is now tentatively aiming for November, with 18 November among the dates considered, to unveil the Digital Fairness Act (DFA). Commissioner Michael McGrath, who is Irish, leads the file. The proposal had been slated for Q3 2026, then promised "before the end of the year". Ireland's Competition and Consumer Protection Commission (CCPC) and Coimisiún na Meán are the likely national enforcers. The slip is small. It still matters, because the hardest question in the DFA is who enforces it, and Ireland has not answered that.
The strongest case for the Act
The case for legislating is serious. The Commission's Digital Fairness Fitness Check, published on 3 October 2024, concluded that existing consumer rules remain "relevant and necessary". It also identified problem practices they handle poorly: dark patterns, addictive design, unfair personalisation and influencer marketing (Commission, review of EU consumer law). Law-firm summaries of the check say non-compliance with consumer law costs EU consumers at least €7.9 billion a year, against compliance costs for businesses of no more than €737 million (McCann FitzGerald).
The prevalence evidence points the same way. A 2022 Commission-funded behavioural study found that 97% of popular EU websites and apps used at least one dark pattern (Irish Times). Roach-motel cancellation, pre-ticked boxes and confirmshaming are not close calls. An honest free-speech and pro-innovation position should accept that interface tricks that defeat informed choice are a market failure, not an expression of consumer preference.
Where the real problem sits: layered law, unclear owners
The EU already regulates much of this. Article 25 of the Digital Services Act bars online platforms from designing interfaces that deceive or manipulate users. It carves out practices already covered by the Unfair Commercial Practices Directive or the GDPR (Springlex, DSA Article 25). The result is a patchwork. The same manipulative button can fall under consumer law, data protection law or the DSA, depending on what it does.
Ireland has already seen this overlap in practice. The Data Protection Commission fined TikTok €345 million, in a decision adopted on 1 September 2023 and announced on 15 September. After an EDPB binding decision, it recorded a GDPR Article 5(1)(a) fairness infringement relating to "dark patterns" (DPC press release). So Ireland's data regulator is already policing manipulative design through the GDPR. Under the DSA, Coimisiún na Meán is the Digital Services Coordinator. The CCPC is the competent authority for online-marketplace obligations under Articles 30 to 32, with DSA-level fines of up to 6% of global turnover (Mason Hayes & Curran). Adding a DFA enforced by the CCPC and Coimisiún na Meán would give Ireland three or four regulators with a claim over one interface.
Irish practitioners flagged this before the DFA existed. William Fry noted it was not clear how dark patterns would be investigated in practice, or whether the DPC would lead with Coimisiún na Meán assisting, or the reverse (William Fry). A new statute that adds a fourth enforcer without resolving this will not make dark-pattern enforcement faster.
What proportionate drafting looks like
The Commission's stated aims are to strengthen consumer protection "while ensuring a level playing field and simplifying rules for businesses" (Commission). Commissioner McGrath has said the Act is designed to address gaps in existing legislation and is "not meant to regulate specific types of online actors or technologies" (Privacy Laws & Business). That is the right framing, and the draft should be held to it. Four tests follow.
- Prohibit conduct, not design styles. Banning concrete behaviours, such as cancellation harder than sign-up or pre-selected paid add-ons, is enforceable and predictable. Vague bans on "manipulative" or "addictive" design invite litigation over every A/B test. They also push startups towards a bland compliance-driven interface.
- Fold in, don't stack. Where the DFA overlaps with the UCPD, Article 25 DSA or the GDPR, it should replace the overlapping provisions. It should not add a parallel regime with its own definitions.
- Keep speech and personalisation out of scope. Influencer disclosure is a legitimate transparency rule. Editorial content, recommendation and personalisation that users value should not be treated as manipulation merely because it works.
- Scale obligations. The Fitness Check's €737 million annual compliance burden is an average. For a ten-person Irish app developer, a new documentation regime costs far more as a share of revenue than it does for a multinational.
Use the extra weeks
The slip to November costs consumers little. They already have the UCPD, the GDPR and the DSA. A short delay is useful if it produces a tighter text. The Irish government should use the interval to publish a clear allocation of responsibility: which body takes the lead on a given interface complaint, how the DPC, CCPC and Coimisiún na Meán refer cases to each other, and how one investigation avoids three parallel ones. The TikTok decision shows Ireland can fine a large platform heavily for manipulative design. The unanswered question is whether it can do so consistently, and without duplicating effort, across the long tail of smaller services.
The case for the DFA rests on evidence of widespread consumer detriment. That evidence justifies targeted, conduct-based rules and one coherent Irish enforcement map. It does not justify another layer of broadly worded design mandates.