On 11 November 2026 the European Commission adopted its proposal for a Digital Fairness Act (DFA), carried by Justice and Consumer Protection Commissioner Michael McGrath. According to the independent DFA tracker, it is a Regulation that would repeal and replace the 2005 Unfair Commercial Practices Directive. It reaches dark patterns, addictive design, influencer marketing, unfair personalisation, subscription traps and pricing, and paid loot boxes for minors. The tracker says the draft allows Commission fines of up to 6% of worldwide annual turnover in cases the Commission investigates. We have not been able to read the adopted text directly, so what follows rests on those secondary summaries.
The strongest case for the Act
The case for acting is serious. The Commission's Digital Fairness Fitness Check, published in October 2024, examined the Unfair Commercial Practices Directive, the Consumer Rights Directive and the Unfair Contract Terms Directive. Lewis Silkin's summary reports that harmful online commercial practices cost EU consumers at least €7.9 billion per year. It reports compliance costs for business of no more than €737 million per year. That is roughly a ten-to-one ratio of consumer harm to compliance cost, and it is the best argument for legislating.
The five problem areas the check named were dark patterns, addictive design, personalised targeting, digital subscriptions and influencers. TechTimes also attributes to the review a finding that 97% of examined sites and apps used at least one dark pattern. We could not trace that figure to the underlying study, so it should be treated as indicative.
There is also a genuine gap in coverage. The Digital Services Act already bars manipulative interface design on online platforms under its Article 25 (Regulation (EU) 2022/2065). It does not reach every trader. A gym chain, a streaming service or a game studio running its own sign-up flow can fall outside the DSA's platform duties while still using a cancellation maze. TechTimes notes the DFA is meant to cover traders the DSA does not reach. Closing that gap is legitimate, and it is a narrower task than regulating the internet's design.
Where the proposal is right to be restrained
One choice deserves credit. The tracker reports that the DFA does not propose a blanket ban on infinite scrolling or autoplay. Those features have legitimate uses in news, music, video and accessibility, and a design-level ban would have frozen product practice around a political fear. Targeting specific harms, such as a required "terminate the contract here" button for subscriptions, is proportionate. A consumer who signed up with one click should be able to leave with one click, and compliance is simple to specify and simple to audit.
The loot box provision is similarly defensible as a child-protection measure. The tracker reports a prohibition on paid loot boxes and other paid variable-reward systems for minors, with paid virtual currencies disabled by default for minors. Defaults and age-specific limits are less intrusive than bans on the underlying game mechanics for adults.
Where the risk lies
The first risk is the definition of "unfair personalisation" and "addictive design." Personalisation is also how a small shop shows a relevant product, how a language app adapts to a learner and how a news service surfaces local stories. A rule that penalises personalisation which exploits vulnerabilities is reasonable. A rule that leaves firms guessing which recommendation systems count as exploitation invites over-compliance, with products made worse to avoid risk. The final text should anchor the test in demonstrable consumer detriment, not in the mere presence of a feature.
The second risk is the fine ceiling. A 6% turnover maximum mirrors the DSA's top tier, but the DSA applies to very large platforms and the DFA touches every subscription business in the Single Market. The tracker also says national regimes must provide maximum fines of at least 4% of annual turnover for cross-border infringements. For a venture-backed startup, an ambiguous design rule backed by a fine of that size is a deterrent to launching in Europe at all. Penalty ceilings should be matched by clear safe harbours, published guidance and proportionality language that distinguishes deliberate deception from honest design error.
The third risk is the cumulative stack. Firms serving EU users already operate under the GDPR, the DSA, the Digital Markets Act and the AI Act. TechTimes reports that enforcement powers under the DFA are disputed, and that is a warning sign. If national authorities and the Commission interpret one design duty differently, small companies bear the cost of the disagreement. A single, well-defined enforcement path matters more than a high maximum fine.
What to watch
The tracker says the Act would apply 12 months after entry into force, which in turn is 20 days after publication in the Official Journal. That gives Parliament and Council a long negotiation first, and there is time to fix the drafting. Three tests should guide it. First, can a mid-sized trader tell from the text whether a given interface is lawful? Second, are penalties scaled to intent and harm? Third, does the Act consolidate duties already spread across the DSA and consumer directives instead of stacking another overlapping layer?
The evidence supports acting against subscription traps, deceptive countdowns and manipulative defaults. It supports acting on children's exposure to paid randomised rewards. It does not support vague standards enforced with the heaviest fines in EU digital law. The Commission has aimed at the right target. The negotiation should be used to sharpen the definitions so that honest firms can build confidently and manipulative ones cannot hide.