On November 11, 2026, the European Commission (EC) published its proposal for a Digital Fairness Act (DFA), which would significantly reform the European Union (EU) consumer protection framework and introduce new restrictions on addictive design, influencer marketing, manipulative practices, unfair personalization, and in-game spending. As proposed, the DFA would provide the EC with direct powers to investigate and impose fines of up to six percent of worldwide annual revenue.

I. Context and rationale for the DFA

The DFA aims to modernize EU consumer law to reflect the fact that consumer choices are increasingly shaped by algorithms, personalization, and online design. It targets practices that existing laws do not directly address and would replace diverging national approaches with a single set of directly applicable EU rules.

The DFA would extend the Digital Services Act (DSA) requirements on dark patterns and targeted advertising to businesses beyond online platforms and complement the General Data Protection Regulation (GDPR) by regulating how traders may use profiling in their commercial practices.

II. General fairness rules adapted to the digital environment

The DFA would adapt core provisions of existing EU consumer protection rules—the general prohibition of unfair commercial practices, misleading actions and omissions, aggressive practices, and the list of practices considered unfair in all circumstances—to reflect the digital environment.

For example, services offered “for free” in exchange for personal data would be expressly covered, and the average consumer standard would take into account cognitive biases and online consumers’ limited capacity to process information due to information overload or limited digital literacy. The list of practices considered unfair in all circumstances would be updated to include “new” practices prevalent online, including dark patterns, aggressive commercial practices, and certain pricing practices.

1. Dark patterns, personalization, addictive design, and influencer marketing

The DFA would introduce new transparency and fairness obligations for businesses, in some cases replicating duties imposed on providers of online platforms under the DSA:

• Prohibit dark patterns. Businesses would be prohibited from designing, organizing, or operating online interfaces in a way that is likely to deceive, manipulate, or otherwise distort consumers’ economic behavior. Dark patterns prohibited in all circumstances would include fake scarcity claims, pre-ticked paid add-ons, confirm-shaming, repeated requests to change a choice already made, fake notifications, and disproportionately burdensome steps to refuse, withdraw, or change a choice. The EC would be able to supplement the list.
• Restrict personalized advertising for minors and sensitive data. Businesses would be prohibited from targeting ads to minors based on profiling or using sensitive data (such as health or sexual orientation) for profiling. This restriction would also cover personalized recommendations, rankings, and promotional messages, including through chatbots.
• Subject in-game spending features to increased transparency and minor-protection rules. Virtual currencies would have to show their real-money value. Products directed at or known to be used by minors would have to be disabled by default and require parental approval. Businesses would have to disclose the odds of loot boxes and provide an option to switch them off, and ban loot boxes and pay-to-win mechanisms for minors.
• Allow consumers to switch off addictive features. Businesses whose products encourage compulsive or excessive use would have to let consumers switch off features such as autoplay, streaks, unsolicited notifications, and chatbot prompts simulating personal relationships.
• Disclose influencer marketing. Posts would have to be labeled as “advertisement” or “commercial collaboration,” using the disclosure tool that the DSA requires of online platforms. Influencers would be prohibited from inciting minors to buy or promoting products that are banned from being advertised or are dangerous.
• Make available customer service with a human. Where a business provides online customer service after the conclusion of a contract, it would have to ensure that communication with a human being is made available at the consumer’s request, when other means are not effective.

2. Pricing, subscription, and automated contracting

The DFA would also introduce targeted rules for pricing and online contracts:

• Prohibit personalized pricing for minors and vulnerable consumers. Businesses would be banned from personalizing prices based on profiling in a way that is likely to cause harm, if there is a likelihood that the consumer is a minor or vulnerable. Personalization that benefits consumers, such as student or senior rebates, would remain permitted.
• Prohibit drip pricing and misleading price comparisons. The first price shown would need to include all unavoidable fees and charges. Crossed-out prices could refer only to a verifiable competitor’s price, or for secondhand products, the new price, and not to estimated or recommended prices.
• Rollover free trials only with express consent. Before a free trial ends, businesses would need to send a reminder to consumers. A paid contract would be valid only if the consumer expressly agrees.
• Require reminders before automatic extensions. Consumers would need to be reminded before any automatic extensions. If no reminder is sent, they could terminate the contract free of charge at any time.
• Enable online termination. Where contracts can be concluded online, a prominent “terminate the contract here” function would be required, available even if the contract was concluded offline. Termination notice would also need to be provided on a durable medium (for example, by email confirmation) and include the date on which it takes effect.
• Keep automated contracting under consumer control. Businesses offering automated systems that contract on consumers’ behalf would need to let consumers set parameters, such as a maximum price, and disclose any conflicts of interest. Where a contract is concluded solely between the business’s and the consumer’s automated systems, businesses would have to send the consumer a confirmation of the contract on a durable medium, in plain and intelligible language.

III. Next steps

The draft DFA must now go through the long EU legislative process. In particular, it must be negotiated and adopted by the European Parliament and the Council of the EU. No specific timeline has yet been set for those negotiations, but we expect them to last at least until the end of 2027 and likely to continue in 2028, if not further. The text may change significantly along the way, given that the draft has already drawn criticism from both business associations and consumer groups. Under the proposal, the DFA would apply 12 months after its publication.

In the meantime, businesses offering consumer-facing digital services in the EU should consider starting to assess the DFA’s potential impact on their services. This could include reviewing checkout, consent, and cancellation flows against the blacklisted dark patterns, and checking whether advertising or pricing relies on profiling of minors or sensitive data. Businesses currently preparing for the UK’s new subscription contracts regime under the Digital Markets, Competition and Consumers Act 2024, due to take effect in January 2027, may also wish to consider how their approach compares with the DFA’s subscription proposals.

For more information or with any questions regarding the DFA, please contact Cédric Burton, Jindrich Kloub, Deirdre Carroll, or Tom Evans from Wilson Sonsini’s Data, Privacy, and Cybersecurity and Antitrust and Competition practices.

Olga Kosno, Sebastian Lohmann Garcia, Bianca Tirnovan, and Anaïs Kattan contributed to the preparation of this alert.