EU Commission introduces Digital Fairness Act to restrict unfair online trade practices

On Wednesday, 11 November 2026, the European Commission introduced its proposal for a Digital Fairness Act (DFA), alongside a major revision of the Consumer Protection Cooperation Regulation (CPC Regulation), to modernise consumer safeguards and establish parity between online and offline protections across the EU Single Market.

Central to the DFA are sweeping measures addressing data protection, digital surveillance, and online manipulation, designed to curb practices that compromise personal autonomy and data-driven profiling. The draft legislation prohibits manipulative interface designs, known as dark patterns, designed to pressure consumers into unwanted transactions. It also restricts unfair personalised advertising and dynamic pricing algorithms that target minors or exploit sensitive personal data, curbing intrusive profiling models used to extract commercial concessions.

Under the DFA's fairness-by-design requirements, platforms must enable users to switch off addictive design features, such as persistent prompts that encourage compulsive spending. In addition, the proposal requires transparent real-time pricing where dynamic pricing is used for events, and establishes consumer rights when purchasing via artificial intelligence (AI) agents to ensure customers have access to human customer service representatives.

Accompanying reforms under the CPC Regulation significantly expand the EU's enforcement powers against cross-border digital misconduct. The Commission will have direct authority to investigate large-scale infringements and impose fines reaching up to 6% of an infringing company's annual global turnover. 

Projected to save EU consumers up to €13.7 billion annually, the proposals now advance to the European Parliament and the Council of the European Union for legislative scrutiny.

Training Announcement: Find out more about our range of independent accredited qualifications from BCS and IAPP. These include professional certifications for practitioners covering data protection and AI governance, information security and risk management, along with access to public information.