EU Digital Fairness Act Proposal: What the Official Text Contains and What Changed From the Leaks

The European Commission formally adopted its proposal for a Digital Fairness Act on November 11, 2026, turning weeks of leaked drafts into an official legislative text. Published as COM(2026) 1100 under procedure 2026/0356 (COD), the proposal would replace the 2005 Unfair Commercial Practices Directive with a directly applicable regulation and add a new chapter on “digital fairness” covering dark patterns, influencer marketing, personalised advertising and pricing, game currencies, addictive design and online subscriptions. It arrived as part of a consumer package alongside a revised Consumer Protection Cooperation (CPC) Regulation and a separate simplification directive.

From leaks to an official proposal

Before the adoption, coverage relied on leaked drafts, including our earlier look at what the leaked Digital Fairness Act drafts suggested teams should audit. The Commission has now published the proposal, its annexes, an impact assessment and a factsheet on its Digital Fairness Act page. Much of what leaked survived. Several details are narrower, more conditional or placed in a different instrument than early reports suggested.

The ten dark patterns on the official blacklist

Article 10 sets a general rule: traders must not design, organise or operate online interfaces in a way that is likely to deceive or manipulate consumers or otherwise materially distort their economic behaviour. Part III of Annex I then lists ten practices that are unfair in all circumstances, numbered 53 to 62 in the proposal and its annexes. In plain terms, they are:

• false claims about a product’s availability or popularity, or hiding the conditions behind such claims;
• scarcity or popularity messages shown persistently throughout the ordering process;
• default options the consumer must reject that add payment for an extra product, a different quantity or a different product;
• presenting the option to decline a purchase or a continued supply as the wrong choice;
• creating the false impression that the prominently featured option is the only one;
• repeatedly asking consumers to make or change a choice they have already made, unless the trader needs to do so to meet a legal requirement;
• misleading or ambiguous wording in choices, including reversed framing and double negatives;
• showing the price, contract duration or automatic renewal with less prominence than other material information;
• notifications that falsely suggest someone contacted the consumer or that a matter needs attention;
• making it disproportionately harder to refuse, withdraw or change a choice than is reasonably necessary.

The Commission can expand or modify the list by delegated act as technology and enforcement experience develop. One difference from the leak coverage is worth noting. Earlier reporting described a ban on cookie and data-sharing prompts that frame refusal as the wrong choice. The official list does not mention cookies by name. The general wording on wrong-choice framing, re-prompting and confusing language would still capture many manipulative dark patterns in consent flows, and the ePrivacy and GDPR rules continue to apply alongside it.

Minors, profiling and personalised prices

Some early summaries said the proposal extends the Digital Services Act’s ban on targeting minors from very large platforms to all websites and apps. Article 28 of the DSA already covers all online platforms, not only the very large ones. What the Digital Fairness Act does is extend a similar rule to every trader. Under Article 12, traders may not target ads based on profiling using a consumer’s personal data where they know “with reasonable certainty” that the consumer is a minor. Online platforms already covered by the relevant DSA section are excluded, so the two rules do not overlap. Article 12 also bans profiling-based ads that use special categories of personal data under Article 9(1) GDPR, such as health or religious data, whatever the consumer’s age. Traders are not required to collect extra data to work out whether someone is a minor.

Personalised pricing is treated more narrowly than some leak coverage implied. Article 13 does not ban personalised prices outright. It prohibits prices personalised through profiling in a way “reasonably likely to cause harm” where the trader knows with reasonable certainty that the consumer is a minor or vulnerable. Comparable debates are under way elsewhere, including California’s proposals on surveillance pricing under Assembly Bill 446.

For games and in-app economies, the proposal requires virtual currencies to show the real-money value of items, turns paid virtual currencies off by default for minors unless a parent or guardian approves, requires odds disclosures and an off switch for paid loot-box style “variable reward systems”, and bans those systems and pay-to-win or pay-to-progress mechanics for minors. Several of these provisions defer to a separate proposal referred to in the text as the EU KIDS Act where social networks, video-sharing platforms and AI companions are concerned.

Addictive design, influencers and pricing displays

Article 17 does not ban engagement features. Where a digital product is designed in a way intended or reasonably foreseeable to encourage compulsive or excessive use, traders must give consumers easy tools to switch off, one by one or all at once, four kinds of feature: autoplay and endless content without regular breaks, notifications unrelated to the user’s own activity, streak-style rewards with penalties for missing a day, and features that simulate personal relationships, such as persistent prompts to keep talking to an automated system.

Influencer marketing gets its own article. Each commercial post must be labelled explicitly as an “advertisement” or a “commercial collaboration”, and the brand paying for it must make sure by contract that the influencer complies. Influencers may not urge minors to buy products or pressure their parents, and may not promote products that are banned from advertising or dangerous.

On prices, the blacklist now covers reference-price comparisons where the reference is not a competitor’s actual current price, and prices shown without all unavoidable fees at the first stage. Event ticket sellers using dynamic pricing must disclose how many tickets are available at the advertised price and the maximum price. Virtual queues must show the current price in real time and the highest possible price.

Subscriptions, cancellation and AI shopping agents

The contract rules are the most operational part of the text. Product, billing and support teams should note five obligations:

1. Free trials. Traders must send a reminder on a durable medium before a free trial ends. If they do not, or if the consumer does not expressly agree to continue on a paid basis, the consumer is not bound by the paid contract.
2. Renewal reminders. For online contracts of six months or more, a reminder is due between one month and 14 days before automatic extension. Missing it lets the consumer cancel free of charge at any time until it is sent. Shorter contracts need a reminder before they reach six months or their tenth renewal.
3. A labelled termination function. Any trader that lets consumers sign up online must offer a prominent “terminate the contract here” function, followed by a “confirm the contract termination” step and an acknowledgment within a week, whatever channel was used to sign up.
4. A withdrawal button. A similar “withdraw from contract here” function must stay available throughout the statutory withdrawal period for online distance contracts.
5. A human contact. Where online customer service is offered after purchase, consumers must be able to reach a human on request when other channels are not working.

US companies will recognise much of this from state automatic-renewal enforcement, such as HelloFresh’s $7.5 million California settlement. The proposal also anticipates AI agents that shop for people. Traders offering such automated systems must let consumers choose on first use whether to confirm every contract, only certain contracts within limits such as a maximum price, or none. They must also disclose any payments or conflicts of interest behind the contracts the system proposes.

Fines: 6% of turnover, but only in Commission cases

Reporting on the package has sometimes described the maximum penalty as 6% of global profits. The official texts say turnover. Article 35 leaves penalties mainly to member states, with a maximum of at least 4% of the trader’s annual turnover in the member states concerned in coordinated cross-border cases, or at least EUR 2 million where turnover data is unavailable. The 6% figure applies only where the Commission itself investigates under the revised CPC Regulation. The Commission’s CPC revision page describes those as “very large-scale cases” with a major impact across the single market, and adds that non-EU traders would need to appoint an EU representative. Teams already familiar with the GDPR Article 27 representative requirement will recognise the model.

The road ahead in Parliament and Council

Nothing changes legally today. The proposal goes through the ordinary legislative procedure, which means the European Parliament and the Council must each adopt positions and then agree a common text. The proposal cites Parliament resolutions calling for action on addictive design, but some member states and industry groups favour a lighter touch. Expect lobbying over the “reasonable certainty” knowledge standard, the delegated power to add dark patterns, and how much enforcement shifts to Brussels. Once adopted, the regulation enters into force 20 days after publication and applies 12 months later. Realistically, that points to 2028 or later.

The Commission’s impact assessment estimates yearly consumer savings of EUR 13.7 billion, including time losses, against recurring business costs of about EUR 1.2 billion before adjustment for overlaps. The DFA sits alongside the DSA, the Digital Markets Act, the AI Act and the GDPR, part of Europe’s wider digital rulebook, and the text says it is without prejudice to those laws.

Frequently asked questions

Does the official text differ much from the leaked drafts?

The structure matches, but several rules are conditional. Personalised pricing is banned only where it is likely to cause harm to minors or vulnerable consumers the trader knows about, and addictive features need off switches rather than removal.

Who decides the fines?

National authorities in most cases. The Commission could fine up to 6% of worldwide annual turnover only in large cross-border cases it investigates itself under the revised CPC Regulation, which is a separate proposal.

Do companies need to verify ages to comply?

No. The ad and pricing rules apply where the trader knows with reasonable certainty that a user is a minor, and the text says traders do not have to process extra personal data to find out.

The interface is now the contract

The Digital Fairness Act moves consumer law from the terms and conditions page to the screen itself. Buttons, labels, reminders and notification settings would carry legal obligations of their own. The text can still change in negotiations, but it already shows where EU enforcement is heading, and teams that read the proposal against their own sign-up and cancellation flows now will be better prepared when the final version arrives.