EU Digital Fairness Act Draws Industry Backlash Over Overlapping Rules

The European Commission has drafted a Digital Fairness Act (DFA) that would fine companies up to 6% of their annual worldwide revenue for unfair commercial practices online — and industry groups are already pushing back, warning of "regulation on top of regulation."

Reuters reported on the 9th that the Commission prepared the draft, which is scheduled for official release on the 11th. The bill targets the design and operation of online services that improperly influence consumers' purchasing and usage decisions. It would sit alongside the Digital Markets Act (DMA) and Digital Services Act (DSA), two laws that have already produced more than EUR 2 billion in fines against major technology companies.

The stakes are straightforward. The EU is attempting its most comprehensive overhaul of consumer protection in two decades while companies complain that overlapping obligations across at least four digital laws are raising compliance costs and legal uncertainty.

What would the Digital Fairness Act actually ban?

The draft legislation explicitly names a list of practices for regulation:

• Dark patterns (interface designs that manipulate user choices), including false low-stock alerts and automatically selected paid options
• Free-trial conversions into paid subscriptions without user consent
• Addictive design that encourages excessive service use among teenagers
• Promotional recommendations by AI shopping services

The fine ceiling of 6% of annual worldwide revenue matches the DSA's maximum penalty. The DMA goes further, allowing fines of up to 10% of global revenue, rising to 20% for repeat violations.

At the core of the proposal is a structural change to EU consumer law. The Commission wants to replace the Unfair Commercial Practices Directive (UCPD), enacted in 2005, with the DFA as a regulation — a legal instrument applied directly across all member states without national transposition. The stated aim is to reduce divergence in consumer protection standards across the bloc and strengthen supervision of online commerce.

The draft is not final. It must still pass through deliberations and negotiations in the European Parliament and the Council of the EU, and its specific provisions and implementation schedule may change during the legislative process.

The takeaway: a broad new enforcement tool is on the table, but its final shape remains open.

How much have the DMA and DSA already cost Big Tech?

The industry's unease rests on the enforcement record of the two laws already in force. The DMA became fully applicable in March 2024. It designates large companies operating core platform services — search engines, app stores, social media — as "gatekeepers" and restricts practices such as self-preferencing in search results, blocking external payment methods, and combining personal data without consent.

The fines have accumulated quickly:

• Apple was fined EUR 500 million in April last year for restricting App Store developers from directing users to external payment options
• Meta received a EUR 200 million fine for failing to guarantee users a meaningful choice over how their personal data was used
• Google was fined EUR 460 million for favoring its own services over competitors in search results, and EUR 430 million for restricting developers from directing Google Play users to external purchasing options, both in July

The DSA, fully applicable since February 2024, has produced its own penalties. The law requires platforms to report and remove illegal content, restricts targeted advertising to minors, mandates disclosure of advertiser and recommendation-algorithm information, and bans dark patterns. Platforms and search engines with more than 45 million monthly EU users face additional risk-assessment obligations.

Under the DSA:

• X was fined EUR 120 million in December for verification badges on paid accounts that misled users and for insufficient advertising disclosures
• Temu was fined EUR 200 million in May for failing to properly assess the likelihood of illegal and dangerous goods circulating on its platform
• AliExpress was fined EUR 550 million in July for failing to adequately assess and mitigate risks of counterfeit and illegal goods

The pattern is consistent: every major platform category — social media, app stores, search, e-commerce — has now absorbed a nine-figure or high-eight-figure EU penalty. What the fines have not yet produced is evidence on whether compliance changes deliver the consumer benefits the Commission projects.

Are smaller businesses paying the price for Big Tech compliance?

Compliance has also reshaped products. In September last year, Apple said the European rollout of certain features, including iPhone Mirroring and AirPods live translation, had been delayed because the DMA's interoperability obligations could raise security and privacy concerns. In September, Google revamped how it presents search results in Europe, increasing the visibility of specialized comparison services in searches for hotels, flights and restaurants.

Google argued the changes could reduce convenience for users and raise customer acquisition costs for local businesses. A Commission staff working document on the DMA evaluation lends that claim some support. Industry associations reported in the document that some retailers saw search traffic fall by 40–50% following Google's compliance measures. Small and medium-sized businesses in the accommodation sector reported declines of 20–30% in website visits or direct sales.

The mechanism matters. As smaller businesses lose direct booking and sales channels and grow dependent on external intermediary platforms, they face a greater risk of additional costs, including commissions. The businesses bearing these costs are precisely those the DFA's consumer-protection goals claim to serve.

The takeaway: the DMA's measurable effects so far include losses for small retailers, not only fines for gatekeepers.

Why does industry call the DFA redundant?

The EU already enforces multiple digital regulations in parallel: the DMA, the DSA, the AI Act and the Data Act. Some of these laws overlap in scope and obligations, forcing companies to review different regulatory requirements for the same service.

The overlap is sharpest on the DFA's core targets. Dark patterns, targeted advertising and recommendation algorithms are already partly regulated under the DSA and the General Data Protection Regulation (GDPR). Additional DFA obligations could require companies to overhaul operations from service design to advertising and sales practices.

Industry opposition is now formal. In March, leading business associations, including the European digital industry association DIGITALEUROPE, warned in a joint statement: "if the DFA adds new obligations in areas already regulated by existing EU legislation, legal uncertainty and compliance costs could increase." The groups argued specifically that extending DSA obligations from certain large platforms to online businesses more broadly, or adding detailed interface-design requirements, would raise compliance burdens regardless of company size.

That argument has force, but it is also self-interested. Neither the associations nor the penalized companies have offered evidence that existing DSA and GDPR provisions adequately cover the practices the DFA names — free trials converted without consent, for instance, sits outside the DSA's scope. The industry case against duplication is stronger than its implicit case that current rules suffice.

The takeaway: the overlap complaint is real, but the industry has not shown the DFA's target practices are already policed.

What happens next?

The draft's release on the 11th opens a legislative negotiation in the European Parliament and the Council, where both the fine levels and the scope of regulated practices can change. Companies already operating under DMA and DSA enforcement will now weigh a third compliance regime whose boundaries with existing law remain undefined — and whose final text will not be known for months.