EU Proposes Digital Fairness Act: Six Percent Fines for Dark Patterns

The European Commission has proposed a new consumer protection regime, the Digital Fairness Act (DFA), that would fine tech companies up to six percent of their annual global revenue for deploying manipulative online practices against consumers, according to a draft copy of the legislation.

The proposal, announced in a news release from the EU Commission, aims squarely at a cluster of practices that regulators say harm children and push users into spending more than they intend. The list includes unclear pricing, addictive design features, advertising aimed at minors, and so-called "dark patterns" — interface techniques that manipulate user choices, such as subscriptions engineered to be difficult to cancel.

The stakes for the industry are considerable. A penalty ceiling of six percent of annual global revenue places the DFA among the EU's most financially threatening enforcement tools, in the same order of magnitude as the Digital Markets Act, which can impose fines of up to ten percent of global turnover. For the largest platforms, compliance will be cheaper than the alternative.

What does the proposal actually ban?

The act targets several concrete categories of conduct, according to the Commission's announcement:

• Dark patterns. Deceptive interface designs, including hard-to-cancel subscriptions, would be prohibited outright.

• Addictive design features. Consumers would gain the right to switch off design elements that "encourage excessive or compulsive spending."

• Unclear pricing. Online pricing for cultural and sports events would have to become clear and transparent.

• Practices targeting minors. Unfair practices that encourage overspending by children would face restrictions, including pay-to-win mechanics in games — most notably loot boxes, the randomized virtual items that players purchase without knowing their contents — and persistent in-app prompts.

• Influencer marketing. Content creators would be required to disclose commercial content transparently.

• Personalized ads and prices. Unfair personalized advertising and pricing that targets minors would be restricted.

• Subscription traps. Recurring-payment schemes that are difficult to exit would be banned.

The loot box provision is the most commercially significant item for the games industry. Randomized purchasable rewards have generated billions in revenue for major publishers, and several EU member states have already scrutinized them under gambling law. A bloc-wide prohibition on selling such mechanics to minors would force publishers to either verify ages rigorously, redesign monetization, or remove loot boxes from European markets entirely.

What did the EU's justice chief say?

EU justice chief Michael McGrath framed the proposal as a defense of fair competition, not an attack on business. "Our consumer protection rules will help ensure that businesses compete on the merits of their products and services, not on their ability to exploit consumers or their ability to evade the rules," McGrath said in a statement.

He also offered a line calibrated to pre-empt industry pushback: "We are not making it harder to do business, we are making it harder to do business unfairly."

The rhetorical positioning matters. The Commission has repeatedly faced accusations — from US tech firms and some American officials — that its regulatory agenda disproportionately burdens foreign companies. McGrath's framing casts the DFA as a leveler: a rule that rewards products which win on quality rather than on manipulation.

Why shift enforcement powers to Brussels?

Alongside the substantive bans, the proposal contains a structural reform with long-term consequences. Enforcement power would move from individual member states toward a more centralized system operating under the Commission.

Under the draft, the Commission would gain direct powers to investigate large-scale cases with a major impact on consumers. It would also speed up enforcement coordination with member states and strengthen its hand against non-EU companies, which have historically been harder to reach through fragmented national regulators.

Two motivations plausibly sit behind this centralization, and both are visible in the current enforcement landscape.

First, the existing system is a patchwork. Enforcement today varies country by country across Europe — France, for example, pursues cases under its own consumer framework, producing inconsistent outcomes for identical corporate conduct across the single market. A centralized regime would eliminate that variance.

Second, the shift could tilt regulatory power away from Ireland. The country hosts the European headquarters of major tech giants including Apple, Google, Meta and Microsoft, and its regulators have served as a primary gatekeeper for EU enforcement against those firms. A recent report from UN experts raised concerns about the independence of Ireland's privacy regulator, citing the risk of "undue influence" from the tech firms hosted there. Moving consumer protection enforcement to Brussels would reduce the role of national authorities that sit, geographically and economically, closest to the companies they police.

How large is the exposure for tech companies?

The six percent figure is the proposal's sharpest edge. Applied to the revenue of the largest platforms, it converts consumer protection from a reputational concern into a material financial risk. Companies found to run subscription traps, dark-pattern cancellation flows or minor-targeted loot boxes would face exposure calculated on global income, not merely on their European business.

The breadth of the target list also matters. The DFA does not confine itself to one sector: gaming studios, streaming services, e-commerce platforms, event ticketing companies, and influencer-driven marketing businesses all fall within its scope. Personalized pricing aimed at minors, for instance, touches advertising technology and retail simultaneously. The influencer transparency requirement extends obligations from platforms to individual creators, a population that has largely escaped direct regulatory duties until now.

What happens next?

The proposal now enters the EU legislative process, which requires approval by both the European Parliament and the Council of the EU before the DFA becomes law. That negotiation typically produces amendments to penalty levels, definitions and enforcement mechanisms, meaning the six percent ceiling and the exact scope of the loot box restrictions remain subject to change.

For technology companies operating in Europe, the direction is nonetheless clear. The Commission has now proposed binding, financially severe rules against design practices — addictive loops, manipulative interfaces, exploitative monetization of children — that the industry has treated as standard practice for a decade. Firms that monetize through engagement mechanics and recurring subscriptions will need to audit those systems against the DFA's categories before the enforcement regime, and its centralized new powers, arrive.