EU Digital Fairness Act: Fines Up to 6% of Global Turnover

Fines of up to 6% of worldwide annual turnover — that's the number sitting at the end of the European Commission's proposed Digital Fairness Act, and it's the stick behind one of the broadest consumer-protection instruments Brussels has drafted in years. For any enterprise selling to European consumers, the DFA touches everything from checkout flows to AI agents to loot boxes.

The Regulation covers business-to-consumer commercial practices before, during and after a transaction, treating goods, services and digital content alike as a "product". It defines a minor as anyone under 18. The core unfairness test stays familiar: a practice is unfair if it breaches professional diligence and materially distorts consumer behaviour.

What gets banned outright?

Dark patterns, for starters. Traders may not design online interfaces — visual and auditory components included — in ways likely to deceive or manipulate consumers. An anti-circumvention rule goes further, barring traders from undermining compliance through contractual, technical or behavioural techniques or interface design. Where the DSA, GDPR, AI Act, Digital Markets Act or the proposed EU KIDS Act already regulates an aspect, those laws prevail.

Influencer marketing gets its own rulebook. Traders must disclose the commercial intent of each communication using the terms "advertisement" or "commercial collaboration", and on DSA-covered platforms they must use that law's disclosure functionality. The Act prohibits:

• directly exhorting minors to buy products or persuade their parents to buy them;
• creating the impression of non-commercial purpose, especially in content featuring minors;
• implying a product is suitable for minors when it is not;
• promoting products whose advertising is prohibited or that are dangerous.

Any trader hiring influencers must ensure compliance through contractual terms, or other appropriate means where no contract exists.

What does this change for advertising and pricing?

Profiling-based targeted advertising is barred in two cases: when the trader knows with reasonable certainty the consumer is a minor, and when the trader uses GDPR special categories of personal data. Traders don't have to collect extra data to verify age. DSA-covered online platforms are excluded. Personalised pricing based on profiling is restricted where it's reasonably likely to harm a minor or a consumer made vulnerable by age, credulity, disability or misfortune.

Dynamic ticket pricing faces disclosure duties. Sellers of event tickets whose prices can rise through a trader's actions or algorithms must disclose how many tickets remain at the advertised price and the maximum price. Resellers must display the original total price plus category, row and seat number. Virtual queues must show the current price in real time, whether it may vary, and the cap.

Gaming and addictive design

Three gaming rules stand out. Virtual currencies must display the monetary value of purchased items and must be disabled by default for minors, activated only with parental or guardian approval. Variable reward systems such as loot boxes must disclose item types and probabilities, offer disable tools, and cannot be offered to minors. Pay-to-progress and pay-to-win mechanisms are off-limits for minors entirely. Social networks, video-sharing platforms, AI companions and general conversational chatbots fall outside parts of these rules where the EU KIDS Act applies instead.

Addictive-design obligations apply to traders whose products encourage, or can foreseeably encourage, compulsive or excessive use. They must provide easily accessible tools letting consumers disable, individually or all at once:

• autoplay and uninterrupted consumption without regular interruption points;
• notifications not triggered by the consumer's own activity;
• features rewarding engagement at regular intervals, including penalties for disengagement;
• features simulating interpersonal relationships, such as persistent prompts toward an automated system.

The Commission can add or modify features through delegated acts. DSA authorities supervise online platforms; AI Act authorities supervise AI providers and deployers.

Subscriptions: reminders and a mandated button

Free trials require a reminder on a durable medium before expiry, stating end date, price and termination terms — without it, or without the consumer's express agreement, the consumer isn't bound. Contracts of six months or longer need reminders between one month and 14 days before auto-extension, or consumers can terminate free of charge anytime. Contracts under six months need a reminder one week before the extension reaching six months, or before the tenth extension, whichever comes first.

Termination must be a two-click affair: a button labelled "terminate the contract here", then "confirm the contract termination", with acknowledgement within one week. A separate "withdraw from contract here" button must stay available through the withdrawal period.

AI agents under consent settings

Online customer service must offer a human on request when other channels fail. Automated systems concluding contracts on consumers' behalf face a first-use choice: confirm all contracts, confirm only those meeting a maximum price and time limit, or confirm none — confirmed on a durable medium, changeable anytime. The system must disclose any payment or conflict of interest, triggering confirmation regardless of settings. Authentication can run through the European Business Wallet or European Digital Identity Wallet; traders cannot require consumers to use automation. Financial services are excluded.

Enforcement and the bottom line

Member States must provide adequate, effective enforcement, including action by organisations and competitors. Courts can order cessation without proof of loss, intent or negligence. Consumers can claim compensation, price reduction or termination. Courts can compel disclosure of evidence on the design, operation and impact of online practices — and refusal to disclose can itself help establish unfairness.

Penalties: at least 4% of annual turnover in the Member States concerned, or at least 2 million euros where turnover data is unavailable. For widespread cross-border cases, the Commission can go to 6% of worldwide annual turnover. EU KIDS Act authorities enforce the minor-focused gaming rules.