Brussels, BELGIUM – The European Commission today proposed its Digital Fairness Act (DFA), aiming to strengthen online consumer protection. While the planned EU-wide regulation might help reduce divergence across EU Member States, it introduces overlapping obligations, parallel enforcement, and unnecessary complexity before current rules have been fully enforced, warns the Computer & Communications Industry Association (CCIA Europe).
Only last week, the Commission’s 2027 work programme emphasised the implementation and enforcement of existing laws, with President von der Leyen calling for “streamlined policies” and Commissioner Dombrovskis promising “less red tape and complexity.”
Yet the DFA introduces new requirements in areas already covered by the Digital Services Act (DSA), the Consumer Rights Directive, and the General Data Protection Regulation (GDPR) – including deceptive design (‘dark patterns’), addictive design, and personalised advertising. These rules, however, have yet to be consistently enforced across the EU.
The recently proposed EU KIDS Act also targets addictive design, further highlighting duplication risks. Moreover, reopening EU consumer law through a 40-article regulation risks further regulatory inflation by EU co-legislators, at odds with the Commission’s recent pledge.
Specific measures in today’s proposal raise serious privacy concerns. The DFA’s expanded definition of ‘vulnerable consumers’ now includes personal “misfortune” and circumstances that “impair the consumer’s judgment” – such as addictions and financial distress – while platforms are “reasonably [expected to] foresee” such vulnerabilities, creating legal uncertainty. In practice, this could force digital services to monitor users’ behaviour and process sensitive personal information, conflicting with core GDPR principles such as data minimisation.
The DFA also creates a complex enforcement landscape, with multiple authorities overseeing similar practices under different regulatory frameworks. Rules on AI chatbots and agents, addictive design, and personalised advertising would fall under overlapping national and EU authorities, including data protection, consumer protection, and market surveillance bodies. This will lead to inconsistent enforcement and heavy compliance burdens. In Commission-led cases, DFA fines could reach 6% of global annual turnover.
CCIA Europe urges EU lawmakers to prioritise implementing and enforcing existing laws, alongside cross-border cooperation through the proposed revision of the Consumer Protection Cooperation (CPC) framework, rather than making the EU rulebook even harder to navigate.
The following can be attributed to CCIA Europe’s Policy Manager, Albane Vannier:
“The Commission’s expanded definition of ‘vulnerable consumers’ remains vague, dynamic, and subjective. Businesses need far more clarity on how they are expected to identify consumers’ vulnerabilities without compromising their privacy or risking GDPR liability.”
“The Digital Fairness Act creates an enforcement maze. Having multiple national and EU authorities oversee very similar practices under different EU laws is a recipe for inconsistent enforcement and unnecessary compliance costs.”
The following can be attributed to CCIA Europe’s Head of Policy and Deputy Head of Office, Alexandre Roure:
“Just days ago, the Commission formally pledged to prioritise implementing and enforcing the rules already on the books. Yet this Digital Fairness Act risks opening Pandora’s box for EU co-legislators, inviting further regulatory inflation and enforcement incoherence.”
“EU lawmakers should not use the DFA to restrict or ban legitimate commercial practices that benefit consumers. As drafted, the ban on repeatedly prompting users to reconsider a choice could even capture reminders to enable multi-factor authentication, check security warnings, or review privacy settings.”
“What European consumers need is consistent enforcement of existing rules, not a legislative bidding war that creates legal confusion.”
