Fines of six percent of global revenue are the kind of number that gets a legal department’s attention. That’s what the EU is putting behind its new push against dark patterns, and it should make every app with a maze-like cancellation flow a little uneasy.
The European Commission released a proposal for the Digital Fairness Act (DFA), a set of consumer protection rules aimed at practices that harm children and nudge people into spending more. The list includes unclear pricing, addictive design features, ads aimed at minors, and hard-to-cancel subscriptions. Loot boxes and pay-to-win mechanics aimed at minors would be restricted, as would persistent purchase prompts. Users would also get the right to switch off design features built to encourage compulsive spending.
The act also covers influencer marketing, requiring creators to be transparent about commercial content. It would go after unfair personalized ads and personalized prices that target minors. And it would force clear online pricing for cultural and sports events, a category where drip pricing has been a long-running annoyance.
EU justice chief Michael McGrath said the rules will help businesses compete on the merits of their products, not on their ability to exploit consumers or evade rules. “We are not making it harder to do business, we are making it harder to do business unfairly,” he said. That’s a tidy line. Whether it holds depends on enforcement, and that’s where this gets interesting.
The Commission wants to shift enforcement from member states to a more centralized system. It would get direct powers to investigate large-scale cases with major consumer impact, speed up coordination with national authorities, and strengthen action against non-EU companies. Today, enforcement is a patchwork. France moves one way, other countries move slower or not at all.
There’s also a political subtext. Ireland hosts Apple, Google, Meta and Microsoft, and its regulators have long been criticized for going easy on them. A recent report from UN experts raised concerns about the independence of Ireland’s privacy regulator, citing the risk of “undue influence” from the tech firms based there. Centralizing power in Brussels looks, at least partly, like a way around that problem.
For users, the privacy angle is real even though this isn’t a privacy law. Dark patterns are how companies extract consent, data and money from people who didn’t mean to give any of the three. Personalized pricing and targeted ads aimed at kids depend on profiling. Limiting them cuts into the data-driven business model itself.
Still, this is a proposal, not law. It will face heavy lobbying, and the GDPR taught us that strong text can be undermined by weak enforcement. The test is whether the Commission actually uses those new direct powers, and against whom.