EU proposes sweeping rules to outlaw manipulative app and website design

The European Commission on Wednesday proposed a new regulation aimed at banning the design tricks that steer people toward purchases, subscriptions and extended screen time online, in what the Commission describes as the broadest rewrite of European Union consumer-protection law in two decades. The measure, called the Digital Fairness Act, would apply to any company selling to consumers in the EU's 27 member states, regardless of where that company is based, according to the Commission's own description of the proposal.

The draft regulation singles out ten specific interface practices that would be treated as unfair "in all circumstances," meaning regulators would no longer need to prove consumer harm case by case before acting. According to reporting on the draft text, those practices include fake countdown timers and scarcity warnings during checkout, pre-ticked boxes that add products or higher quantities to a cart, cancellation flows made deliberately harder than sign-up, and pop-up notifications designed to look like a personal message when none was sent, as detailed in reporting on a leaked draft published two days before the announcement. The Commission would be able to add new banned practices to that list later without going back to lawmakers for a full legislative rewrite.

A single rulebook for every member state

The proposal would repeal the EU's 2005 Unfair Commercial Practices Directive, which each of the 27 member states transposed separately into national law, and replace it with a regulation that applies directly and identically across the bloc. The Commission's impact assessment projects €88.4 billion in reduced consumer harm between 2025 and 2035, against an estimated €678 million a year in recurring compliance costs for businesses, according to coverage of the proposal published the day it was unveiled. Penalties for violations could reach 6 percent of a company's worldwide annual turnover, with member states required to set a floor of at least 4 percent for their own enforcement, a figure confirmed in a detailed account of the draft circulated to EU correspondents.

A companion revision to the EU's Consumer Protection Cooperation rules would give the Commission itself the power to investigate major cross-border violations directly, rather than leaving enforcement entirely to national authorities. The draft's own preamble makes the underlying rationale explicit: such practices "may pressure, mislead or otherwise interfere with consumers' ability to take free and informed transactional decisions."

Who would be affected

The rules reach well beyond the handful of platforms already covered by the EU's Digital Services Act. Under the draft, any trader targeting EU consumers — a streaming service, a mobile game studio, a subscription-box retailer, an airline booking site — would need to let adult users switch off features "designed, or reasonably foreseeable, to encourage compulsive or excessive use," such as autoplay and streak-based engagement nudges. Subscriptions lasting six months or longer would require a renewal reminder sent one month to two weeks before the charge, plus an online cancellation option reachable in a few clicks, along with a guaranteed path to a human customer-service representative.

Video games face some of the most specific provisions. In-game currencies would have to display their real-money value and would be switched off by default for users under 18 unless a parent opts in. Paid loot boxes would need to disclose their odds and would be banned outright for minors, and pay-to-win mechanics that let players buy competitive advantages would be off-limits to anyone under 18. Advertising based on behavioral profiling would be banned whenever a trader has reason to believe the user is a minor, extending a restriction that currently applies only to the largest platforms under the Digital Services Act to every company doing business in the EU.

• Fake scarcity counters and repeated low-stock warnings during checkout
• Pre-selected add-on products or inflated quantities in a shopping cart
• Cancellation processes made deliberately harder than signing up
• Pop-up alerts designed to resemble a personal contact that was never sent
• Free trials that convert to paid subscriptions without a fresh, active consent

Industry pushes back, advocates want more

The proposal arrives after more than a year of lobbying from both directions. Industry groups including DigitalEurope wrote to the Commission in March arguing the law should be "reset" around simplification and better-regulation principles rather than layering new obligations onto existing EU tech rules. Game developers, including larger studios, have specifically criticized the real-money-value display requirement for virtual currencies as technically unworkable for complex in-game economies.

On the other side, more than 200 civil-society and consumer organizations had pressed the Commission to deliver an "ambitious" law rather than a watered-down one, and Germany's government circulated a position paper in October arguing the Commission had not sufficiently justified converting a directive into a directly binding regulation. The tension between those camps is likely to shape the next stage of negotiations, which will play out in the European Parliament and among the Council of the EU's member-state governments.

What happens next

Wednesday's announcement is a proposal, not a finished law. It now enters the EU's ordinary legislative procedure, in which the European Parliament and the Council — the body representing national governments — must each agree on a text before any final version can be adopted, a process tracked on the Parliament's own legislative-tracking page. Analysts who have followed the file do not expect the Digital Fairness Act to take effect before the end of 2028 at the earliest, and the Commission's own materials indicate the regulation would apply 12 months after it formally enters into force. For now, the practices the draft targets — countdown timers, pre-ticked boxes, loot boxes sold to minors — remain legal across the EU, and companies that rely on them have roughly two years, at minimum, to make their case to lawmakers before any of it becomes binding.