EU Digital Fairness Act Targets Dark Patterns

Nearly every popular website or app you use is built to manipulate you, and Brussels finally has the receipts. A 2022 European Commission study found that 97 percent of the most popular websites and apps used by EU consumers deployed at least one dark pattern, from hidden fees to fake urgency countdowns to unsubscribe flows designed to fail. Now the Commission is turning that evidence into a law. The Digital Fairness Act, expected to be tabled in the fourth quarter of 2026, is the EU's next major attempt to regulate the manipulative design techniques that shape how hundreds of millions of people shop, scroll, and consent online.

Key Takeaways

• The European Commission plans to table the Digital Fairness Act in Q4 2026, targeting dark patterns, addictive design, manipulative personalization, and misleading influencer marketing.
• A 2022 Commission study found 97 percent of popular EU websites and apps used at least one dark pattern, and the Commission's 2024 Digital Fairness Fitness Check estimated these practices cost EU consumers at least €7.9 billion per year.
• In April 2026, the Electronic Frontier Foundation published recommendations urging the Commission to ban pay for privacy schemes and treat surveillance based profiling as a core fairness problem, not just a data protection issue.
• The DFA follows the EU's April 2025 fines against Apple (€500 million) and Meta (€200 million) for Digital Markets Act violations tied to their pay or consent advertising models, showing regulators are already primed to act on this exact issue.
• Full adoption is likely years away, with Parliament and Council negotiation through 2026 and 2027 and staggered application expected between 2028 and 2030, so this is a rulemaking preview, not a rule in effect.

What Is the Digital Fairness Act?

The Digital Fairness Act is a forthcoming EU consumer protection law aimed at online practices that existing rules do not clearly address: deceptive interface design, addictive product features, exploitative personalization, and misleading marketing by social media influencers. It grew out of the Commission's Digital Fairness Fitness Check, a Staff Working Document published on October 3, 2024, which concluded that the EU's existing consumer protection framework, built mainly around the Unfair Commercial Practices Directive and the Consumer Rights Directive, remains broadly sound but has real gaps for problems that did not exist when those laws were written.

The Fitness Check put a number on the harm: at least €7.9 billion per year in financial harm to EU consumers from dark patterns, addictive design, and related digital practices. That figure, more than any single anecdote, is what turned a fitness check into a legislative commitment. Commissioner Michael McGrath, who leads the justice and consumer protection portfolio, has been tasked by Commission President Ursula von der Leyen with developing the proposal.

What Practices Would the Act Cover?

The DFA is expected to address five overlapping problem areas: manipulative interface design, addictive product features, unfair personalization, influencer marketing, and heightened protections for minors. Manipulative interface design is the broadest category and includes what dark patterns in email consent flows already illustrate at a smaller scale: pre checked consent boxes, confirmshaming language on decline buttons, countdown timers that reset, and cancellation flows deliberately built to be harder than signup flows.

Unfair personalization is the piece most relevant to anyone who has ever wondered why an ad seemed to know something private. The Commission's own framing describes this as personalized pricing and targeting according to tracking and profiling, language that puts behavioral profiling itself inside the scope of a consumer protection law rather than leaving it solely to the GDPR. Addictive design covers infinite scroll, autoplay, and notification patterns engineered to maximize time on a platform rather than serve the user's stated goal. Minors receive specific attention throughout, reflecting years of pressure on platforms over the psychological effects of algorithmic feeds on children.

Why Is the EFF Pushing for a Ban on Pay for Privacy?

The Electronic Frontier Foundation argues the DFA should explicitly prohibit business models that charge users money as the price of avoiding surveillance. In a May 2026 Deeplinks post responding to the Commission's consultation, EFF policy analyst Christoph Schmon put it directly: "Users should not have to trade their data or pay extra to avoid being tracked." The recommendation targets so called pay or consent schemes, where a platform offers a free ad supported tier that harvests personal data alongside a paid tier that promises less tracking, effectively pricing privacy as a luxury feature rather than a default right.

This is not a hypothetical concern. In April 2025, the European Commission fined Meta €200 million and Apple €500 million for Digital Markets Act violations connected to exactly this kind of pay or consent design. EFF's ask is that the DFA generalize the principle those fines already established under a narrower law: users should not have to choose between paying money and surrendering their data to companies that profit from tracking them. The organization also recommends supporting automated, browser and OS level privacy signals, so consent and refusal can be expressed technically rather than negotiated through a confusing pop up every time.

How Would This Affect Consent for Tracking and Profiling?

EFF's brief goes further than banning a specific pricing model. It argues that surveillance based profiling itself distorts digital markets by "rewarding data exploitation rather than quality of service," and that the DFA should treat unfair profiling and surveillance advertising as fairness violations, not just privacy violations subject to a separate consent framework. That reframing matters because it opens the door to remedies beyond the GDPR's consent mechanics: bans, default limits on data use, and market level obligations that do not depend on a user clicking through a banner correctly.

On children specifically, EFF recommends the DFA lean toward limiting data use by default rather than mandating invasive age verification, arguing that many online harms are tied to the collection and exploitation of their data in the first place, so cutting off the data pipeline addresses the root cause more directly than trying to gate access at the front door.

What Happens Next, and When?

The European Commission opened a public consultation on the Digital Fairness Act that ran from July 17 to October 24, 2025, gathering input from consumer groups, industry, and civil society organizations like EFF before drafting begins in earnest. The Commission's own work programme lists the DFA as a Q4 2026 legislative initiative, meaning a formal proposal, not a final law, is expected to land before the end of this year.

From there, the process follows the EU's ordinary legislative procedure: the European Parliament and the Council of the EU negotiate amendments to the Commission's text, a process that realistically runs through 2026 and 2027 given the scope of what is being proposed. Most analysts tracking the file expect possible adoption in late 2027, with entry into force and staggered application for different obligations spread across 2028 to 2030. In other words, nothing in the DFA binds any company yet, and won't for at least another year or two even in the best case. For readers tracking how the EU's rulebook has already shifted, the EU's ePrivacy withdrawal on email tracking is a useful contrast: that is a rule already in effect, while the DFA is still years from taking hold.

Why This Matters Even Before It's Law

Legislative previews like this one are useful signals precisely because companies do not wait for a law to take effect before they start adjusting. The Digital Markets Act fines against Apple and Meta already show EU regulators are willing to treat pay or consent and manipulative consent design as enforceable violations under existing law, which means the DFA is less a radical departure than a codification and expansion of a direction regulators have already committed to. For anyone tracking how state level privacy law overhauls and EU consent standards for tracking and profiling are evolving in parallel, the DFA consultation record, and EFF's detailed response to it, is the clearest public preview available of where the rules are heading next.

The DFA also matters as a bellwether for other jurisdictions. The EU's Unfair Commercial Practices Directive and GDPR have both been widely copied or referenced in privacy and consumer protection laws outside Europe, and a Digital Fairness Act that explicitly bans pay for privacy schemes and folds profiling into consumer protection law would give regulators elsewhere a fresh template to point to.

The Bottom Line

The Digital Fairness Act is still a proposal in progress, not an enforceable rule, but its scope, covering dark patterns, pay for privacy, addictive design, and profiling driven personalization, signals where EU regulation of manipulative digital practices is headed over the next several years. Anyone with a stake in how consent, tracking, and personalization get regulated in the EU should watch the Q4 2026 proposal closely, since the framework taking shape now will likely set the terms of the debate for years after it's finally adopted. Keep an eye on the Commission's legislative file and civil society responses like EFF's as the proposal moves from consultation to formal text.