The EU Promises Digital Fairness, But Still Want Users To Do the Work

The author is a policy advisor at European Digital Rights (EDRi).

This week, the European Commission published its long-awaited Digital Fairness Act (DFA), accompanied by proposals to strengthen cross-border consumer protection enforcement and simplify certain existing consumer rules. Together, they could significantly change how the EU regulates commercial practices and, ultimately, how extractive business models negatively impact fundamental rights. A gargantuan task, even if one worth tackling.

The DFA would replace the Unfair Commercial Practices Directive (UCPD) with a directly applicable Regulation. Most importantly, it introduces new prohibitions against manipulative design, addresses addictive features and tackles problems ranging from influencer marketing and gaming practices to subscriptions, personalized pricing and AI agents acting on people's behalf.

There are several things to welcome, and this Commission team deserves credit for years of serious work. Its impact assessment estimates that the proposed measures could prevent €13.7 billion in consumer detriment annually, including the value of time lost. This adds to the negative impact on fundamental rights that has been evidenced for years.

The European Digital Rights (EDRi) has been pushing for stronger protections against manipulative and exploitative commercial practices for years, including the need to modernize consumer law to better protect fundamental rights online. I won't attempt a comprehensive assessment of every provision here, given that several deserve their own analysis, particularly the rules on AI agents, gaming, unfair pricing and the accompanying enforcement reforms. This piece concentrates on something running through the proposal that is difficult to ignore: how much responsibility the law continues to place on people to protect themselves against practices that companies deliberately design, test and profit from.

Some manipulation will finally be banned

One of the most promising parts of the DFA is its new blacklist of ten digital deceptive design practices, the so-called “dark patterns”: fake notifications, repeated attempts to make people reverse their decisions, deliberately complicated refusal mechanisms and other familiar tricks would be prohibited outright. This is welcome, even if we've spent years debating whether existing consumer law already prohibits deceptive design. Often it does, but that hasn't stopped these practices from spreading. Forcing regulators to establish unfairness through complex legal assessments hasn't exactly delivered spectacular results for protecting people from such practices.

There is also a broader prohibition on manipulative interface design. Its relationship with existing consumer law and the Digital Services Act could use some clarification, particularly given the overlapping rules and enforcement authorities. Still, the blocklist offers something valuable: clear boundaries for practices that companies should have stopped deploying years ago. This, however, makes the Commission's hesitation elsewhere even more difficult to understand. If we can prohibit some manipulative design practices outright, why is the EU so reluctant to take a similar approach to certain (also manipulative) addictive features?

Are we really doing cookie banners again?

Take Article 17, which explicitly recognizes that features such as autoplay, uninterrupted scrolling, engagement streaks and certain AI interactions can encourage compulsive or excessive use. For consumer law, this is an important development. Businesses increasingly profit from keeping people engaged, including when no purchase takes place. The proposal even recognizes that continuing to use a service can constitute a commercial decision.

And what does the law require companies to do about addictive features? Largely, provide an off switch. We know from the documents that the Commission actually considered requiring attention-maximizing features to be disabled by default for everyone. Its impact assessment explains that this option was rejected partly because of concerns about disrupting business models and consumer experience.

We should find that reasoning rather difficult to accept. Of course people enjoy engaging services and personalized recommendations. But enjoying something tells us very little about whether we want companies continuously testing how to keep us online beyond our intentions. And the Commission's own consultation findings complicate the argument: among respondents supporting EU action on addictive design, 58% favored allowing consumers to opt into such features rather than being exposed to them automatically.

There is also a too familiar political risk: we've spent years watching companies turn cookie consent from a perfectly valid legal and protective basis into an obstacle course, only for the resulting frustration to become an argument against EU privacy and data protection regulation.

Now imagine another set of inconvenient controls, confusing settings and repeated choices: people will inevitably become frustrated, industry will complain about Brussels ruining the user experience, and eventually someone will suggest weakening the rules (they will call it ‘simplification,’ though). I'd rather we didn't repeat that exercise.

There is a legal question here, too: the text prohibits both specific manipulative interface design and unfair commercial practices in general. Could some of the addictive features covered by Article 17 already be unlawful under those provisions, even when an opt-out is available? That relationship needs clarification, because providing an off switch should never become a convenient defense for manipulation.

Apparently, being vulnerable is no longer enough

Consumer law has traditionally distinguished between the average consumer and particularly vulnerable consumers: when a commercial practice targets particularly vulnerable people, authorities can assess its unfairness from the perspective of those people, rather than the average consumer. However, as academics have argued for a long time, increasingly sophisticated commercial systems make that distinction harder to sustain.

Vulnerability in the digital realm is situational: financial pressure, exhaustion, emotional distress or loneliness may change how someone responds to commercial pressure. Companies observe people's behavior, infer their weaknesses and adapt their practices accordingly. Even someone who ordinarily makes informed decisions can still be manipulated by a system continuously optimized to exploit predictable behavioral responses.

The Commission's impact assessment acknowledges the limitations of traditional consumer concepts. But something interesting happened between the leaked draft and the final proposal: the former referred broadly to consumers who were particularly vulnerable because of disability, age, credulity or personal circumstances; the official proposal instead refers to a specific misfortune or circumstance serious enough to impair someone's judgment.

That considerably narrows the circumstances covered by this particular protection, potentially making it harder to assess commercial practices from the perspective of people experiencing temporary or situational vulnerabilities.

Of course, the general prohibition of unfair commercial practices still applies to everyone. But it’s difficult to understand why the Commission chose a more restrictive formulation when its own research documents how digital businesses exploit behavioral vulnerabilities.

The EU should preserve stronger protection for people facing particular vulnerabilities, while recognizing that these can arise temporarily, affect anyone and sometimes result from the commercial practices themselves. That also means requiring companies to identify and prevent foreseeable exploitation, rather than expecting people to demonstrate that their personal circumstances were serious enough to deserve protection.

The problem becomes especially apparent with personalized practices. The proposal restricts certain harmful personalized pricing practices when traders know users are minors or particularly vulnerable. Yet companies increasingly infer and exploit vulnerabilities that may be temporary, difficult to categorize, or deliberately generated by the commercial environment itself. All of the above does not even take into account the potential for even more data collection and processing, and thus mass surveillance, of it all.

Why should consumer law require such a high threshold for vulnerability when identifying and exploiting more ordinary weaknesses has become a commercial capability (one that many companies are proud of)? Perhaps we should spend less time asking whether people are vulnerable enough to deserve special protection, and more time preventing businesses from creating or exploiting those vulnerabilities.

‘Fairness by design,’ but who's responsible for proving it?

The Commission's impact assessment discusses introducing a general fairness-by-design obligation, something many civil society organizations have supported. The legislative proposal contains useful elements, including the prohibition of manipulative interface design and the existing requirement that companies act with the care and skill reasonably expected of a responsible business. But it stops short of establishing a clear horizontal duty requiring companies to assess, document and prevent foreseeable manipulation across their commercial systems.

While we welcome that the text would help courts and authorities obtain evidence about how online commercial practices operate and affect consumers, this still places the burden of proving unfair practices on regulators, civil society and affected consumers rather than companies who hold the information. Companies know which designs they tested, what they optimized for and how people responded. They know which interventions increased spending, reduced cancellations or encouraged longer engagement. Regulators, consumers and civil society organizations, hand in hand with the impacted people whose rights have been violated, generally have to reconstruct that information after the fact.

We know that the Commission examined stronger approaches to easing or reversing the burden of proof during its preparations. The European Parliament and Council, as co-negotiators, should revisit them.

EDRi, for starters, would like to see proportionate obligations requiring traders to assess foreseeable risks before deploying potentially harmful commercial practices, alongside documentation requirements explaining their design choices. For certain practices already known to pose serious risks, the law could go further: presume them unfair unless the company can demonstrate otherwise. That doesn't mean imposing identical duties on a small online shop and a company operating sophisticated behavioral optimization systems, because the law, based on the proportionality principle, can distinguish between them.

But if companies can measure exactly how their systems influence us, asking them to demonstrate that their commercial practices are fair hardly seems unreasonable.

Children deserve protection. So does everyone else

The relationship between the DFA and the proposed EU KIDS Act (which is already threatening to make the internet less safe) adds another layer of difficulty. The two proposals establish different protections depending on age, including stronger restrictions for minors on certain personalized advertising and gaming practices, alongside separate safeguards against addictive design.

There are welcome limits in the DFA on requiring additional personal data processing to identify minors. Nevertheless, the combined approach may encourage further age classification and potentially intrusive and harmful verification. And the underlying question remains: why should protection against manipulative commercial practices depend so heavily on someone’s characteristics, including age in this case?

Children may face particular risks, but harmful commercial practices don't suddenly become harmless when someone turns 18. And yes, comparisons with alcohol, tobacco or gambling sometimes appear in this debate. Those sectors show that consumer choice alone is not always an adequate response to harmful commercial practices. In addition to that, digital spaces are also places where people (including children) communicate, organize, learn and exercise fundamental rights. Importing approaches centered on restricting access would have serious consequences.

The more useful lesson is that foreseeable harms can justify regulating what companies do, instead of concentrating on who should be excluded from their services. We can draw red lines around harmful commercial practices instead. That means companies delivering a less enshittified internet, something that would not only relieve people and their rights, but also create a more level playing field amongst companies. That would address the source of the problem without making intrusive age checks the condition for enjoying basic protections.

The European Commission's recent preliminary findings concerning TikTok under the Digital Services Act make this particularly relevant. Authorities are thus already examining whether engagement-driven content recommender systems create unacceptable risks, and we believe that the DFA could complement that work through clearer rules across the digital economy, including beyond the biggest platforms. Because we should be addressing the commercial incentives and optimization practices that encourage exploitation, rather than treating each harmful feature as an isolated problem.

A chance to change who is responsible

Let us get this straight: the European Commission recognizes addictive design, yet largely relies on opt-outs; it studies situational vulnerability, yet narrows the relevant legal language; it examines fairness by design and stronger evidentiary obligations, without clearly translating them into preventive responsibilities. What does this mean for the next steps?

Civil society groups want to be optimistic: for once, Brussels has presented legislation intended to strengthen digital rights and, given the current enthusiasm for deregulation, we'll take that as a reason to hope for the better, even if only shortly. The European Parliament and Member States now have an opportunity to strengthen the proposal and give it actual teeth. Safer defaults, clearer prohibitions, meaningful remedies and proportionate corporate accountability are badly needed and would go a long way.

For years, people have been expected to read privacy notices, manage consent, adjust settings and defend themselves against commercial systems designed by companies with vastly greater information and resources. Companies design these systems: they test their effects, understand their commercial objectives and profit from their operation. How much longer should people have to fight the design of the services they use every day?