The draft and its impact assessment were finalised and reported ahead of a formal presentation expected in mid-November 2026, according to Informat.ro, which described the text. The reported provisions include the ten-practice blacklist, safeguards for children, and rules for AI shopping assistants.
One rulebook instead of 27
The current rules come from the Unfair Commercial Practices Directive, adopted in 2005, when almost nobody did their shopping on a phone. A directive has to be written into national law, and that leaves room for interpretation. Enforcement in one country can look nothing like enforcement in the next.
A regulation works differently. It applies as written, without transposition, so the same list of banned practices would hold in Prague, Lisbon and Helsinki. National consumer authorities keep their role. They simply work from identical text.
The proposal still needs approval from the European Parliament and from national governments, which is where the political argument starts.
Five of the ten banned practices
The draft names ten practices that are unfair in every circumstance, with no case-by-case assessment. The examples reported so far:
- making cancellation harder than signing up, for example by requiring a phone call for a contract opened online;
- hiding the price or the auto-renewal terms until late in the process;
- drip pricing, where fees appear only at the final checkout step;
- pre-ticked boxes for paid add-ons;
- fake scarcity, such as stock alerts that are not based on real inventory.
Practices outside the blacklist are still judged individually. The list covers only conduct that the Commission treats as unfair regardless of context, which is why it is short and specific.
Children in games and apps
The draft goes further for minors. Loot boxes and pay-to-win mechanics in video games would be banned by default, rather than left to parental settings. Profiling-based advertising aimed at children would be prohibited outright.
It also addresses features that keep young users in an app: autoplay, notifications unrelated to what the child is doing, and retention chatbots that keep a conversation going. For parents who have watched a ten-year-old negotiate with a game's shop screen, the change would be visible at home, not only in a legal text.
A cancel button and a human being
Two requirements apply to everyone. Companies would have to offer a clear "cancel contract here" button, and customers would have a right to reach a human customer service agent instead of a loop of automated replies. The same draft sets rules for AI shopping agents that act on a consumer's behalf, an area where the Commission sees a gap between existing contract law and how assistants now operate.
The estimated benefit and the estimated cost
The impact assessment puts consumer losses avoided between 2025 and 2035 at €88.4 billion. The annual benefit, counting both money saved and time not lost to manipulative interfaces, is estimated at €13.7 billion a year. Recurring compliance costs for businesses are estimated at €678 million a year.
Spread across roughly 450 million EU consumers, that annual benefit works out to about €30 per person. The consumer benefit is around twenty times the estimated recurring compliance cost, though the two figures land on different sides of the balance sheet: one on households, the other on companies.
On penalties, the ceiling in the draft is up to 6% of global annual turnover. For comparison, the GDPR maximum is 4% of worldwide turnover or €20 million, whichever is higher.
Germany wants to amend, not replace
The main reported objection comes from Germany, which argues for targeted amendments to existing consumer legislation instead of a broad new regulation. That position matters because the proposal needs member states on board. A country that prefers patching the 2005 directive can slow a replacement text, even one that has already been drafted in detail.
Where the AI Act already stands
Consumer protection is not the only EU rulebook touching these interfaces. Since 2 August 2026, Article 50 of the AI Act requires providers and deployers to tell users when they are interacting with an AI system and to embed machine-readable markers in synthetic content. The AI Omnibus moved the compliance deadline for standalone high-risk systems in Annex III to 2 December 2027, and to August 2028 for systems embedded in regulated products.
The Digital Fairness Act would sit alongside that, on the commercial-practice side rather than the product-safety side. A chatbot that fails to disclose itself breaks one set of rules. A checkout that hides its renewal price breaks the other.
Do I have to wait for this regulation before complaining about a subscription trap?
No. The 2005 Unfair Commercial Practices Directive stays in force until a replacement takes effect, and national consumer authorities already act on aggressive or misleading practices under it. What changes with the new text is that the ten blacklisted practices would no longer need a case-by-case argument.
Is 6% of turnover calculated on European or worldwide revenue?
The draft refers to global annual turnover, the same base used in the GDPR and in the Digital Services Act. In practice, supervisors rarely apply the maximum, and the figure mainly sets the outer limit for negotiation and settlement.
Does the ban on pre-ticked boxes affect small online shops too?
A regulation applies to traders regardless of size, so the blacklist would cover a one-person web shop as well as a large platform. The Commission's impact assessment expects the recurrent compliance cost across the EU to be about €678 million a year, most of it in reworking checkout and cancellation flows rather than in ongoing paperwork.
The proposal is scheduled for formal presentation in mid-November 2026. Germany's stated preference is to amend existing consumer law rather than replace it.
