EU Digital Fairness Act (COM(2026))

Social media intrusion arrived before the rules. AI intrusion arrives with early rules—and hard user-level levers (One-Click Exit, Active Opt-In, Kill-Switches) to fight back. #RACinform

🟢 Overview

On 11 November 2026, the European Commission published its proposal for the Digital Fairness Act (COM(2026) 1100 final), repealing the 2005 Unfair Commercial Practices Directive (2005/29/EC) and converting EU consumer protection rules into a directly applicable Regulation.

Public messaging frames the Act around consumer-facing headlines: banning fake countdown timers, enforcing one-click cancellation, and curbing infinite scroll.

For operators, product owners, and governance leads, the real shift sits underneath the poster. The proposal centralises enforcement powers in Brussels, reverses the burden of proof on algorithmic systems, introduces mandatory technical controls for AI contracting agents, and backs non-compliance with turnover-based fines up to 6% globally.

🟢1️⃣ Structural Shift: From National Directive to Centralised EU Regulation

Direct Applicability: Repealing Directive 2005/29/EC removes 27 national transpositions. One rulebook applies directly across all Member States 12 months after entry into force.
Centralised Brussels Enforcement: Under the parallel revision to the Consumer Protection Cooperation (CPC) Regulation (COM(2026) 1120 final), the Commission gains direct investigation and fining powers for widespread cross-border infringements.
Delegated Rule Expansion (Articles 10(3) & 17(2)): The Commission grants itself open-ended authority to update the banned dark-pattern list and mandatory "disable-able" addictive design features via delegated acts without reopening primary legislation.
B2C Scope Only (Recital 17): B2B transactions remain outside scope. Subscription traps, auto-renewals, and opaque pricing in B2B SaaS continue untouched under this text.

🟢2️⃣ Execution-Plane Controls: What Systems Must Actually Build

The Act moves beyond general principles and mandates specific UI, billing, and architectural states across Chapter III (Articles 10–29):

Mandatory Cancellation & Withdrawal Architecture (Articles 23 & 24): Any trader offering online sign-up must provide a continuously visible, prominently labelled online termination button ("terminate the contract here") followed by a single confirmation step ("confirm the contract termination") and a durable-medium receipt within one week. Logged-in users cannot be forced to re-enter identification or contract details.
Free Trials & Auto-Renewals (Articles 20–22): Free trials can no longer silently convert into paid plans; traders must send a reminder and capture express active consent before charging. Long-term contracts (6+ months) require reminders 14 to 30 days prior to auto-renewal. If a trader fails to send the reminder, the consumer can terminate immediately at zero cost—and owes nothing for the elapsed post-extension period.
Kill-Switches for Addictive Design (Article 17): Services must provide easily accessible controls allowing adult users to disable—individually or all at once—autoplay, non-user-triggered notifications, streak/penalty retention mechanics, and AI systems that simulate interpersonal relationships to prolong engagement. (Banned outright for under-18s).
Pricing & Virtual Queue Telemetry (Articles 18 & 19): Dynamic ticketing and virtual queues must display real-time price changes and the maximum possible ticket price at the moment the user enters the queue. Drip pricing—adding unavoidable fees late in checkout—is prohibited.
Virtual Currencies & Loot Boxes (Articles 14–16): In-game currencies must display real-world fiat equivalents at the point of purchase. Variable reward systems (loot boxes) must publish exact drop probabilities, offer a user disable toggle, and are banned for minors.
Right to a Human Interlocutor (Article 25): Automated customer support loops must provide escalation to a human being upon request when automated channels fail to resolve an issue.

🟢3️⃣ AI Contracting Agents & Algorithmic Governance (Articles 26–27)

One of the most consequential additions in the text governs automated systems and AI agents concluding contracts on behalf of consumers:

Mandatory Guardrails on First Use (Article 26(2)): Systems acting on a consumer's behalf must force an explicit upfront choice: confirm every contract before execution, confirm only contracts outside user-set thresholds (such as maximum spend and time limits), or authorise full autonomy.
Conflict-of-Interest Overrides (Article 26(4)(b)): If an AI contracting tool receives commission, sponsorship, or preferencing fees from a merchant, it must disclose the conflict and force manual user confirmation—overriding any prior autonomous setting.
EU Business & Digital Identity Wallets (Article 26(5)–(6)): Establishes interoperability hooks for AI agents and traders to authenticate identity and delegation authority via European Business Wallets and EU Digital Identity Wallets.
Machine-Readable Disclosures (Article 27): Where both trader and consumer transact solely via automated systems, human-readable pre-contractual disclosures drop away in favour of machine-readable formats.

🟢4️⃣ Enforcement Asymmetry, Evidence Disclosure & Penalties

Forced Algorithmic & UX Disclosure (Article 34): Where a claimant or regulator shows reasonable suspicion of an unfair online practice, courts and authorities can compel the trader to hand over internal evidence on the design, functioning, and behavioural impact of their interface or algorithm. Failure to disclose—or supplying incomplete data—allows authorities to infer unfairness directly.
Vendor Recourse Without Open-Source Shield (Article 36 & Recital 98): Traders fined due to third-party software or UX components gain a statutory right of recourse against commercial vendors. However, Recital 98 explicitly excludes free and open-source software from recourse claims—leaving the deploying operator carrying 100% of the regulatory liability.
Turnover Fines (Article 35): National authorities must set maximum fines of at least 4% of annual turnover in the Member States concerned (or at least €2 million where turnover data is unavailable). For Commission-led cross-border investigations, maximum fines reach 6% of worldwide annual turnover.

🔵 RACinform View

Less Theatre, Real User Power.

At poster level, the Digital Fairness Act looks like standard Brussels PR. Reading the actual 71-page text (COM(2026) 1100) reveals the opposite: execution-plane law with real teeth.

Decentralised User Leverage: Brussels cannot audit millions of interfaces manually. Instead, the Act embeds self-executing user levers—voiding renewal fees when reminders are missed (Articles 20–22), mandating hard exit buttons (Articles 23–24), and granting kill-switches for addictive AI hooks (Article 17)—so users can challenge non-compliance directly.
Delegated Agility (Articles 10(3) & 17(2)): Primary law moves too slowly for mutating dark patterns. Delegated powers let the Commission update banned practices fast without reopening legislation.
Reversed Burden of Proof (Article 34): Courts can compel internal UX and algorithmic disclosures—and infer unfairness directly if a trader stonewalls.
Two Watchouts: Free and open-source software carries zero vendor recourse (Article 36 & Recital 98), leaving operators 100% liable for open-source dependencies. It turns "free software" into uninsured regulatory liability for small operators who don't audit what sits inside their stack. Scope also remains strictly B2C (Recital 17), leaving B2B SaaS traps untouched.

Verdict: Clean operators get a level playing field. Predatory billing loops and dark-pattern retention architectures just lost their legal cover—if your backend logic or third-party scripts fail an Article 34 disclosure order, liability lands squarely on you.