“Regulation on Top of Regulation”: Industry Pushes Back Against EU Digital Fairness Act as Overlapping Rules Add to DMA and DSA Burdens

EU seeks to expand regulation of online platforms and e-commerce through the DFA
Big Tech fines and service cutbacks mount following implementation of DMA and DSA
Potential overlap with existing regulatory obligations raises concerns over legal uncertainty and higher compliance costs

The European Union (EU) is tightening regulation of digital platforms and e-commerce companies. Having targeted large platforms’ market dominance and the circulation of illegal content and goods through the existing Digital Markets Act (DMA) and Digital Services Act (DSA), it is now seeking to broaden oversight to consumer transaction practices more generally through the Digital Fairness Act (DFA). Meanwhile, market participants warn that, with numerous EU-level digital regulations already operating in parallel, adding similar obligations could increase legal uncertainty and compliance burdens, creating further confusion for businesses.

DFA Draft Set for Official Unveiling

On the 9th (all dates hereafter are local time), Reuters reported that the European Commission had prepared a draft DFA to regulate unfair commercial practices by online platforms and e-commerce companies. Scheduled for official release on the 11th, the proposed legislation focuses on preventing companies from using the design and operation of online services to improperly influence consumers’ purchasing and usage decisions. It explicitly identifies a range of commercial practices for regulation, including dark patterns such as false low-stock alerts and automatically selected paid options; conversion of free trials into paid subscriptions without consent; addictive design that encourages excessive service use among teenagers; and promotional recommendations by artificial intelligence (AI) shopping services. Depending on the case, companies that violate the rules would face fines of up to 6% of their annual worldwide revenue.

At the heart of the proposal is a comprehensive overhaul of the EU’s existing consumer protection framework to reflect the digital transaction environment. The Commission is pursuing a plan to replace the Unfair Commercial Practices Directive (UCPD), enacted in 2005, with the DFA. By introducing the DFA as a regulation directly applicable throughout the EU, it aims to reduce differences in consumer protection standards across the bloc and strengthen supervision and penalties for online commerce companies. However, the proposal must still undergo deliberations and negotiations in the European Parliament and the Council of the EU, and its specific provisions and implementation schedule may change during the legislative process.

DMA Enforcement Cases Mount

As EU-level efforts to tighten regulation gain momentum, market concerns are also growing. This is because the implementation of similar existing laws has already left companies facing substantial penalties and compliance burdens. A prominent example is the DMA, which became fully applicable in March 2024. The law designates large companies operating core platform services, such as online search engines, app stores and social media, as “gatekeepers” and focuses on preemptively preventing them from using their market dominance to restrict competition. Specifically, it regulates practices such as favoring their own services in search results, restricting the use of external payment methods, obstructing competing services’ market entry, and combining personal data without user consent. Companies that violate the rules can face fines of up to 10% of annual worldwide revenue, rising to 20% for repeat violations.

Since the DMA took effect, the EU has imposed a series of major penalties on leading technology companies, including Apple, Meta and Google. In April last year, Apple was fined EUR 500 million after the Commission determined that it had restricted App Store developers from directing users to external payment options. Meta received a EUR 200 million fine for failing to guarantee users a meaningful choice over how their personal data was used. In July, Google was hit with hefty fines of EUR 460 million and EUR 430 million, respectively, for favoring its own services over competitors in search results and restricting developers from directing Google Play users to external purchasing options.

Impact Spreads to Smaller Businesses

There have also been cases in which service launches were delayed or features adjusted during the compliance process. In September last year, Apple said the European rollout of certain features, including iPhone Mirroring and AirPods live translation, had been delayed because the DMA’s interoperability obligations could raise security and privacy concerns. Google also revamped the presentation of search results in Europe in September to comply with the relevant rules, increasing the visibility of specialized comparison services in searches for hotels, flights and restaurants.

Google argued that these measures could reduce convenience for users and raise customer acquisition costs for local businesses. Indeed, according to a staff working document on the DMA evaluation released by the Commission, relevant industry associations reported that some retailers saw search traffic fall by 40–50% following Google’s compliance measures, while small and medium-sized businesses in the accommodation sector reported declines of 20–30% in website visits or direct sales. As smaller businesses become dependent on external intermediary platforms instead of their existing direct booking and sales channels, they face a greater risk of incurring additional costs, including commissions.

Table 1. Major Corporate Penalties and Responses Following Implementation of EU Digital Regulations

DSA Also Causes Considerable Market Disruption

The DSA, which became fully applicable in February 2024, has also placed enormous pressure on platform companies. The law’s central purpose is to impose obligations on digital service providers to prevent the circulation of illegal content and goods and protect users. Specifically, it includes provisions requiring procedures for reporting and removing illegal content, restricting targeted advertising to minors, disclosing information about advertisers and recommendation algorithms, and banning dark patterns that distort users’ choices. Very large online platforms and search engines with more than 45 million monthly users in the EU are also subject to additional obligations to assess and mitigate risks arising from the spread of harmful content and addictive service design. Violations can result in fines of up to 6% of annual worldwide revenue.

A substantial number of major enforcement cases under the DSA have also accumulated. Last December, the Commission fined social media platform X EUR 120 million on the grounds that the blue verification badges provided to paid verified accounts misled users and that the platform failed to provide sufficient advertising information and other disclosures. In May, Chinese e-commerce platform Temu was fined EUR 200 million for failing to properly assess the likelihood of illegal and dangerous goods circulating on its platform. In July, AliExpress was hit with a EUR 550 million fine for failing to adequately assess and mitigate the risk of counterfeit and illegal goods circulating on its platform.

Opposition Grows Over Risk of Overlapping Regulation

Market participants are concerned that introducing the DFA could significantly increase companies’ compliance burdens. The EU already enforces multiple digital regulations, including the DMA, DSA, AI Act and Data Act. The problem is that some of these laws overlap in scope and obligations, requiring companies to review and address different regulatory requirements for the same service. In particular, dark patterns, targeted advertising and recommendation algorithms, which the DFA seeks to govern, are already partly regulated under the DSA and the General Data Protection Regulation (GDPR). Additional obligations could require companies to overhaul their overall operations, from service design to advertising and sales practices.

Industry opposition is also emerging. In March, leading business associations, including the European digital industry association DIGITALEUROPE, warned in a joint statement that “if the DFA adds new obligations in areas already regulated by existing EU legislation, legal uncertainty and compliance costs could increase.” In particular, they argued that extending obligations the DSA imposes on certain online platforms to online businesses more broadly, or adding detailed requirements for service interface design, could increase compliance burdens regardless of company size.