The EU Proposes a Digital Fairness Act to Crack Down on Loot Boxes and Dark Patterns

The European Commission is preparing to launch the Digital Fairness Act (DFA), an ambitious regulation designed to ban deceptive practices on the internet and give users control over features that encourage compulsive use. Widely reported from November 9, 2026, the proposal represents the most comprehensive overhaul of European digital consumer protection in over two decades.

What the Digital Fairness Act does

The DFA will replace the Unfair Commercial Practices Directive (UCPD), a 2005 law that was written for a web that barely existed. The new regulation applies to all online platforms, not just the largest ones. Retail, gaming, social media, streaming and e-commerce will all be affected simultaneously.

Ten "dark pattern" practices are explicitly prohibited. The annex lists fake stock or buyer-counters (designed to create artificial scarcity), pre-ticked checkboxes, labyrinthine cancellation processes, harassment pop-ups and fake notifications. Crucially, regulators will no longer need to prove individual harm in each case to enforce the ban. Fines can reach 6% of a company's global annual revenue, with member states required to set minimum penalties of at least 4%.

Loot boxes: when gaming meets gambling

One of the DFA's most controversial provisions targets in-game monetization. Loot boxes will be banned for minors — randomized reward mechanisms purchased with real or virtual currency that function identically to slot machines. Pay-to-win purchases (items required to progress in a game) are also prohibited for users under 18.

The rationale is well documented. A survey of 2,600 Austrian students aged 10 to 19 found that more than half had made in-app purchases, frequently on loot boxes. The European gaming industry generated between €20 billion and €40 billion in revenue last year alone. Ilkka Paananen, CEO of Finnish developer Supercell (_Clash of Clans, Clash Royale_), warned Brussels against "killing one of Europe's few tech success stories."

The industry lobby is pushing back hard. Dirk Bosmans, head of the Pan-European Game Information (PEGI) system, argued that age ratings already flag in-game currencies and loot boxes. "We are capable of solving this quicker than regulation can," he said. Urs Buscke of the European Consumer Organisation (BEUC) countered that labels alone cannot prevent harm to vulnerable consumers.

Notably, the DFA does not ban loot boxes for adults — it only requires them to be disabled by default for minors and re-enabled with explicit parental consent. The text acknowledges a genuine design tension: the same reward mechanisms that make games engaging are also the ones that make them fun.

Addictive design: the right to be interrupted

Article 17 of the DFA introduces a radical concept: the right to disable addictive features, individually or all at once. Platforms must provide simple toggles to turn off autoplay, infinite scroll, and engagement-driven notification systems.

This echoes a European Parliament resolution from December 2023 that proposed a digital "right not to be disturbed." The DFA's version does not, however, mandate that these features be disabled by default — the burden of opt-in remains with the user.

For social media companies, the impact will be immediate. Instagram, TikTok and YouTube will have to embed mandatory pause controls into their feeds. The Digital Services Act (DSA) already classifies some of these platforms as "very large platforms" with enhanced obligations — but the DFA fills consumer protection gaps that the DSA leaves open, particularly around interface design and manipulative patterns.

The political chessboard: Brussels divided

The DFA has been years in the making, triggered by a 2024 fitness check of EU consumer law that identified significant gaps. Commissioner Michael McGrath's Directorate-General for Justice leads the drafting. The European Parliament has issued at least four resolutions (May 2025, July 2025, September 2025, November 2025) calling for ambitious measures.

But documents obtained by investigative outlet Follow the Money reveal a split within the Commission itself: a senior DG Connect official opposes stricter regulation, arguing for a more industry-friendly approach. DG Connect is responsible for promoting the EU's tech sector — creating an institutional tension between consumer protection and competitiveness.

What to expect

The DFA is expected to be formally presented by the Commission in early November 2026. The EU legislative process is typically lengthy: after the Commission proposal, the Council and European Parliament will negotiate a final text — a process that normally takes 18 to 24 months. The form (regulation vs. directive) is still undecided and will determine how uniformly the rules are applied across member states.

What is already clear is that the paradigm has shifted. Europe's internet in 2028 will look significantly different from today's — less manipulation, more user agency, and inevitably, a technology industry forced to redesign its engagement strategies. The era of designing for addiction is ending not because companies changed their minds, but because the law finally caught up.

Sources: The Verge, Follow the Money, Agence Europe

✓ Independent sources cross-checked and verified before publishing