Skip to main content

The Digital Markets, Competition and Consumers Act (DMCCA) consumer protection regime is now live

New obligations, enforcement powers and potential penalties will focus minds on addressing unfair commercial practices embedded in digital consumer journeys.

At a glance
 

  • The UK's new consumer protection regime, enacted through the Digital Markets, Competition and Consumers Act (‘DMCCA’), is relevant to a wide range of Business-to-Consumer (‘B2C’) companies, particularly those who sell directly to consumers online.
  • Amongst other things, this regime (which went live on 6 April 2025) introduces a new prohibition on fake reviews, adds requirements to prevent drip pricing, and will establish new obligations for subscription contracts.
  • It also grants the Competition and Markets Authority (‘CMA’) new enforcement powers, including the ability to directly impose fines for non-compliance with a number of important consumer laws without going to court.
  • This blog sets out actions that senior management should consider to ensure compliance, including conducting a thorough review of online selling practices and addressing any unfair commercial practices as a priority.
  • We illustrate this by reference to two case studies, namely fake reviews (signalling the importance of fit for purpose risk assessments) and greenwashing (highlighting the importance of fair online choice architecture).
  • Taking these actions early can reduce the risk of enforcement action and associated financial penalties, which can be substantial – up to a maximum amount of £300,000 or 10% worldwide turnover (whichever is higher).
  • Looking ahead, compliance should be embedded as an ongoing process through robust processes and safeguards, appropriate training and thorough record keeping.

Key elements of the new consumer protection regime relevant to online selling


The DMCCA became law in May 2024, with the dual aim of promoting competition in digital markets (something we have previously written about here and here) and protecting consumers by updating exiting rules. Following the competition regime going live in January of this year, the new consumer protection regime entered into force on 6 April 2025, introducing provisions that respond to evolving online markets and changing consumer behaviours.

This new regime replaces and updates the Consumer Protection from Unfair Trading Regulations 2008 to meet the needs of UK consumers. In this blog we focus on the elements that have a particular relevance to online markets:

  • A new prohibition on fake reviews.
  • Additional requirements relevant to drip pricing.
  • Upcoming obligations in relation to subscription contracts.

We also set out the new direct enforcement regime that has been introduced by the DMCCA, which will have implications for how the CMA enforces a range of consumer laws.

The DMCCA adds fake reviews to the list of commercial practices that are prohibited in all circumstances (i.e. unlike many other provisions of the DMCCA, there is no need to consider the likely effect of these practices on consumers to prove an infringement of the law). This emphasis reflects the importance of consumer reviews on the internet (the CMA has previously estimated that £23 billion a year of UK consumer spending is influenced by online reviews).

As explained by the CMA, the ban encompasses reviews presented as – but not actually based on – an authentic consumer experience, either because they are fake or because they hide the fact they have been incentivised. The new regime forbids both the submission and the commissioning of these types of reviews.

These provisions apply to both businesses who publish reviews on their own websites and also intermediaries who publish reviews about third-party businesses (e.g. search engines, online marketplaces and social media). This banned practice contains a ‘positive’ obligation, meaning that in scope companies must take active steps to comply with the law to prevent and remove banned reviews and false or misleading consumer review information. We provide more detail on the implications of this below. The CMA has stated that it will initially focus on supporting businesses with their compliance, with enforcement action in this area only expected to commence from July.

The DMCCA also requires that companies provide the key information consumers need to make informed decisions. The omission of material information (including on pricing) is therefore unlawful. This effectively prohibits ‘drip pricing’, namely showing an initial headline price only to subsequently introduce additional mandatory charges.

Businesses are therefore required to tell consumers the total price of their products upfront (note, the definition of a product covers both physical and intangible things, including goods, services and digital content). This price must include any fees, taxes, charges, or other necessary payments. In cases where the price – or a part of it – cannot be reasonably calculated in advance, companies must clearly include the information necessary for the consumer to calculate an estimate.

The CMA is clear in guidance published to accompany the new regime that businesses should already be familiar with their consumer law obligations in this area, and that it may take enforcement action on this type of drip pricing (i.e. unexpected mandatory charges added on at the end of an online purchasing journey) over the coming year. However, the CMA also intends to further consult on some elements of drip pricing (e.g. fixed-term period contracts) in the summer. The CMA has stated that it will not enforce on issues relevant to this subsequent guidance until the final guidance has been published.

The DMCCA also includes provisions relating to subscription contracts, which are an increasingly common feature when transacting online. They have been introduced due to concerns about the extent to which consumers find themselves ‘stuck’ in contracts they no longer want (e.g. due to auto-renewal). The Government has previously estimated that unwanted subscriptions cost UK consumers £1.6 billion a year.

The new regime will establish new requirements relevant to pre-contractual information, reminder notices, and cancellation rights. For example, companies will be required to inform consumers about the upcoming renewal of their subscription and the associated payment. Another key provision is the introduction of mandatory ‘cooling off’ rights. These are fixed 14-day periods starting on the day a contract is signed (or any goods are received) during which consumers may exercise a right to cancel without the imposition of any penalties.

These provisions are not yet in force, as they still require secondary legislation to be implemented. This is expected to occur by early 2026 and will be informed by the outcome of a recent Government consultation on the topic.

Finally, under the DMCCA, the CMA now has the power to investigate and directly enforce breaches of a number of important consumer laws without needing to litigate through the courts. The CMA has provided guidance on how it intends to use its direct enforcement powers. It is important to note the new rules will not apply retrospectively, meaning any related CMA action will exclusively concern infringements which occurred on or after the new regime’s commencement date.

Before reaching any decisions, the CMA plans to follow a formalised investigatory process, which includes an investigation, an initial and then a final decision. In all cases, investigated companies have an opportunity to make representations and offer undertakings before the CMA reaches a final decision. In the interest of pace, the CMA has stressed that it will seek early resolution through settlement where appropriate.

In the case of non-compliance, the CMA can impose remedial measures and fines of up to £300,000 or 10% worldwide turnover (whichever is higher). Penalties are calculated based on the seriousness of the infringement and will be adjusted based on a variety of factors, such as:

  • The size of the company and its financial position (to ensure penalties can successfully deter breaches).
  • Mitigating factors (e.g. cooperation and proactivity).
  • Aggravating factors (e.g. concealment of breaches, repeated/continued non-compliance).
  • Proportionality and settlement discounts (if applicable).

Companies have a right to appeal CMA enforcement decisions to court within a given window (e.g. within 60 days from receiving a penalty notice). The CMA can also issue penalties if companies fail to provide information or provide false or misleading information.

What actions should the senior management of B2C companies be considering?


1. Conduct a comprehensive review of all existing online selling practices

Although the regime has implications which stretch well beyond the digital realm, the CMA has indicated that protecting “consumers from misleading or high-pressure online sales and pricing practices” will be a key priority for the year ahead.

B2C companies with an online presence should therefore review all their consumer-facing online sales activities (e.g. webpages, apps, and ads). They should identify the selling practices used and determine whether any of these may be considered unfair under the new regime. In conducting this review, companies should consider the full list of unfair commercial practices in addition to the new provisions highlighted above.

In the longer term, reviewing business practices should become an ongoing consideration.

2. Resolve any commercial practices considered to be unfair

Where a review identifies commercial practices that may be considered unfair, companies should resolve these as a priority. Not only will this reduce the risk of enforcement action, this may also be considered a mitigating factor in the event of any subsequent enforcement. The CMA has stated in its enforcement guidance that “taking proactive steps to cease and correct the infringing conduct before the CMA has notified the party that it has decided to conduct an investigation” will be considered a mitigating factor when setting fines.

In making these changes, compliance, legal, and risk teams will play a crucial role. However, for online activities, this will necessitate the involvement of the technology, marketing and design teams responsible for the relevant online content, advertising, websites, or apps. Therefore, fostering a company-wide understanding and commitment to DMCCA obligations is critical.

In terms of remedying potentially non-compliant conduct, the outcome of prior CMA enforcement activity, as well as associated guidance, can give a helpful sense of what is expected, as explored in the case study below.

3. Embed compliance as an ongoing process

Moving forward, companies should implement measures to ensure ongoing compliance, including robust processes and safeguards. This includes developing clear principles and guidelines for displaying information online and providing personnel with training on legal requirements. By embedding compliance considerations into the design phase of online sales journeys, companies can proactively mitigate risks.

Maintaining thorough records is crucial for demonstrating compliance. Companies may be required to provide evidence supporting past decisions. The CMA's guidance highlights that it may formally request various types of information, including business records, customer complaints, information about consumer research and testing, and evidence as to the accuracy of any factual claim made as part of a commercial practice.

4. Be aware of CMA priorities

Firms should monitor the evolution of CMA priorities, which may guide its investigations and enforcement action.

In its recently published approach to consumer protection under the new regime, the CMA has already stated that it will prioritise egregious conduct which causes tangible harm or preys on people in vulnerable circumstances. In so doing, the CMA has highlighted the following types of practices as being particularly harmful for consumers and fair-dealing businesses, therefore undermining consumer trust and confidence:

  • misleading information about prices.
  • misleading information about goods and services.
  • unfair online choice architecture.
  • unfair contractual barriers to switching and exercising legal rights.
  • banned practices.

Indeed, the emphasis on online choice architecture, namely the way companies design journeys that influence digital user choices, is telling here. The CMA has already carried out extensive work in this area, highlighting how dark patterns (e.g. misleading ranking of options, excessive friction to steer users away from certain choices or the use of framing and prominence to make certain products more appealing) can unfairly influence consumer choices and purchases.

Conclusions


The UK's new consumer protection regime represents a significant shift in the consumer protection landscape for B2C companies. While the CMA has indicated an initial focus on supporting businesses in understanding and complying with the new rules, it has also made clear its intention to act swiftly and decisively against non-compliant behaviour.

For B2C companies for whom the internet is a critical route to market, this means that a thorough review of, and if necessary updates to, existing online selling practices is essential. This review should encompass all aspects of the online customer journey, from website design and advertising to contract terms and subscription models.

Failure to adapt to these new regulations could expose businesses to significant risks, including reputational damage, financial penalties, and legal challenges. By taking proactive steps now to understand and comply with the DMCCA, businesses can mitigate these risks and position themselves to thrive in a rapidly evolving digital marketplace.