At a glance
 

• The UK's new consumer protection regime, enacted through the Digital Markets, Competition and Consumers Act (‘DMCCA’), is relevant to a wide range of Business-to-Consumer (‘B2C’) companies, particularly those who sell directly to consumers online.
• Amongst other things, this regime (which went live on 6 April 2025) introduces a new prohibition on fake reviews, adds requirements to prevent drip pricing, and will establish new obligations for subscription contracts.
• It also grants the Competition and Markets Authority (‘CMA’) new enforcement powers, including the ability to directly impose fines for non-compliance with a number of important consumer laws without going to court.
• This blog sets out actions that senior management should consider to ensure compliance, including conducting a thorough review of online selling practices and addressing any unfair commercial practices as a priority.
• We illustrate this by reference to two case studies, namely fake reviews (signalling the importance of fit for purpose risk assessments) and greenwashing (highlighting the importance of fair online choice architecture).
• Taking these actions early can reduce the risk of enforcement action and associated financial penalties, which can be substantial – up to a maximum amount of £300,000 or 10% worldwide turnover (whichever is higher).
• Looking ahead, compliance should be embedded as an ongoing process through robust processes and safeguards, appropriate training and thorough record keeping.

Key elements of the new consumer protection regime relevant to online selling

The DMCCA became law in May 2024, with the dual aim of promoting competition in digital markets (something we have previously written about here and here) and protecting consumers by updating exiting rules. Following the competition regime going live in January of this year, the new consumer protection regime entered into force on 6 April 2025, introducing provisions that respond to evolving online markets and changing consumer behaviours.

This new regime replaces and updates the Consumer Protection from Unfair Trading Regulations 2008 to meet the needs of UK consumers. In this blog we focus on the elements that have a particular relevance to online markets:

• A new prohibition on fake reviews.
• Additional requirements relevant to drip pricing.
• Upcoming obligations in relation to subscription contracts.

We also set out the new direct enforcement regime that has been introduced by the DMCCA, which will have implications for how the CMA enforces a range of consumer laws.

What actions should the senior management of B2C companies be considering?

1. Conduct a comprehensive review of all existing online selling practices

Although the regime has implications which stretch well beyond the digital realm, the CMA has indicated that protecting “consumers from misleading or high-pressure online sales and pricing practices” will be a key priority for the year ahead.

B2C companies with an online presence should therefore review all their consumer-facing online sales activities (e.g. webpages, apps, and ads). They should identify the selling practices used and determine whether any of these may be considered unfair under the new regime. In conducting this review, companies should consider the full list of unfair commercial practices in addition to the new provisions highlighted above.

In the longer term, reviewing business practices should become an ongoing consideration.

2. Resolve any commercial practices considered to be unfair

Where a review identifies commercial practices that may be considered unfair, companies should resolve these as a priority. Not only will this reduce the risk of enforcement action, this may also be considered a mitigating factor in the event of any subsequent enforcement. The CMA has stated in its enforcement guidance that “taking proactive steps to cease and correct the infringing conduct before the CMA has notified the party that it has decided to conduct an investigation” will be considered a mitigating factor when setting fines.

In making these changes, compliance, legal, and risk teams will play a crucial role. However, for online activities, this will necessitate the involvement of the technology, marketing and design teams responsible for the relevant online content, advertising, websites, or apps. Therefore, fostering a company-wide understanding and commitment to DMCCA obligations is critical.

In terms of remedying potentially non-compliant conduct, the outcome of prior CMA enforcement activity, as well as associated guidance, can give a helpful sense of what is expected, as explored in the case study below.

3. Embed compliance as an ongoing process

Moving forward, companies should implement measures to ensure ongoing compliance, including robust processes and safeguards. This includes developing clear principles and guidelines for displaying information online and providing personnel with training on legal requirements. By embedding compliance considerations into the design phase of online sales journeys, companies can proactively mitigate risks.

Maintaining thorough records is crucial for demonstrating compliance. Companies may be required to provide evidence supporting past decisions. The CMA's guidance highlights that it may formally request various types of information, including business records, customer complaints, information about consumer research and testing, and evidence as to the accuracy of any factual claim made as part of a commercial practice.

4. Be aware of CMA priorities

Firms should monitor the evolution of CMA priorities, which may guide its investigations and enforcement action.

In its recently published approach to consumer protection under the new regime, the CMA has already stated that it will prioritise egregious conduct which causes tangible harm or preys on people in vulnerable circumstances. In so doing, the CMA has highlighted the following types of practices as being particularly harmful for consumers and fair-dealing businesses, therefore undermining consumer trust and confidence:

• misleading information about prices.
• misleading information about goods and services.
• unfair online choice architecture.
• unfair contractual barriers to switching and exercising legal rights.
• banned practices.

Indeed, the emphasis on online choice architecture, namely the way companies design journeys that influence digital user choices, is telling here. The CMA has already carried out extensive work in this area, highlighting how dark patterns (e.g. misleading ranking of options, excessive friction to steer users away from certain choices or the use of framing and prominence to make certain products more appealing) can unfairly influence consumer choices and purchases.

Conclusions

The UK's new consumer protection regime represents a significant shift in the consumer protection landscape for B2C companies. While the CMA has indicated an initial focus on supporting businesses in understanding and complying with the new rules, it has also made clear its intention to act swiftly and decisively against non-compliant behaviour.

For B2C companies for whom the internet is a critical route to market, this means that a thorough review of, and if necessary updates to, existing online selling practices is essential. This review should encompass all aspects of the online customer journey, from website design and advertising to contract terms and subscription models.

Failure to adapt to these new regulations could expose businesses to significant risks, including reputational damage, financial penalties, and legal challenges. By taking proactive steps now to understand and comply with the DMCCA, businesses can mitigate these risks and position themselves to thrive in a rapidly evolving digital marketplace.