Fairness and Politics of Digital Advertising

2. Is Fairness a Legislative Challenge?

Identifying problematic practices alone is insufficient to justify new laws, given that consumer protection laws already provide a legal basis to address deceptive behaviours online. The European Commission concluded in 2017 that existing consumer rules were fit for purpose, as evidenced by its Fitness Check of EU consumer laws and the evaluation of the Consumer Rights Directive.[1]

But by the time of the 2024 Fitness Check on digital fairness, it concluded that certain digital practices undermine consumer decision-making, particularly for vulnerable users.[2] The Commission’s own Better Regulation guidelines assert that proving an actual regulatory gap would be a first step to justify any new legislation. The Commission has not yet publicly demonstrated that the UCPD, UCTD, and CRD fail to provide the necessary legal basis to act.

2.1 Existing Legal Basis

The current EU consumer law framework already provides a basis for consumer protection that overlaps with the proposed DFA scope, as it includes provisions prohibiting unfair commercial practices, requiring the provision of pre-contract information, imposing design constraints on purchase flows, and ensuring that unfair terms are not binding on consumers.

• For instance, Article 5 of the UCPD prohibits practices that are contrary to professional diligence and materially distort consumer behaviour, including manipulative defaults such as pre-selected options; Article 6 UCPD prohibits misleading information that affects consumer behaviour; and Article 7 prohibits the omission or obscuring of material information, particularly in cases involving hidden fees, unclear disclosures, or disguised advertising, while obstructive consent or cancellation flows engage the prohibition on aggressive practices in Articles 8 and 9.
• The ban on aggressive practices under Articles 8 and 9 of the UCPD prohibits undue influence, including the exploitation of a position of power to impair consumers’ freedom of choice. Together, these provisions already capture a broad range of coercive and manipulative interface designs commonly associated with so-called dark patterns.
• Also, the CRD already imposes some ex-ante transparency and digital interface obligations that the DFA would address through information and transparency obligations that apply to all distance contracts, including online, requiring traders to provide clear and comprehensible information prior to contract conclusion. Article 8(2) specifically addresses digital interface design for online purchases, which the European Court of Justice has interpreted strictly to prevent deceptive interface design;[3] and Article 22 requires traders to get consumer consent to any additional payments, effectively prohibiting dark pattern practices, including so-called “basket sneaking,” via pre-ticked boxes and default options.

The UCTD addresses broader unfairness in consumer contract terms, addressing power and information asymmetries (including those embedded in digital services) that cause a significant imbalance in the parties’ rights and obligations. UCTD requires that contract terms be drafted in plain and intelligible language, thereby rendering “unfair terms” non-binding on consumers.[4] Hence, courts can already intervene where a contractual imbalance exists, and case law has acknowledged that consumers are, by default, in a weaker bargaining position that warrants a proactive judicial intervention.

In light of the existing framework, one might argue that the material standards for the current rights and obligations are inadequate or insufficiently enforced. While such a view is perhaps warranted, it is not a credible basis for moving from horizontal consumer protection to an online-specific law, particularly when the existing framework already applies across commercial channels. Nor could one credibly claim that an obligation would be better enforced because it sits under one umbrella, but not the other.

Furthermore, this EU consumer regime is neither rigid nor outdated. The European Data Protection Board has also provided interpretative guidelines, including blacklists of outright prohibitions, indicative lists in existing laws, and non-binding guidance to reduce uncertainty and enhance predictability for both consumers and businesses.[5] Annex I of the UCPD contains a blacklist of prohibited practices in all circumstances, inter alia bait advertising (Annex I, no. 5), false urgency (no. 7),  practices relating to fake reviews and endorsements (nos. 23b/c), and hidden advertising (no. 11).[6] Through the CRD, the EU has demonstrated that it has addressed digital complexity with detailed rules when necessary,[7] and any shortcomings are not due to a lack of rules – thereby undermining the case for a new digital act.

Given this level of legal coverage, the introduction of the DFA does not fill an identifiable void in substantive law but merely re-articulates existing prohibitions in a sector-specific form, potentially fragmenting interpretation and creating parallel standards for functionally identical practices. In other words, the DFA’s core objectives are explicitly regulated in the UCPD, CRD, and UCTD, with safeguards against unfair practices, withdrawal rights, remedies, transparency obligations, and contractual fairness comprehensively covered.

Therefore, the issue does not lie in the absence of substantive rules but in their effective enforcement capacity, coordination across Member States, and the pace of case-law development, rather than in gaps in substantive law.

2.2 Reversing the Burden of Proof

Where the DFA may lack a legislative gap to fill, critics would argue there is no shortage of political objectives for another incremental digital act. Consumer watchdogs routinely cite the Commission’s Fitness Check, which shows that certain unfair commercial practices cause consumers online financial harm of at least €7.9 billion annually.[8] While we shall return to the economic impact, there are also institutional arguments for the Commission to pursue the DFA.

To begin, the current directives preserve national discretion in transposition and enforcement, whereas a regulation applies uniformly and directly across Member States, allowing greater Commission oversight and direct supervisory roles while reducing reliance on national courts and current cross-border mechanisms. A regulation will recast the current decentralised EU framework, established under the Consumer Protection Cooperation (CPC) Regulation 2017/2394 for cross-border cooperation and coordinated enforcement of consumer protection laws by national authorities, into a hub-and-spoke model.

• Such a change will also have a significant bearing on enforcement powers across the Member States. UCPD is enforced on a case-by-case basis by CJEU and national courts, who must uphold the evidential thresholds for harm and causation in litigation.
• While CJEU has established the principle of effectiveness, requiring that EU-derived rights are not rendered virtually impossible or excessively difficult to exercise through national procedural rules,[9] the executive branch may prefer observable proxies – such as prohibitions in UI design, defaults, and interfaces where legislators can define per se prohibited or restricted design practices – rather than demonstrating harm or misleading conduct. Ex-ante obligations become, de facto, a shift in the burden of proof.

Such reversals are not unknown in EU consumer law, but they are typically confined to narrowly defined circumstances. For example, Article 12 of UCPD empowers courts and authorities to require traders to substantiate the accuracy of factual claims; Article 6(9) of the Consumer Rights Directive places the burden on traders to demonstrate compliance with pre-contractual information obligations; and Article 11 of the Sale of Goods Directive (Directive 2019/771) presumes that defects appearing within the conformity period existed at delivery.

These reversals of the standard burden of proof are relatively carefully calibrated and to specific situations. However, prescriptive requirements in the DFA would shift the burden of proof from market authorities to traders only for business models based on personalised advertising and behavioural targeting while leaving functionally equivalent practices by other business models subject to the traditional effects-based standard.

[1] Directive 2011/83/EU of the European Parliament and of the Council of 25 October 2011 on consumer rights (Consumer Rights Directive), OJ L 304, 2011.

[2] European Commission, Study to support the fitness check of EU consumer law on digital fairness and report on the application of the Modernisation Directive, 2024.

[3] See Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e.V. v Amazon EU Sàrl (C-649/17), EU:C:2019:576; Content Services Ltd v Bundesarbeitskammer (C-49/11), EU:C:2012:419.

[4] Council Directive 93/13/EEC of 5 April 1993 on unfair terms in consumer contracts, OJ L 95, 1993.

[5] European Data Protection Board, Guidelines 03/2022 on Deceptive Design Patterns in Social Media Platform Interfaces: How to Recognise and Avoid Them, Version 2.0, 14 February 2023.

[6] Directive 2005/29/EC of the European Parliament and of the Council of 11 May 2005 concerning unfair business-to-consumer commercial practices in the internal market (Unfair Commercial Practices Directive), OJ L 149, 2005.

[7] Directive 2011/83/EU of the European Parliament and of the Council of 25 October 2011 on consumer rights (Consumer Rights Directive), OJ L 304, 2011.

[8] European Commission. (2024). Commission staff working document: Fitness check of EU consumer law on digital fairness (SWD(2024) 230 final); BEUC (The European Consumer Organisation), Towards the Digital Fairness Act (BEUC-X-2025-110), 2 December 2025.

[9] See Rewe-Zentralfinanz eG and Rewe-Zentral AG v Landwirtschaftskammer für das Saarland (33/76), EU:C:1976:188, para. 5; Comet BV v Produktschap voor Siergewassen (45/76), EU:C:1976:191, paras 11–18.

3. Is Personalisation Inherently Harmful?

Personalisation – i.e. customisation of content and services – is a long-standing practice across media marketing channels. Far from a new phenomenon, tailoring content and generating recommendations has traditionally been – and remains – a core strategy for engaging audiences and attracting potential customers. Surveys indicate that an overwhelming majority (80 per cent) of European small businesses attract more customers through personalisation; 86 per cent report increased revenue thanks to personalisation, and 73 per cent of businesses would struggle without it.[1]

The 2024 Digital Fairness Fitness Check concluded that personalisation and online profiling allow businesses to persuade consumers more effectively,[2] but also highlighted opaque targeting parameters, inadequate transparency about why specific ads are shown, and the use of behavioural data. The Check identified these practices (alongside dark patterns and addictive design) as the harms most warranting adaptation of the consumer acquis, and the DFA will justify intervention primarily on this basis.

The Commission did not propose any legislative remedies to these problems and found that the three core consumer directives had remained, by and large, relevant and technology-neutral. Regulatory Scrutiny Board went further,[3] issuing a negative opinion in April 2024 as the Check was not clear on “the existence and size of the gap between existing consumer legislation and the digital acquis nor on the scale and development of the problem,” and did “not sufficiently identify and analyse enforcement deficits,” or “the role that Member States national rules and their administrative capacities play.” The second Board opinion was positive but with reservations, instructing Commission’s Directorate-General for Justice and Consumers (DG JUST) to “refrain from making statements and conclusions that imply that attribution was established” and to “refrain from stating or suggesting that the evidence base is robust.[4]”

Thus, the Commission’s internal guardrails conclude that the DG JUST has yet to demonstrate that the fairness deficit requires additional legislation, not least in light of subsequent legislation such as the DSA and the DMA. But whether the harms identified justify lex specialis remains open, which is the question the DFA’s impact assessment (due before the Board on 1 July 2026) must address.

Nonetheless, consumer organisations and the Commission’s own consultation machinery have since presented changes within 12 months of the 2024 Fitness check. For example, BEUC’s 2025 position paper,[5] Towards the Digital Fairness Act, calls for the consideration of a controversial ban on advertising based on tracking or profiling (Recommendation 10); a prohibition on any personalisation that exploits consumer “vulnerabilities,” that is succinctly defined (Recommendation 1); and personalised pricing (Recommendation 9).

BEUC goes on to recommend switching off personalisation of offers by default, requiring all users to opt-in for personalisation (Recommendation 8), and any default feature that may cause addiction-like behaviour (Recommendation 6). Also, the Commission’s own June 2025 research request for the impact assessment lists opt-out options for personalised ads,[6] bans on specific dark patterns, mandatory age assurance, and addictive design features disabled by default among the policy options under active consideration.

3.1 “Default Off” and Ban on Personalised Advertising

Among the above, perhaps one of the most far-reaching ideas in circulation is a ban on all forms of personalised advertising – or, more broadly, a requirement that personalisation across all online services (and not just advertising) be an opt-in feature that the user actively enables.

These restrictions would evolve significantly from the EU acquis, which is built on consent, lawful processing, transparency, and user choice, rather than prohibition. The GDPR recognises consent and legitimate interests as lawful bases for processing,[7] explicitly naming online advertising and profiling, and also provides enhanced rights to users when it takes place or when user behaviour is tracked online.[8] Also, the EPD regulates the collection of data used for personalisation,[9] and the DSA requires transparency on advertising content, the main parameters that determine why a specific advertisement is shown to them, and user control over recommendation systems.[10] In addition, the consumer directives were updated to include additional transparency obligations for personalised ranking and pricing.

Ever since the GDPR entered into force, European regulators, businesses, and users have invested substantial resources and personnel to adapt to its framework, and the European ad-supported media and ad-tech industries are no exception. Under the GDPR, they have implemented consent management platforms, which were also required to undergo successive iterative redesigns by national regulators, assumed greater liability, and effectively ended background tracking in the EU; and national data protection authorities (DPAs) and consumer agencies also provide meticulously detailed guidelines on the whole process, including designs on structural elements and buttons.[11]

The fairness debate and some of the BEUC recommendations frame the issue as though personalisation took place in a legal vacuum, when in fact it is one of the most heavily regulated activities in the EU’s digital rulebook and within a consistent architecture for the protection of fundamental rights that the Union has only recently completed. In particular, the “default off” option was considered – and ultimately rejected by the co-legislators – during the drafting process of the DSA, after the European Data Protection Supervisor argued that recommender systems should rest on opt-in rather than opt-out mechanisms.[12]

A “default-off” duty or a personalised advertising ban, stacked on existing principles and targeted prohibitions, fails to live up to Article 7 TFEU or Article 13(1) TEU that ensures the consistency of EU policies. Especially given that the Fitness Check produced no evidence of a legal gap, and the deliberation under the DSA – and its ultimate rejection – came into full effect that took place only two years ago. A prohibition that the co-legislators declined to write into the DSA – a part of a major change to the EU’s paradigm – cannot be reintroduced two years later as a consumer “fairness” regulation and presented as coherent. Lex posterior (the DFA) should not reverse the rejection when the original text (i.e., the DSA) can be amended.

Given the jurisprudence,  a “default off” or a ban on personalised advertising would commit the Commission to litigation, which might take the better part of a decade.

Here, the CJEU has rarely upheld an outright prohibition on lawful economic activity when a less intrusive instrument was available – notably, the Court has annulled the first Tobacco Advertising Directive,[13] and the Data Retention Directive was a disproportionate interference with fundamental rights.[14] And in the case of the DFA, fundamental rights are in the balance, since advertising is a commercial expression within the scope of Article 11 of the EU Charter of Fundamental Rights (and equivalent Article 10 of the European Convention of Human Rights), and a ban on personalised ads may conflict with Article 16 on the freedom to conduct a business.

Given that fundamental rights are in the balance, as well as the relative importance of the personalisation benefits discussed at the outset, a “default off” option or a ban would not comfortably satisfy a proportionality test before the CJEU. Existing laws (e.g., the GDPR or the targeted measures under the DSA) suggest that less onerous legislative techniques are available. In fact, the existence of a “default off” measure itself suggests there is a less restrictive option than a ban. In turn, permitting personalisation once it is opted in suggests that it is lawful in principle, albeit administratively suppressed.

The evident existence of less restrictive measures also opens the EU up to litigation at the World Trade Organization (WTO), where the EU has the burden of proof – i.e., must prove that there are no less trade-restrictive measures reasonably available to invoke an exception to EU market access commitments on data-processing or advertising services.[15]

3.2 Conflating Personalisation and Manipulation

As the previous reasoning implies, the greater societal issue of fairness cannot be about the well-regulated activity of personalisation in itself. It is about the exploitation of personal or behavioural data to manipulate users into making decisions against their interests – especially when transparency is absent or consent is engineered. Lawful profiling based on personal data or contextual behaviour can occur without coercive, deceptive, or exploitative intent. Manipulation, by contrast, involves the intentional exploitation of cognitive biases or emotional vulnerabilities. Personalisation and manipulation are not the same activity, and once they are conflated, the EU acquis begins to erode.

Their distinction is embedded in the acquis and is reflected in several major legislative instruments. Under the UCPD (Article 5), the AI Act (Article 5(1)), and the DSA (Article 25), manipulation is defined as the material distortion or impairment of a consumer’s ability to make an autonomous decision, not merely influence or persuade the choice. Under all three acts, manipulation must also have a material effect – i.e., the effect threshold is significant, and not just trivial.

Similar to how a personalisation ban collapses the acquis, an approach in which personalisation and manipulation are seen as even vaguely connected – i.e., if the “material distortion” standard is replaced with a presumption that personalisation could be manipulative – would dissolve the UCPD, the AI Act, and the DSA. And, similar to the question about the ban, the dissolution would also occur within less than two years of the DSA’s adoption and within one year of the AI Act. Once again, those who deem personalisation a form of manipulation cannot point to any developments that would justify such a major disruption of acquis that justifies such a legal position.

If the DFA contradicts settled EU doctrine against persuasive relevance or customisation, then an e-commerce site that uses behavioural data from prior purchases stored in a personal profile to suggest recommendations could be treated as “steering” or cognitive exploitation. Under a framework that treats adaptation as suspect, even the perfectly drafted threshold would struggle to distinguish between welfare-enhancing and exploitative adaptation in practice, and create severe enforcement issues: Personalised interfaces reduce information overload, accessibility tools simplify navigation for elderly users, and recommendation systems help consumers find relevant products among millions of irrelevant alternatives.

This is particularly problematic if a supermarket chain engaged in the same practice is deemed “offline”, although its databases and loyalty membership programme are actually managed digitally.

Supermarkets, retail chains and airline loyalty programmes have recorded purchase histories to identify patterns, segment customers into target groups, and tailor personalised offers for half a century. If the true policy objective is to constrain certain “digital-first” firms rather than to upset established personalisation practices, then the DFA would duplicate existing instruments such as the DSA and DMA, which are already tailored to that purpose.

EU legal history offers a lesson on how such vague thresholds have already generated CJEU and national litigation rather than better consumer protection. When the UCTD deliberately left the concept of “unfairness” open-ended, case law had to progressively clarify boundaries that legislators had left undefined,[16] and legal fragmentation persisted for years before the CJEU produced a unifying doctrine – and any conflation of personalisation and manipulation under the DFA forces the acquis to repeat this effort, although the cost was already paid once by consumers while businesses adapted to the most restrictive readings over a generation.

In sum, the central justification and motif of the DFA entail a reversal of this decade-long journey that the EU acquis has already undertaken, for an arguable political objective that is easier to amend under the DSA. Meanwhile, the compliance burden of the DFA falls disproportionately on lawful market participants while illicit actors – that operate outside regulatory scrutiny or enforcement reach – remain largely unaffected. In other words, the DFA’s central animating premise is regulatory failure on an issue that the EU acquis has already solved.

[1] Centre for Information Policy Leadership, The role of personalised digital advertising in European competitiveness (2025).

[2] European Commission, Commission Staff Working Document: Fitness check of EU consumer law on digital fairness (SWD(2024) 230 final), 2024.

[3] European Commission, Regulatory Scrutiny Board, Opinion: Fitness check of consumer law on digital fairness, meeting of 24 April 2024 (SEC(2024) 245 final), 2024.

[4] ibid.

[5] BEUC, Towards the Digital Fairness Act, Position Paper BEUC-X-2025-110, December 2, 2025.

[6] Bertuzzi, L., & Tar, J., Major EU Digital Fairness Act policy options laid out in research request, MLex, 2025.

[7] GDPR Articles 6(1)(a), 6(1)(f), 21, June 18, 2025.

[8] ibid., Recital 58; Article 4(4), 22, Recital 22 and 72; Recital 24.

[9] Article 5(3), Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (E-Privacy Directive), OJ L 201/37,

[10] Articles 26, 27 and 38, Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services (Digital Services Act), OJ L 277, 2022.

[11] See inter alia Commission Nationale de l’Informatique et des Libertés (CNIL), Dark Patterns in Cookie Banners: CNIL Issues Formal Notice to Website Publishers, December 12, 2024; Commission nationale de l’informatique et des libertés (CNIL), Online Targeted Advertisement: What Action Plan for the CNIL?, June 28, 2019; Cookie Information, French Cookie Rules (n.d.); Direction générale de la concurrence, de la consommation et de la répression des fraudes (DGCCRF), Pratiques commerciales trompeuses (n.d.).

[12] European Data Protection Supervisor, Opinion 1/2021 on the Proposal for a Digital Services Act, 2021.

[13] Case C-376/98, Germany v European Parliament and Council

[14] Cases C-293/12 and C-594/12, Digital Rights Ireland Ltd and Seitlinger and Others

[15] Lee-Makiyama, Hindley, Protectionism Online: Internet Censorship and International Trade Law, ECIPE Working Paper No. 12/2009; United States – Measures Affecting the Cross-Border Supply of Gambling and Betting Services, WT/DS285/AB/R

[16] Notably Océano, C-240/98; Pannon GSM, C-243/08; Aziz, C-415/11.

4. How Is “Vulnerability” Enforced?

Further regulatory action rests on the premise that consumers behave differently online than offline, and that technological developments and increased tracking of online behaviour enable businesses to persuade consumers more effectively online.[1] Therefore, consumers are generally more vulnerable online and need enhanced protection.

In addition, specific user conditions make certain groups more vulnerable than others. Vulnerability does not require a loss of legal capacity as consumers may still be vulnerable due to mental or physical infirmity, age or credulity.[2] The UCPD protects identifiable and foreseeable vulnerable groups through these objective criteria. Current proposals by the Commission and BEUC go beyond this approach by relying on broader and more situational forms of vulnerability – making the term less objective and more difficult to enforce in practice.

To a certain extent, this also conflicts with the established definitions of vulnerability under existing laws, such as UCPD Article 5(3), which applies when a practice is likely to materially distort the economic behaviour of the average member of the relevant vulnerable group.[3]

In sum, the current doctrine already recognises vulnerability that involves a demonstrable risk of harm to an identifiable group and a discernible impairment of agency. For instance, DSA already prohibits targeted advertising profiling minors or special categories (such as race, politics, religion, health, and sexual orientation) that are based on GDPR Article 9.[4]

If the DFA departs from this established doctrine by diluting the precision on the vulnerable group – for instance, if the scope for situational vulnerability is expanded, such as temporary emotional or financial distress, otherwise known as “dynamic vulnerability” –  the legal system loses an objective benchmark, and enforcement becomes discretionary on subjective perception.[5] Prevailing legal standards do not accommodate such an approach, as it creates significant operational uncertainty for firms and offers potential conflicts with EU privacy-enhancing technologies policy (such as pseudonymisation and anonymisation).[6]

4.1 Enforcement Issues With Broadening the Scope

If vulnerability is defined broadly, businesses would effectively be required to determine in real time whether a user is “vulnerable” before presenting personalised content. Consequently, services or users must engage in intrusive profiling to recognise vulnerabilities, which directly conflicts with GDPR, EPD, and data minimisation principles.

Regardless of whether the information is accumulated by a service provider or the user (say, a self-declaration of a condition in the browser), the vulnerability identifier would become a veritable treasure trove that incentivises attacks by criminal groups or advanced persistent threat (APT) actors, thereby posing an immediate national security threat.

Also, if a service cannot objectively determine whether a user is “momentarily vulnerable,” practical problems immediately arise: given that vulnerability is an exception (relative to the baseline of a reasonably well-informed average consumer), and under rule of law, the enforcer or the complainant must establish that the trader was aware of a condition that is subjective, transient, or non-verifiable – and that the trader could reasonably be expected to foresee the negative effects of their practices on consumers with that condition.

As a result, misusing the concept of vulnerability can weaken enforceability rather than strengthen protection. And as evidential requirements pose difficulties, EU lawmakers could simply adopt an approach that assumes vulnerability is systemic online – i.e., all users are vulnerable – which would reverse the burden of proof.

The Commission seems persuaded by the notion that all users are inherently vulnerable because they are susceptible to persuasion. The CJEU has already argued that there is a systemic information asymmetry against the consumer,[7] but the case law does not support reading this asymmetry as universal – i.e., applying to all consumer-facing commercial interactions. Nor does it extend to a presumption of vulnerability. By doing so, the presumption de facto immediately collapses the doctrine of vulnerability itself: vulnerability would cease to function as a legally differentiating concept tied to specific conditions and would be legally redundant, as its premise would be transformed into a general condition for market participation.

Furthermore, vulnerability justifies proportionate safeguards relative to the risks, but not every instance of imbalance must lead to a prohibition, or let alone a regulatory solution to rebalance the asymmetry. EU consumer law builds on the unfairness test in the UCTD that is effect-driven – and if vulnerability is construed to encompass ordinary susceptibility to persuasion, EU law slides from harm (effect) prevention to mandates: commercial speech, branding, scarcity cues, and other behavioural techniques are reserved for the offline environment and sanctioned business models.[8]

[1] European Commission, Call for Evidence for an Impact Assessment: Digital Fairness Act, 2024.

[2] Directive 2005/29/EC of the European Parliament and of the Council of 11 May 2005 concerning unfair business-to-consumer commercial practices in the internal market (Unfair Commercial Practices Directive)

[3] ibid.

[4] Arts 26(3) and 28, Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services (Digital Services Act), OJ L 277, 2022.

[5] Digital industry associations, Joint Observations on the Consumer Agenda 2030 (Draft Council Conclusions), February 4, 2026.

[6] ibid.

[7] See inter alia Aziz v Caixa d’Estalvis de Catalunya (C-415/11), EU:C:2013:164; Océano Grupo Editorial SA v Rocío Murciano Quintero (Joined Cases C-240/98–C-244/98), EU:C:2000:346; Pannon GSM Zrt v Erzsébet Sustikné Győrfi (C-243/08), EU:C:2009:350.

[8] Directive 2005/29/EC of the European Parliament and of the Council of 11 May 2005 concerning unfair business-to-consumer commercial practices in the internal market (Unfair Commercial Practices Directive), 2025.

5. What Powers Remain for Member States and the Courts?

The impact of the DFA will not be solely corrective and has institutional implications that extend beyond regulating dark patterns, manipulation, and unfair contractual terms in the digital environment. While the requirements under the DFA will be subject to negotiation during the lawmaking process, its mere form of a regulation (as opposed to a directive) would recalibrate institutional balance, alter the enforcement doctrine, and reshape market structure in ways that extend well beyond the stated objective of addressing unfair commercial practices online.

The well-known subsidiarity test under Article 5(3) TEU requires that the objectives cannot be sufficiently achieved by the Member States and are better achieved at the Union level by reason of scale or effects. In the case of the DFA, the underlying problem identified throughout this paper is not a lack of legal basis at the Member State level, but rather constraints on enforcement capacity within an already harmonised framework. While the DFA likely finds its legal basis under Article 114 TFEU as a necessary harmonisation measure to improve the functioning of the internal market, its objectives go beyond Member State laws with a de facto reallocation of competences from national authorities and courts towards centralised supervision that alters the constitutional balance, without demonstrating that such a shift is necessary or proportionate to achieve its stated objectives.

5.1 Marginalising National Powers

Since the first online banner ad appeared in 1994, the digital advertising market has been completely reshaped, expanding from roughly €99 million in 1995 to €357 billion in 2021 globally.[1] Even in Europe, the digital advertising market continues to grow by 16 per cent, reaching a record market value of €118.9 billion.[2] DFA will inevitably shift national competences in consumer law towards a more centralised model based on EU supervision. Currently, EU law operates through national enforcement and judicial application despite substantive harmonisation under the UCPD and coordination in the CPC Regulation.

At the outset, the DFA that replicates the GDPR enforcement architecture would naturally produce the same institutional outcome, with 27 national authorities exhibiting divergent practices, particularly as enforcement remains fragmented, with national DPAs differing in resources, priorities, or procedural speed. However, recent years have introduced a different institutional model that conferred some direct supervisory powers on the Commission, e.g., under the DSA over Very Large Online Platforms, whereas the DMA assigns exclusive enforcement of gatekeeper obligations to the Commission,[3] with material standards and guidelines set centrally.

The DFA would have a different institutional outcome than DSA since it applies horizontally across online commerce and the advertising market, which currently accounts for 70–80 per cent of total ad space expenditure.[4] As online commerce becomes the standard mode for all retailers (including traditional storefronts), regulatory powers correspondingly shift to the Union level, further eroding Member State powers. Eventually, Member States retain formal competence over residual or offline markets, with increasing fragmentation of offline commercial practices.

This reallocation also affects national competences that are highly politically sensitive, including media and culture, as well as AVMSD, which formally preserves national discretion in culture, language, and media matters.

In practice, Member States may retain authority over media pluralism in doctrine but lose the ability to sustain pluralistic media, since smaller media are more reliant on advertising that allows free access, while data enables advertisers to target audiences more precisely, thereby supporting a wider range of media outlets.[5]

Hence, the DFA de facto shifts the practical authority over how local media are commercialised and financed. Regulations on interface design, advertising practices, and data use affect monetisation models that have a greater first-order effect on revenue generation on national European media than global platforms, since the former cannot compensate for lower margins through expanding into global markets, which is an asymmetrical impact across the EU which is largely ignored in the debate.

5.2 Limiting Judicial Interpretational Powers

Furthermore, the institutional effects of the DFA also apply to the judicial doctrine established by case law on the UCPD. Moving from an ex-post judicial assessment to an ex-ante model is not just costly, but also reduces the space for contextual balancing by national courts. Over time, fairness ceases to evolve through case law and regulatory specifications that are products of intergovernmental negotiations and lobbying by national champions. Whereas the DFA may not formally displace the jurisprudence of the CJEU or national courts, all ex-ante legislation narrows their functional relevance, as consumer protection shifts from case-law-driven evolution to political negotiations of banned practices, thresholds, and exemptions.

The DFA may also shift enforcement away from traditional consumer protection law, which is largely effect-based and focuses on harmful effects. In contrast, ex-ante enforcement focuses on “tick the boxes” design compliance in interface architecture or pro forma risk mitigation activities.[6] As a result, market supervision in the post-Breton era is gradually shifting towards examining compliance (e.g., failure to demonstrate the capacity to produce compliant designs or to conduct adequate risk assessments) rather than merely preventing harm. Experience with the GDPR and other laws shows that, under the ex-ante model, compliance often requires organisational capacity to produce documentation, which benefits large organisations.

5.3 Centralisation and Enforcement

Centralisation without an increase in investigative capacity and technical expertise is likely to raise enforcement thresholds rather than lower them, as it leads to fewer but more politically salient cases. This dynamic is already observable in other areas of EU digital regulation, where supervisory attention gravitates towards large platforms, while the majority of harmful practices occur in diffuse, everyday commercial environments where the vast majority of transgressions ought to occur and where consumers typically spend the majority of their money and time – i.e., grocery stores and household services, such as car loans, telecoms or insurances. The DFA is ultimately different from its predecessors among digital acts, such as the DSA or the DMA, that targeted systemic risks associated with very large (and relatively few) online platforms, whereas the fairness deficit concerns a broader spectrum of actors, including SMEs, non-platform businesses, and both advertising media and advertisers.

[1] European Commission, Study on the impact of recent developments in digital advertising on privacy, publishers and advertisers, 2024.

[2] IAB Europe, IAB Europe AdEx Benchmark 2024 report, 2025.

[3] European Commission, The enforcement framework under the Digital Services Act, 2025.

[4] See IAB, 2025.

[5] European Commission, Annual Colloquium on Fundamental Rights 2016: Media Pluralism and Democracy – Session Ia: Media Pluralism and Independence from Financial Pressures and Constraints, November 17, 2016.

[6] European Commission, Study to Support the Fitness Check of EU Consumer Law on Digital Fairness and Report on the Application of the Modernisation Directive, 2024.

6. Unintended Changes to the Market Structure

The DFA will not operate in isolation. In addition to the existing acquis, the deliberations for the Digital Omnibus Simplification Package (or the Digital Omnibus),[1] precede the DFA, which already doubles down on the existing paradigm of affirmative user choice. The Omnibus aims to end “banner fatigue” by streamlining consent under the GDPR and the EPD so that websites may rely on consent expressed at the level of the operating system (OS) or browser.

The DFA adds a new prompt that structurally encourages rejection, while the Digital Omnibus re-examines where consent is collected, and their combined effect is compounding rather than simplifying: users face layered prompts that drive down consent rates for downstream actors, while the relative advantage shifts to gatekeepers that already control our devices.

6.1 Gatekeepers Above All Gatekeepers

The Digital Omnibus would insert two new provisions into the GDPR. Article 88a, in the GDPR numbering, sets out a narrow whitelist of processing that requires no consent and specifies how consent must be requested when it is required. The more consequential Article 88b sets out how consent, refusal, and objection are to be expressed through “automated, machine-readable means” – i.e., browser settings, the OS user profile, or the EU Digital Identity Wallet under eIDAS 2.0.

In effect, Article 88b designates a substrate layer of US tech giants’ operating systems as a “user-choice” infrastructure, with these firms mediating identity and consent on behalf of the entire open web. Once consent is given or rejected at the browser or OS level, it is reused everywhere else, and the publishers and services that depend on the open web are removed from negotiating consent with their own users, leaving the publishers worse off.[2]

In the same manner that the DFA reverses data protection, the Digital Omnibus is a radical reversal of the EU data regulation regime that ironically set out to favour EU media and businesses. Europe’s attempt to reshape the markets culminated in regulations such as the DSA and DMA, which imposed requirements on gatekeepers and very large online platforms (VLOPs), using carefully calibrated thresholds for user numbers and turnover. However well-intentioned the Digital Omnibus may be, Article 88b designates some of the gatekeepers as legally sanctioned bottlenecks for consent and identity management.

The DFA would further compound this effect as a second prompt at the service-level to opt-out from advertising. If Article 88b and the DFA were to operate in tandem, open-web players would first see their user base filtered for the sake of “simplicity” under the Digital Omnibus, and the remaining users would be filtered again, since the DFA views personalisation as inherently harmful.

All this while the browser- or OS-based ecosystems (whose targeting relies on first-party data within its own walls) never meet either filter.

The DFA and the Omnibus will inevitably transfer revenues from a business model that sustains culturally diverse and pluralistic digital media to OS and browser developers. In April 2021, iOS 14.5 introduced App Tracking Transparency, which required apps to obtain advertising consent through a system prompt controlled by Apple – an opt-in that most users declined. Downstream apps and services lost close to $10 billion in advertising revenue in the second half of 2021,[3] while Apple’s own services business reached $18.3 billion in a single quarter; [4] French and Italian competition authorities have since ruled against the mechanism as an abuse of dominant position that penalised the smallest publishers.[5]

Since advertising remains the primary financing mechanism for local media, the DFA and the Digital Omnibus are intrinsically linked to European linguistic and cultural diversity. Smaller publishers, such as regional and local-language media, are already operating on narrow margins and depend more on advertising-funded models, as their markets or languages are too small for subscription-based models. The Commission and the Council appear to recognise the harm to advertising-funded media and have proposed a carve-out for media service providers under Article 88a(3), which the industry coalition of broadcasters, publishers, and ad-funded media deems unrealistic in practice.[6]

And if the European ad-based businesses are stifled, the surviving model is subscription, which primarily works in major European markets or languages with scale. But even subscription-based models rest on persistent identity, authentication, and billing, and these sit at the device and OS layers as well, where operating systems or app stores take a cut. In conclusion, European publishers that move to a paywall do not automatically create an ecosystem but develop a billing dependency on an OS.

6.2 Contextualisation Builds on Discrimination

While the DFA clearly disfavours personalisation in marketing, non-personalised, contextual advertising – i.e., the placement of ads based on page content rather than user-specific data – is not necessarily a less problematic alternative. Contextual advertising may avoid behavioural tracking but remains a form of targeted communication, in which the targeting logic has merely shifted to traditional target group segmentation. While this may reduce data-processing intensity, contextual advertising does not eliminate persuasive designs or potential manipulation.

Offline advertising formats illustrate how the absence of personal data processing and reliance on contextualisation does not eliminate discriminatory effects. Offline media – such as outdoor, broadcasting, and print media – cannot be customised in real time and must rely exclusively on contextual placement within the ad space. Such “static” media have always relied on clustering individuals into target groups – often via geographic segmentation (through postal codes), income, and other socio-economic variables – as well as movement patterns, places visited or activities at different times of the day (e.g., groups who stay home during the day) that are matched against media reach and penetration. These variables correlate strongly with socio-economic class, language group, ethnicity, and gender.

• Reliance on contextual information, therefore, reinforces structural inequalities, in which attractive offers are selectively marketed to demographics most likely to “convert”, i.e., people with higher disposable incomes and spending habits, almost explicitly favouring men. Contextual advertising is therefore less inclusive: For example, an advantageous sales offer placed in a Dutch-language motoring magazine (or its website) in bilingual Belgium will typically be ineffective at reaching French-speaking women.
• Conversely, contextualisation also leads to less advantageous offers or even manipulative practices aimed at vulnerable demographics – such as offers to purchase gold, high-interest loans, and gambling sites are distributed via direct-mail or text messages in economically vulnerable or migrant communities that underreport fraud, thereby escaping market supervision, or via daytime TV broadcasting that targets unemployed, ill, elderly, or children home from school. Perhaps the most crude and oldest form of contextual exploitation is in supermarkets, which always place candy at the checkout, at a height that crying children can reach.
• The use of personal data also predates the digital economy. Personalised and individualised marketing was championed as “direct marketing” by Lester Wunderman in the 1960s,[7] which in the late 1980s evolved into computerised (but not yet online) customer relationship marketing (CRM): American Airlines began database-driven marketing in 1981,[8] fitting the offer to individual behavioural history.
• Since the 1980s, retail chains have pioneered personalisation through loyalty programmes and coupon offers to collect and exploit personal information. To this day, loyalty cards remain a critical digital data-mining tool for brick-and-mortar stores, serving as marketing infrastructure that enables retailers to invest in customer experience improvements, competitive pricing, and promotional offers.

In conclusion, all services – both “digital-first” and brick-and-mortar businesses – rely on internet-based personalisation to remain relevant, and overly restricting it deteriorates customer experience rather than improving consumer welfare.

Removing personalisation will not eliminate discrimination, but likely to strengthen it through the use of crude socio-economic proxies such as gender, postal codes, and income, resulting in entrenched ethnic exclusion, gender bias, and other forms of discrimination.

[1] European Commission, Proposal amending Regulations 2016/679, 2018/1724, 2018/1725, 2023/2854 and Directives 2002/58/EC, 2022/2555 and 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations 2018/1807, 2019/1150, 2022/868, and Directive 2019/1024 (Digital Omnibus), COM(2025) 837, 2025.

[2] Davies, J., European publishers say the Digital Omnibus ‘cookie fix’ leaves them worse off, Digiday, December 5, 2025.

[3] AppleInsider, Social media firms see $10B cut in ad revenue due to App Tracking Transparency, October 31, 2021

[4] McGee, P., Snap, Facebook, Twitter and YouTube lose nearly $10bn after iPhone privacy changes,

Financial Times, October 31, 2021.

[5] Autorité de la concurrence, Décision n° 25-D-02 du 31 mars 2025 relative à des pratiques mises en œuvre dans le secteur de la publicité sur applications mobiles sur les terminaux iOS, 2015; Autorità Garante della Concorrenza e del Mercato (AGCM), Case A561, 2025.

[6] EBU, EGTA, EPC, European media associations call on the EU to reconsider introducing data-usage consent restrictions in the Digital Omnibus, May 2026. https://www.ebu.ch/news/2026/05/european-media-associations-call-on-the-eu-to-reconsider-introducing-data-usage-consent-restrictions-in-the-digital-omnibus.

[7] Wunderman, L., Direct marketing – The new revolution in selling [Speech], Massachusetts Institute of Technology, Cambridge, MA, United States, November 29, 1967.

[8] De Boer, E. R., & Gudmundsson, S. V., 30 years of frequent flyer programs. Journal of Air Transport Management, 24, 18–24, 2012.

7. Who Bears the Compliance Costs?

As the previous chapters have highlighted, the case of the DFA rests on the proposition that the existing rulebook is inadequate for the digital economy. However, it no longer regulates markets through a single instrument but rather through accumulation: the GDPR, the DSA, the DMA, the AI Act, the Data Act, and now a proposed DFA each sits atop the others.

All EU initiatives are subject to a cost-benefit analysis. For European consumers and users, the question is whether the cumulative returns – i.e., the quality of the outcome – of the EU digital acquis have already passed the point of diminishing returns with each new law. For businesses and policymakers concerned with EU competitiveness and productivity, the question is whether the marginal costs of DFA exceed the marginal benefits – and where those costs are absorbed.

The GDPR offers an empirical reference point for answering that question, as the only horizontal digital rule whose compliance effects have been broad enough and long enough to serve as a baseline. Assuming an increasing compliance cost based on enterprise size, starting from €5,000 per year for the smallest enterprises,[1] and up to €5 million for large-sized enterprises,[2] applied against the EU enterprise structure of the number of firms in each category,[3] yields an estimation of GDPR compliance cost of €544 billion per year. Its significance becomes obvious when benchmarked against other categories of European expenditure: it exceeds EU public and private R&D expenditure (€403 billion) or defence spending (€381 billion).[4]

The conclusion of this analogy is that the European economy already invests more in complying with data protection rules than in innovation or protecting its sovereignty.

And from a law-and-economics perspective, the GDPR is unique in its design because its costs are largely variable, rather than fixed. They take the form of legal review, consent architecture, documentation, auditing, data governance, internal staffing, outside counsel, risk management, and, most importantly, system redesign that affects day-to-day productivity. These costs do not scale proportionally with turnover and are regressive in competitive terms, as a large multinational player that controls the underlying user choice infrastructure amortises them efficiently across markets and revenue streams, whereas a smaller advertising media company must absorb them directly into its margins.

The incremental burden of the DFA may be smaller than that of GDPR, as its direct sector scope is narrower. Nonetheless, the advertising industry is a key input to other sectors, thereby indirectly distorting downstream markets, including the swathe of SME activity in Europe. IAB Europe reports that the European digital advertising market reached €119 billion,[5] and, based on the GDPR example, the DFA would reasonably impose an additional €3–6 billion in compliance, redesign, and liability costs, which amount to up to 5 per cent of that sectoral turnover.

The impact of the DFA on the EU economy takes two channels. First, the direct price increases faced by the sector affect the EU macroeconomics in the margins. Such an effect on consumer prices may indeed be trivial, around 0.1 per cent of aggregate consumption, yet representing an incremental addition to existing inflationary pressures.

Second, digital advertising is not a final consumer good. It is an input into retail, services, media, and a large swathe of SME activity. Subsequently, a rise in the costs or efficiencies of digital advertising propagates through customer acquisition costs, campaign inefficiency, business risks, and reduced targeting precision, all of which affect the margins of other industries, including European media and retail, which operate with slim profit margins as price-takers. For instance, McKinsey estimates that European grocery retail operates at a 2.8 per cent net operating margin.[6]

Estimating the productivity loss step by step, we observe:

• Using Eurostat input–output coefficients, advertising and market research account for 0.7 per cent of all industry inputs. The use of advertising and market research is particularly intensive in broadcasting (12.8 per cent of all production inputs), publishing (4.7 per cent), and retail (0.7 per cent), thereby supporting revenue generation in these sectors.
• A 31 per cent loss in total factor productivity (e-0.37) has been observed in other cases of EU ex-ante[7] Consultancy assessment indicates much higher productivity losses up to 75 per cent for contextual advertising compared to personalised advertising.[8]
• Meanwhile, the elasticity between advertising spending and corporate revenue has been estimated to 0.09 to 0.12 in empirical research.[9]

Table 1: Direct costs and productivity lossesSource: Authors’ calculations based on Eurostat, Sethuraman, et al., Implement Consulting

Productivity losses in the advertising sector would generate revenue losses of €7 to 23 billion annually, in addition to the €3 to 6 billion in direct costs borne by the advertising and ad-tech industry itself.

Taken together, the societal loss is €10 to 29 bn annually (depending on whether the DFA imposes new ex-ante rules or bans personalised ads).

Even on the generous assumption that the DFA would eliminate the entire measured detriment at €7.9 bn from subscription management and cancellation problems identified in the Commission’s Fitness Check, the costs would exceed the benefits several times over.

When a cost shock hits an input critical to revenue generation, these costs may be difficult to pass through to consumers in price-competitive markets. DFA compresses margins, and even a modest deterioration in acquisition efficiency can wipe out a material share of profits. The significance of this result lies not in the isolated impact of a single measure, but in its interaction with an already saturated regulatory environment, as well as the compliance costs of all previous variables from the GDPR and other interventions.

The cumulative effect is also multiplicative rather than additive, particularly in sectors operating on low margins, such as smaller retailers or European publishers confined to national or regional markets, whereas incumbents absorb and distribute these compliance costs across non-EU markets.

In this setting, the DFA does not merely regulate European markets, but systematically favours non-EU players outside its jurisdiction and incentivises further consolidation into larger platforms: When the DFA design-based obligations increase compliance costs, the largest integrated actors can easily offset compliance costs against benefits of the Digital Omnibus, or amortise the cost across their global user bases and existing compliance resources – which European media, retailers and other downstream players cannot.

[1] Secure Privacy, The Cost of GDPR Compliance (n.d.).

[2] See International Association of Privacy Professionals, Should Vendors Be Able to Pass Along Costs of GDPR Compliance? (n.d.); PwC, Privacy Reset: Rethinking Data Protection for a New Era (n.d.).

[3] Eurostat, Enterprise Structure by Size Class, 2025.

[4] Eurostat, R&D Expenditure (n.d.), Council of the European Union, EU Defence in Numbers (n.d.).

[5] IAB Europe, IAB Europe’s 2024 AdEx Benchmark Report: European Digital Advertising Market Surpasses €100bn for the First Time (2024).

[6] McKinsey & Company, State of Grocery Europe 2025, 2025.

[7] Lee-Makiyama, H., Narayanan Gopalakrishnan, Economic Costs of Ex Ante Regulations, Occasional Paper No. 07/2020.

[8] Implement Consulting, A Personal Touch, 2025

[9] Sethuraman, Tellis, Briesch, “How Well Does Advertising Work? Generalizations from Meta-Analysis of Brand Advertising Elasticities”, Journal of Marketing Research 48(3), 2011.

8. Conclusions

For many of the legal questions that have been raised in this report, the answers are as much political as they are legislative. The overall conclusion is that the DFA reframes a consumer protection objective as a question of EU Single Market governance, in ways that would displace established principles underpinning the institutional balance within the EU and consumer protection as a shared competence.

In this regard, the DFA disrupts this existing equilibrium and the subsidiarity principle by reallocating supervisory authority towards the Commission, but only for the online advertising that represents an ever-growing share of the advertising market, leaving Member States competences confined to legacy markets and the diminishing relative share of print and broadcasting media against the online channels.

The question of competence is not confined to the vertical allocation between the EU and the Member States, but also to the horizontal balance between the judiciary and the executive. Rule of law under Montesquieuean principles is fundamentally adjudicative, relying on courts – both national and CJEU – to interpret open-ended thresholds like “misleading” or “unfair” conduct on a case-by-case basis, thereby allowing doctrine to evolve incrementally through jurisprudence in parallel with changing technologies or values.

Rightly or wrongly, the DFA shifts enforcement towards ex-ante, where compliance is assessed against prescriptive design criteria that replace contextual judicial balancing. EU consumer protection is thereby transformed from a rights-based, effects-driven system into a compliance-based “tick the boxes” regime. This trajectory also mirrors developments in data protection, where formal competence remains shared, but centralisation has progressively eroded the powers of national data protection agencies.

It is also clear that the existing directives provide a comprehensive legal basis for addressing unfair commercial practices, including those manifested through interface design, or can be reformed. The EU is not suffering from legal fragmentation – since it is already united by common rules – but rather from judicial and supervisory fragmentation. In other words, the issue is not the absence of rules, but enforcement – i.e., resource limitations. But the EU cannot add cumulative legislation to compensate for the lack of enforcement resources and expect better outcomes. DFA is therefore structurally unlikely to achieve its stated objectives on its own.

This has a bearing on whether the DFA passes the subsidiarity scrutiny, which requires that Union action be justified by demonstrating that the objectives cannot be sufficiently achieved by the Member States. However, the DFA objectives cannot be achieved at the Union level, as the resources (as well as their current constraints) are at the national level. Shifting to a Union-level legislative instrument would not materially improve the ability to detect, prove, or remedy unfair practices.

This question also touches upon a fundamental and constitutional sensitivity for Member States, namely media plurality and cultural policy: Advertising is not merely an industrial activity, but the primary financing mechanism for local media, which is intrinsically linked to linguistic and cultural diversity. By reshaping the conditions under which advertising-funded media operate, the DFA will directly determine which media outlets will remain economically viable.

The DFA may not be a direct EU control of national competences in media or cultural policies, but the economic viability of smaller media would be materially affected by the unintended consequences of EU regulation. By introducing new set of fixed costs that scale with organisational capacity, regulations favour business models that are based on controlling the user choice infrastructure over open-web publishers and small publishers that are already operating with limited margins – especially if advertising-funded models become less viable relative to volume-driven and subscription-based ecosystems.

Finally, the proportionality of the DFA must be assessed against its economic incidence. As the cost analysis in chapter 7 estimates, even a relatively modest additional burden and productivity loss in the advertising sector would generate losses between €10 and 29 billion, which even exceeds the measurable consumer welfare losses it seeks to address. These costs are not additive but multiplicative, as they are layered onto existing obligations under the GDPR, DSA, and related instruments that disincentivise digitalisation.

This does not imply that regulatory intervention is unwarranted, but rather that its design must be calibrated to minimise distortionary effects. For example, providing EU funding for additional enforcement capacity at either the EU or national levels would achieve more durable welfare gains at a fraction of the systemic cost of another layer of regulation. A more coherent reform trajectory would also combine such resources with the strengthening of the CPC system through enhanced investigative powers, procedural streamlining, deterrence capacity, and cross-border reach.

This would entail equipping authorities with robust digital enforcement tools – such as mystery shopping, behavioural testing, algorithmic auditing, and AI-assisted detection – to address evidentiary gaps in online environments; accelerating cross-border procedures through clearer timelines, binding coordinated actions, and cross-border mechanisms to avoid weakest-link enforcement.

Finally, a better cost-benefit ratio for the DFA takes more than lower costs, but also more benefits and consumer welfare generated.

The appropriate policy response lies not in the creation of a sector-specific act, but in the recalibration of the horizontal consumer protection framework, addressing also deceptive practices and exploits of vulnerabilities in the grocery store queue, before the fitting room mirror, or through the loyalty card. A technologically neutral “fairness” reform – call it a Consumer Fairness Act – recasting the UCPD, CRD, and UCTD – and supported by enhanced funding instruments, tools, and CPC coordination – would justify a regulation better aligned with the subsidiarity and proportionality principles.

References

AppleInsider. (2021, October 31). Social media firms see $10B cut in ad revenue due to App Tracking Transparency. https://appleinsider.com/articles/21/10/31/social-media-firms-see-10b-cut-in-ad-revenue-due-to-app-tracking-transparency

Autorité de la concurrence. (2025, March 31). Décision n° 25-D-02 du 31 mars 2025 relative à des pratiques mises en œuvre dans le secteur de la publicité sur applications mobiles sur les terminaux iOS. https://www.autoritedelaconcurrence.fr/en/decision/regarding-practices-implemented-sector-mobile-application-advertising-ios-devices

Autorità Garante della Concorrenza e del Mercato (AGCM). (2025). App Tracking Transparency di Apple (Case A561, Provvedimento n. 30620). https://en.agcm.it/en/media/press-releases/2025/12/A561

Bertuzzi, L., & Tar, J. (2025). Major EU Digital Fairness Act policy options laid out in research request. MLex. https://www.mlex.com/mlex/articles/2354824/major-eu-digital-fairness-act-policy-options-laid-out-in-research-request

BEUC (The European Consumer Organisation). (2025). Towards the Digital Fairness Act (BEUC-X-2025-110). https://www.beuc.eu/sites/default/files/publications/BEUC-X-2025-110_Towards_the_Digital_Fairness_Act.pdf

Centre for Information Policy Leadership. (2025). The role of personalised digital advertising in European competitiveness. https://www.informationpolicycentre.com/uploads/5/7/1/0/57104281/cipl_public_first_impact_of_digital_ads_european_competitiveness_mar25.pdf

Commission Nationale de l’Informatique et des Libertés (CNIL). (2019, June 28). Online targeted advertisement: What action plan for the CNIL? https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil

Commission Nationale de l’Informatique et des Libertés (CNIL). (2024, December 12). Dark Patterns in cookie banners: CNIL issues formal notice to website publishers. https://www.cnil.fr/en/dark-patterns-cookie-banners-cnil-issues-formal-notice-website-publishers

Cookie Information. (n.d.). CNIL cookie compliance: French cookie law explained .https://cookieinformation.com/regulations/cookie-guidelines/french-cookie-rules/

Council of the European Union. (n.d.). EU defence in numbers. https://www.consilium.europa.eu/en/policies/defence-numbers/

Council Directive 93/13/EEC of 5 April 1993 on unfair terms in consumer contracts. Official Journal of the European Communities, L 95 (1993). https://eur-lex.europa.eu/eli/dir/1993/13/oj/eng

Court of Justice of the European Union (CJEU) cases:

Case 33/76, Rewe-Zentralfinanz eG and Rewe-Zentral AG v Landwirtschaftskammer für das Saarland, EU:C:1976:188 (1976).

Case 45/76, Comet BV v Produktschap voor Siergewassen, EU:C:1976:191 (1976).

Case C-376/98, Germany v European Parliament and Council, EU:C:2000:544 (2000).

Joined Cases C-240/98 to C-244/98, Océano Grupo Editorial SA v Rocío Murciano Quintero, EU:C:2000:346 (2000).

Case C-243/08, Pannon GSM Zrt v Erzsébet Sustikné Győrfi, EU:C:2009:350 (2009).

Case C-49/11, Content Services Ltd v Bundesarbeitskammer, EU:C:2012:419 (2012).

Case C-415/11, Mohamed Aziz v Caixa d’Estalvis de Catalunya, Tarragona i Manresa (Catalunyacaixa), EU:C:2013:164 (2013).

Joined Cases C-293/12 and C-594/12, Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and Others, and Seitlinger and Others, EU:C:2014:238 (2014).

Case C-649/17, Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV v Amazon EU Sàrl, EU:C:2019:576 (2019).

Davies, J. (2025, December 5). European publishers say the Digital Omnibus ‘cookie fix’ leaves them worse off. Digiday. https://digiday.com/media/european-publishers-say-the-digital-omnibus-cookie-fix-leaves-them-worse-off/

De Boer, E. R., & Gudmundsson, S. V. (2012). 30 years of frequent flyer programs. Journal of Air Transport Management, 24, 18–24. https://doi.org/10.1016/j.jairtraman.2012.05.003

Digital industry associations. (2026, February 4). Joint observations on the Consumer Agenda 2030 (Draft Council Conclusions).

Direction générale de la concurrence, de la consommation et de la répression des fraudes (DGCCRF). (2025, May 12). Pratiques commerciales trompeuses: les clés pour les reconnaître et s’en prémunir. https://www.economie.gouv.fr/dgccrf/les-fiches-pratiques/pratiques-commerciales-trompeuses-les-cles-pour-les-reconnaitre-et-sen-premunir

Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (e-Privacy Directive). Official Journal of the European Communities, L 201 (2002). https://eur-lex.europa.eu/eli/dir/2002/58/oj

Directive 2005/29/EC of the European Parliament and of the Council of 11 May 2005 concerning unfair business-to-consumer commercial practices in the internal market (Unfair Commercial Practices Directive). Official Journal of the European Union, L 149 (2005). https://eur-lex.europa.eu/eli/dir/2005/29/oj/eng

Directive 2011/83/EU of the European Parliament and of the Council of 25 October 2011 on consumer rights (Consumer Rights Directive). Official Journal of the European Union, L 304 (2011). https://eur-lex.europa.eu/eli/dir/2011/83/oj/eng

Directive 2019/2161 of the European Parliament and of the Council of 27 November 2019 on better enforcement and modernisation of Union consumer protection rules. Official Journal of the European Union, L 328 (2019). https://eur-lex.europa.eu/eli/dir/2019/2161/oj

EBU, EGTA, EPC. (2026, May). European media associations call on the EU to reconsider introducing data-usage consent restrictions in the Digital Omnibus. https://www.ebu.ch/news/2026/05/european-media-associations-call-on-the-eu-to-reconsider-introducing-data-usage-consent-restrictions-in-the-digital-omnibus

European Commission. (2016). Commission staff working document: Guidance on the implementation/application of Directive 2005/29/EC on unfair commercial practices (SWD(2016) 163 final). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52016SC0163

European Commission. (2016, November 17). Annual colloquium on fundamental rights 2016: Media pluralism and democracy – Session Ia: Media pluralism and independence from financial pressures and constraints. https://ec.europa.eu/newsroom/just/items/31198/en

European Commission. (2024). Call for evidence for an impact assessment: Digital Fairness Act. https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14622-Digital-Fairness-Act_en

European Commission. (2024). Commission staff working document: Executive summary of the fitness check of EU consumer law on digital fairness (SWD(2024) 231 final). https://commission.europa.eu/document/download/d3b2a18b-7eec-4fe6-8421-8961a9ceb288_en

European Commission. (2024). Study on the impact of recent developments in digital advertising on privacy, publishers and advertisers. Publications Office of the European Union. https://op.europa.eu/en/publication-detail/-/publication/8b950a43-a141-11ed-b508-01aa75ed71a1/language-en

European Commission. (2024). Study to support the fitness check of EU consumer law on digital fairness and report on the application of the Modernisation Directive. https://commission.europa.eu/publications/study-support-fitness-check-eu-consumer-law-digital-fairness-and-report-application-modernisation_en

European Commission. (2024). Commission staff working document: Fitness check of EU consumer law on digital fairness (SWD(2024) 230 final). https://commission.europa.eu/document/download/707d7404-78e5-4aef-acfa-82b4cf639f55_en

European Commission. (2025). Proposal for a regulation amending Regulations (EU) 2016/679, 2018/1724, 2018/1725, 2023/2854 and Directives 2002/58/EC, 2022/2555 and 2022/2557 as regards the simplification of the digital legislative framework (Digital Omnibus) (COM(2025) 837 final). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52025PC0837

European Commission, Regulatory Scrutiny Board. (2024). Opinion: Fitness check of consumer law on digital fairness (SEC(2024) 245 final). https://commission.europa.eu/law/law-topic/consumer-protection-law/review-eu-consumer-law_en

European Data Protection Supervisor. (2021). Opinion 1/2021 on the proposal for a Digital Services Act.https://www.edps.europa.eu/system/files/2021-02/edps-2021-01-opinion-on-digital-services-act-package_en.pdf

European Commission. (2025). An agile digital rulebook for the EU. https://digital-strategy.ec.europa.eu/en/policies/digital-rulebook

European Commission. (2025). Digital Omnibus Regulation Proposal. In Shaping Europe’s digital future. https://digital-strategy.ec.europa.eu/en/library/digital-omnibus-regulation-proposal

European Commission. (2025). The enforcement framework under the Digital Services Act. In Shaping Europe’s digital future. https://digital-strategy.ec.europa.eu/en/policies/dsa-enforcement

European Data Protection Board. (2023). Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: How to recognise and avoid them (Version 2.0). https://www.edpb.europa.eu/system/files/2023-02/edpb_03-2022_guidelines_on_deceptive_design_patterns_in_social_media_platform_interfaces_v2_en_0.pdf

European Parliament. (2016). Protection of vulnerable adults: European added value assessment accompanying the European Parliament’s legislative initiative report (PE 581.388). https://www.europarl.europa.eu/RegData/etudes/STUD/2016/581388/EPRS_STU(2016)581388_EN.pdf

Eurostat. (n.d.). Enterprise statistics by size class and NACE Rev. 2 activity (from 2021 onwards). https://doi.org/10.2908/SBS_SC_OVW

Eurostat. (n.d.). R&D expenditure. https://ec.europa.eu/eurostat/statistics-explained/index.php?title=R%26D_expenditure

France Num. (n.d.). Se lancer dans le e-commerce : quelles obligations pour les professionnels ? https://www.francenum.gouv.fr/guides-et-conseils/developpement-commercial/site-e-commerce/se-lancer-dans-le-e-commerce-quelles

IAB Europe. (2024). IAB Europe’s 2024 AdEx benchmark report: European digital advertising market surpasses €100bn for the first time. https://iabeurope.eu/iab-europes-2024-adex-benchmark-report-european-digital-advertising-market-surpasses-e100bn-for-the-first-time/

IAB Europe. (2025). IAB Europe AdEx benchmark 2024 report. https://iabeurope.eu/knowledge_hub/iab-europe-adex-benchmark-2024-report/

Implement Consulting. (2025). A Personal Touch. https://implementconsultinggroup.com/article/personalised-advertising

International Association of Privacy Professionals. (n.d.). Should vendors be able to pass along costs of GDPR compliance? https://iapp.org/news/a/should-vendors-be-able-to-pass-along-costs-of-gdpr-compliance

Lee-Makiyama, H., & Hindley, B. (2009). Protectionism online: Internet censorship and international trade law (ECIPE Working Paper No. 12/2009). European Centre for International Political Economy. https://ecipe.org/wp-content/uploads/2014/12/protectionism-online-internet-censorship-and-international-trade-law.pdf

Lee-Makiyama, H., & Narayanan, B. (2020). Economic costs of ex ante regulations (Occasional Paper No. 07/2020). European Centre for International Political Economy. https://ecipe.org/wp-content/uploads/2020/10/ECI_20_OccPaper_07_2020_Ex-ante_Regulations_LY06.pdf

Lipsman, A. (2024). Walmart TV & the pioneers of in-store retail media. Media, Ads + Commerce (Substack). https://mediaadsandcommerce.substack.com/p/walmart-tv-and-the-pioneers-of-in

McGee, P. (2021, October 31),  Snap, Facebook, Twitter and YouTube lose nearly $10bn after iPhone privacy changes. Financial Times. https://www.ft.com/content/4c19e387-ee1a-41d8-8dd2-bc6c302ee58e

McKinsey & Company. (2025). State of grocery Europe 2025. https://www.mckinsey.com/industries/retail/our-insights/state-of-grocery-europe-report

PwC. (n.d.). Privacy reset: Rethinking data protection for a new era. https://www.pwc.com/us/en/services/consulting/cybersecurity-risk-regulatory/library/privacy-reset.html

Sethuraman, R., Tellis, G. J., & Briesch, R. A. (2011). How well does advertising work? Generalizations from meta-analysis of brand advertising elasticities. Journal of Marketing Research, 48(3), 457–471. https://doi.org/10.1509/jmkr.48.3.457

UK Competition and Markets Authority. (2020). Online platforms and digital advertising market study: Final report. https://assets.publishing.service.gov.uk/media/5fa557668fa8f5788db46efc/Final_report_Digital_ALT_TEXT.pdf

Dispute Settlement Body, United States — Measures Affecting the Cross-Border Supply of Gambling and Betting Services, WT/DS285/AB/R (WTO Appellate Body, 2005).

Wunderman, L. (1967, November 29). Direct marketing – The new revolution in selling [Speech], Massachusetts Institute of Technology, Cambridge, MA, United States.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union, L 119 (2016). http://data.europa.eu/eli/reg/2016/679/oj

Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services and amending Directive 2000/31/EC (Digital Services Act). Official Journal of the European Union, L 277 (2022). https://eur-lex.europa.eu/eli/reg/2022/2065/oj