Contribution to the European Commission’s consultation on the Digital Fairness Act

We appreciate the European Commission’s efforts to address consumer risks in digital markets that are not fully covered by existing regulations. The European Commission’s “Fitness Check of EU Consumer Law on Digital Fairness” highlighted that enforcement in consumer protection has been inconsistent and unclear, and that there are legal uncertainties as to how exactly different regulations apply to complex digital marketplaces. We therefore fully support the objectives of the Digital Fairness Act (DFA), particularly the prohibition of manipulative design features (dark patterns), liability for unmarked or harmful influencer marketing, protection against addictive design of applications and digital services, stricter regulation of personalisation of prices and advertising, and protection of minors as a priority. In the following sections, and after some general comments on digital fairness, effective enforcement and potential overlaps with the DSA and other texts, we share more specific remarks on dark patterns, addictive designs, targeted advertising and the protection of minors. We close this contribution with a call to ensure that any new policy initiative in the tech regulation area does benefit Internet users and does not only lead to “compliance for the sake of compliance”. 

The concept of “digital fairness” 

While we appreciate the Commission’s aim to address gaps in consumer protection/consumer law, we would strongly recommend focusing on the wider concept of ‘digital fairness’ that includes an understanding of fairness by design. In its fitness check report, the Commission defines digital fairness as “ensuring a high level of consumer protection in the digital environment”.1 We believe that fairness is not only a question of protection or security, but also of equity and accessibility. Products and services should be designed and operated with fairness at their core. Consumers should not bear the sole burden of protecting themselves from potential online harms.  

On effective enforcement 

Consumer law is currently not fit for purpose to address many of the challenges posed in the digital fairness “fitness check” and therefore must be urgently updated and upgraded. However, it is not entirely clear whether the challenges identified in the “fitness check” stem from gaps in the law or from inconsistent and insufficient enforcement. Considering the fragmented regulatory landscape, the question is how to make enforcement most effective. It is uncertain how the DFA could contribute to the effectiveness of national authorities tackling consumer cases. Improving coordination between authorities tackling consumer cases, resource allocation, and information sharing should therefore be at the centre of the law’s enforcement strategy.  

Coordination networks already exist to enable cooperation between the EU and the national levels in many of the existing tech regulation legal regimes (General Data Protection Regulation (GDPR), Audio-Visual Media Services Directive (AVMSD), Digital Services Act (DSA), European Media Freedom Act (EMFA)). Joint priority setting is desirable to clarify responsibility and better target enforcement resources. This could be in the form of a coordination hub between various already existing networks (e.g. the European Regulators Group for Audiovisual Media Services (ERGA), the European Data Protection Board (EDPB), the European Board of Digital Services). If this governance model works well, this hub could serve as the premises for an EU-wide ‘digital regulator’.  

In addition, we encourage the Commission to consider setting up a central complaint mechanism to facilitate users in filing complaints under the various legal regimes. 

Treat overlaps with the DSA and other existing legislation with care 

The DSA has already introduced new provisions around manipulative behaviours, specifically under Article 25 which states:  

“Providers of online platforms shall not design, organise or operate their online interfaces in a way that deceives or manipulates the recipients of their service or in a way that otherwise materially distorts or impairs the ability of the recipients of their service to make free and informed decisions”.  

Compared to the DSA, which focuses on online services and risks for users (the recipients of the services) that stem from those, the DFA aims to focus on users as consumers. In addition, the DFA may also cover businesses, as the consultation is said to be designed to receive feedback from relevant stakeholders on how to ensure fairness “for consumers and businesses in business-to-consumer transactions in the digital single market”.  

To avoid overlaps, serious consideration should be given to assessing the areas, scope and regulated entities that are already covered by each of the existing pieces of legislation regulating the online world (e.g. the AVMSD addresses ‘audiovisual media services’, the GDPR addresses data ‘controllers’ and ‘processors’, the DSA addresses ‘information society services’, ‘intermediary services’ and ‘online platforms’. Oftentimes, these will overlap, but not always. This is a topic that interface will look into in the coming months, with the objective of producing an overview of existing overlaps and inconsistencies in terms of definitions, main beneficiaries, regulated actors, etc., and deriving recommendation to key actors from it.  

The drafting of the DFA, whatever its form, should for, instance, be an opportunity to clarify what the definition of an average consumer entails in the digital space. For instance, is it ‘any natural person who is acting for purposes which are outside their trade, business, craft, or profession’, as defined in the DSA (Article 3(c))? Is it something else?  

On dark patterns 

In the digital fairness fitness check, dark patterns are described as ‘commercial practices deployed through the structure, design or functionalities of digital interfaces or system architecture that can influence consumers to take decisions they would not have taken otherwise’.  

While the DSA prohibits online platforms from using designs, functionalities or interfaces that ‘deceive or manipulate recipients of the service, or otherwise materially distort or impair their ability to make free and informed decisions’ (Art. 25), it excludes cross-sector practices already covered by the Unfair Commercial Practices Directive (UCPD) and the GDPR.2 Thus, in the case of dark patterns, conflicts of norms primarily arise from the fact that some legal frameworks impose stricter or more specific obligations than others. This creates legal uncertainty and leaves space for interpretation. The DSA could have been the framework to put in place rules specifically targeting dark patterns, but the regulation defers to the UCPD and the GDPR instead of banning certain dark patterns more widely. Therefore, the DFA has the potential to fill this gap by providing guidance on outlining what falls under ‘deceptive dark patterns’. Furthermore, we support an update of the UCPD’s blacklist of unfair commercial practices to ban dark patterns explicitly. In line with our suggestion to widen the scope of the definition of digital fairness by including fairness by design and by default, we push for an equal display of options, easily understandable language and accessibility, and design choice transparency. 

On addictive designs 

While the DSA does not outright ban addictive designs, the regulation recognises that the design of recommender systems, for instance, should be taken into account when assessing systemic risks, especially to minors and mental health. Plus, the DSA requires risk assessment and mitigation for features likely to cause overuse, promoting more transparent and user-controlled design, especially around recommender systems. The European Commission’s guidelines on measures to ensure a high level of privacy, safety and security for minors online introduce additional best practices around addictive designs (see hereafter). If the DFA aims to tackle addictive designs, these existing measures under the DSA should be taken into consideration in order to avoid creating unnecessary additional layers of obligations. It is especially important to stress here that the DSA came into force quite recently and has not yet reached its full potential, which impedes the assessment of its efficiency (or lack thereof) in this regard. 

On influencer marketing 

We recommend aligning influencer disclosures and commercial communications with the provisions of the AVMSD and the DSA, but to close existing gaps by providing guidance on what falls under ‘influencer marketing’ (paid content that affects purchase behaviours) and by using standardised labels across interfaces, formats and languages. 

On targeted advertising 

The DSA does cover targeted advertising to some extent. Its Article 26 requires online platforms to clearly label advertisements so that users can immediately recognise them as ads, know on whose behalf they are displayed, and, if different, who paid for them. Users must also be given meaningful information about why the ad was shown to them, including the main targeting criteria, and how they can adjust those settings. In relation to the previous point on influencer marketing (see above), platforms must provide a way for users to declare when their own content is commercial and ensure that such content is also clearly marked for others. Article 26 of the DSA also prohibits the use of sensitive personal data, such as data related to health, religion, or sexual orientation, for profiling-based advertising. 

Article 39 of the DSA introduces additional requirements for Very Large Online Platforms (VLOPs) and Search Engines (VLOSEs), which must keep a public, searchable ad repository covering ads shown, for auditing and research purposes. As for Article 28(2), it bans targeting minors with ads based on profiling.  

Overall, our recommendation regarding targeted advertising is to implement an opt-in obligation for all users for any targeted advertising activity (with additional checks for minors under a certain age, in accordance with Article 8 of the GDPR). This should not lead to the putting in place of ‘pay or consent’ type of mechanisms but actually giving the possibility to users to choose if they want to receive targeted advertising based on profiling or not. For instance, the choice could be between receiving targeted advertising based on profiling or receiving non-targeted advertising. 

Protection of minors 

Article 28 of the DSA and more specifically the accompanying guidelines from the European Commission on measures to ensure a high level of privacy, safety and security for minors online already include key insights on what would constitute a ‘fair’ digital environment for children. In particular, section 6 of the guidelines includes recommendations on service design, which deserve close attention. One example is the recommendation to ‘[s]et accounts for minors to the highest level of privacy, safety and security by default’, which should in fact be extended to all users, irrespective of their age. Turning off push notifications and the default autoplay of videos and hosting live streams are some examples.  

Overall, we encourage the European Commission to consider extending some of its recommendations, especially those on ‘Online interface design and other tools’ (section 6.4) to all users, not just minors. Although children are particularly vulnerable online, all users, irrespective of their age, deserve to benefit from a high level of privacy, safety and security online. Making sure digital services are privacy-preserving, safe and secure by default and by design would circumvent the need to implement age assurance mechanisms, which may sound nice on paper but are challenging to implement and enforce (and not necessarily a good idea in the first place, as shown in our recent policy brief Mind the Gap: Age Assurance and the Limits of Enforcement Under EU Law).  

Simplification 

We would like to stress the specific policy and geopolitical context in which this consultation is taking place. Following the publication of various reports, in particular the so-called Draghi report on EU Competitiveness, and amidst mounting pressure both from big tech actors and the U.S. Administration to ‘deregulate’, EU decision makers are considering simplifying the Union’s ‘digital rulebook’. While some amount of simplification is indeed needed to reinforce users’ rights in the digital sphere, we ask the European Commission not to give in to the temptation of introducing simplification measures that would solely reply to the industry’s calls to ‘reduce the burden to comply’. Simplification efforts should address unnecessary burdens only, not unpleasant ones. Their main goal should be to ensure that Internet users benefit from a better online experience, that they have increased knowledge about their rights online and that they know how to leverage them and who to turn to if they are being infringed upon.  

For these reasons, and as the consultation is designed as an impact assessment on how to improve consumer protection and increase consumers’ trust, with the option of ‘assessing the need for targeted prohibitions’, we call for a simplification in the sense of avoiding overlaps with already existing tech regulation and aligning key definitions used in the GDPR, UCDP, DSA, DMA and Artificial Intelligence (AI) Act. The DFA can complement the existing regulatory framework by introducing stronger rules to prevent manipulative and unfair commercial practices, including those leveraging AI, showing consumers what their rights are, who they can reach out to if they are not respected, and what the mechanisms for redress are.