Brussels Targets Loot Boxes and Dark Patterns With Digital Fairness Act

The European Commission has unveiled the Digital Fairness Act (DFA), a draft regulation aimed squarely at the design tricks that keep users online longer and spending more than they intend. The proposal targets misleading prices and availability claims, addictive mechanics such as video game loot boxes, undisclosed influencer marketing and algorithmic rabbit holes that trap users in endless loops on platforms like YouTube, TikTok and Meta’s services. Brussels estimates the measures could save European consumers as much as €13.7 billion a year.

• Dark patterns banned: Fake scarcity claims, pre-ticked boxes and guilt-tripping messages would be prohibited outright across the EU.
• Loot boxes under scrutiny: Paid random-reward systems must disclose odds, cannot be offered to minors and must be switchable off by any user.
• Heavy penalties: Companies breaching the rules could face fines of up to 6% of their worldwide annual turnover.

It is, on paper, one of Brussels’ most ambitious attempts to regulate not what platforms sell, but how they push people to consume it.

What the DFA would outlaw

The scope is broad and reaches some of the most visible corners of the digital economy. According to reporting on the draft, companies such as Duolingo, Strava and Ticketmaster could fall under the new rules. The Commission says the law will “protect consumers of all ages” and create fairer competition for businesses.

The proposal replaces the 2005 Unfair Commercial Practices Directive with directly applicable rules across the bloc, adding specific provisions for digital commercial practices. Beyond dark patterns, it would force platforms to remind users when a free trial is about to convert into a paid subscription, require explicit confirmation before charging, and give consumers a route to human customer service when automated channels fail.

Article 15 of the draft tackles paid “variable reward systems” — virtual items offering random rewards or variable odds bought with money or paid-for virtual currency. Loot boxes, wheels of fortune and collectible card packs are named as examples. Traders would have to disclose the types of items available and the probability of obtaining them, clearly and prominently, before any spending takes place.

“Variable reward systems that offer random rewards or variable odds, such as loot boxes, wheels of fortune, or collectible card packs, are prone not only to cause unwanted spending by consumers but can also be harmful due to the fact that they share the speculative features of gambling.”

The opt-out tools would apply to all consumers, not just children, and the Commission could extend the list of switchable features later. Lawyers following the file note that autoplay, push notifications a user never triggered, and login rewards or streaks are among the mechanics in scope.

Special protections for minors

Children receive the toughest treatment. Paid variable reward systems could not be offered in products directed at minors, or where a trader knows with reasonable certainty that a child is using the product. Pay-to-win and pay-to-progress mechanics would be banned for under-18s, and for products aimed at minors, paid virtual currencies would be off by default until a parent or guardian consents.

Whether a product is aimed at children would be judged on objective signs, and age-rating systems such as PEGI can count. Legal analysis suggests games rated 18+ would face fewer limits than all-ages titles — a detail that could nudge developers toward higher ratings.

Influencer transparency is another pillar. Posts promoting products would need clear labels such as “advertisement”, a rule that also covers gambling-related promotions. The Commission worries that children may view influencers as friends and fail to recognise commercial recommendations, and that creators can exploit that trust by obscuring a post’s commercial purpose.

Timeline, fines and industry pushback

The DFA is not law yet. It is a proposal that must pass through the European Parliament and the Council, where measures could change or be dropped. If adopted in its current form, the regulation would apply 12 months after entering into force.

Consumer groups have welcomed the text. The European consumer organisation BEUC called it a “much needed” tool to give people back control over the time and money they spend online. Michael McGrath, the EU commissioner responsible for consumer protection, framed it around household budgets: “At a time when households are under cost-of-living pressure, consumers should be able to trust that the prices they see are the prices they pay.”

The tech lobby is less enthusiastic. CCIA Europe warns the law overlaps with existing rules such as the Digital Services Act and data protection regulation, creating “a maze of enforcement” with multiple authorities overseeing similar practices. Davide Galli, president of the European SME association SMEunited, argued that Europe already has one of the world’s strongest consumer protection models: “It doesn’t lack rules, it lacks enforcement.”

Parts of the video game industry have already called restrictions on virtual currencies, loot boxes and microtransactions “unviable, unjustified and disproportionate”. Industry lawyers counter that loot boxes differ from regulated gambling because they generally allow no cash-out and never leave the buyer empty-handed.

The DFA attacks real problems with commendable ambition and an obvious risk of overreach. Curbing dark patterns, loot boxes that normalise chance among minors and disguised advertising is welcome: these are practices engineered to exploit human biases, and the “free market” argument weakens when the board is rigged. Yet the line between “addictive design” and “a well-made product” is slippery — a Duolingo streak or a Strava notification motivates some users and stresses others — and legislating there risks drowning the good with the bad. Europe has a record of reaching these fights first, for better and worse. The spirit of the DFA looks right; the devil, as ever in Brussels, will be in the fine print and the years of negotiation ahead.