DMCCA 2024: How the CMA Enforces Dark Patterns on UK Websites

The Digital Markets, Competition and Consumers Act 2024 is the most significant change to UK consumer protection enforcement in a generation. Its most consequential reform for UK website operators is not the substantive rules themselves, which largely restate and extend existing prohibitions, but the enforcement mechanism: the Competition and Markets Authority can now fine businesses directly without going to court.

For a technical check of whether your site includes patterns the CMA has identified as non-compliant, run a free scan at /uk/en/scan.

What the DMCCA 2024 is and what it replaced

The Digital Markets, Competition and Consumers Act 2024 received Royal Assent in May 2024 and came into force in stages. Part 4 of the Act governs unfair commercial practices. It replaces and extends the Consumer Protection from Unfair Trading Regulations 2008, which transposed the EU Unfair Commercial Practices Directive.

The substantive prohibitions on unfair commercial practices were not dramatically changed: misleading actions, misleading omissions and aggressive commercial practices were already prohibited. What changed materially is that the DMCCA adds specific targeted provisions on drip pricing, fake reviews and subscription contract design, and gives the CMA direct enforcement powers that did not exist under the previous regime.

Under the pre-DMCCA framework, the CMA could investigate and reach undertakings but needed to apply to court to impose financial penalties. This made the enforcement process slow and expensive. The DMCCA's direct-fining power means the CMA can now act more like the ICO does in data-protection enforcement: investigate, issue a notice of intent, allow representations, and issue a penalty notice without court proceedings.

Drip pricing

Drip pricing occurs where a headline price is advertised but mandatory fees are added incrementally as the consumer progresses through the checkout. The final price paid is materially higher than the initial price displayed. The CMA's draft guidance on DMCCA Part 4 identifies drip pricing as a priority enforcement area.

Under the DMCCA, displaying a price that omits mandatory components is a misleading action under section 230. Mandatory components include booking fees, service charges, administration charges and any other cost the consumer must pay as part of the transaction. These must be included in the headline price or clearly displayed alongside it from the first moment the price is shown to the consumer.

The e-commerce patterns most commonly investigated in the CMA's pre-DMCCA and transitional enforcement work include: flight and event ticketing sites that add per-booking fees only in the final checkout step, subscription services that advertise a monthly price before tax and platform fees, and accommodation platforms that show nightly rates before mandatory cleaning or resort fees.

A compliant implementation shows the total mandatory price, including all compulsory components, from the first price disclosure. Where a dynamic component such as delivery cost cannot be calculated until the consumer selects their location, that is acceptable, but the existence and basis of the additional charge must be disclosed early.

Fake reviews

The DMCCA explicitly prohibits commissioning fake reviews, submitting fake reviews and hosting reviews without taking reasonable steps to prevent fake ones. Schedule 19 of the DMCCA lists fake reviews as a specific commercial practice that is unfair in all circumstances.

For a UK website that publishes customer reviews, this creates an obligation to have a verification process. Platforms cannot simply display any submitted review without any checks. The standard is "reasonable steps," which the CMA has indicated includes checking reviewer identity against purchase history for verified purchases, implementing detection mechanisms for bulk or patterned submissions, and having a process for removing reviews identified as fake.

The prohibition also extends to incentivised reviews where the incentive is not disclosed. Asking customers to leave a review in exchange for a discount or gift, without disclosing this in the review itself, creates a misleading impression about the authenticity of the review.

Subscription traps

The DMCCA's subscription contract provisions specifically govern auto-renewing contracts. The provisions require: clear information about ongoing charges before sign-up, a reminder notice before each renewal that the consumer did not specifically select, and an easy cancellation mechanism that is at least as simple to use as the sign-up process.

The subscription provisions were delayed in commencement and are expected to take effect in Autumn 2026. Verify the current position at legislation.gov.uk before assuming they are in force.

Even before formal commencement of the subscription-specific provisions, subscription designs that make cancellation unreasonably difficult fall under the general unfair commercial practices prohibitions. A multi-step cancellation flow that requires a phone call when sign-up was online, or that presents multiple retention offers and barriers before allowing cancellation, is potentially an aggressive commercial practice under the pre-existing DMCCA provisions.

The CMA's new direct enforcement powers

The DMCCA's most operationally significant reform for businesses is Schedule 6, which gives the CMA direct enforcement powers. The CMA can now:

Investigate suspected unfair commercial practices, issue information notices requiring evidence, conduct formal investigations, issue a provisional decision with proposed remedies, allow representations from the business, and issue a final infringement decision with financial penalties, all without court proceedings.

Penalties under DMCCA Part 4 can reach 10% of global annual turnover. For individual officers of businesses found responsible, penalties can reach £300,000. Daily penalties for continuing breaches can be up to 5% of daily turnover.

Businesses have the right to appeal CMA decisions to the Competition Appeal Tribunal. Unlike ICO appeals (where the fine is suspended pending appeal), the DMCCA enforcement regime requires checking current procedural rules on payment timing at appeal.

Practical patterns to audit on your site

The CMA's enforcement focus, based on its published market investigations and case decisions, has consistently targeted practices in e-commerce, ticketing, subscriptions and digital services. The checklist for a UK e-commerce site includes:

Whether the checkout total matches the first price displayed to the consumer, with any difference fully accounted for by optional selections (not mandatory fees added later). Whether any mandatory fee that was not in the first-displayed price is disclosed clearly before the consumer commits to purchase. Whether customer reviews come from verified purchasers or have a disclosed methodology. Whether subscription sign-up and cancellation are equivalent in effort. Whether countdown timers or stock scarcity indicators reflect genuine real-world constraints or are artificially generated to create pressure. Manufactured urgency ("only 2 left" when inventory is not genuinely limited) is a misleading action under DMCCA Part 4.

CMA enforcement before DMCCA: the track record

The CMA's pre-DMCCA enforcement under the Consumer Protection from Unfair Trading Regulations 2008 and the Enterprise Act 2002 established the patterns the new regime builds on. Cases that are directly relevant to website design include:

The CMA's investigation into online secondary ticket platforms, which found drip pricing and misleading availability indicators, resulted in undertakings requiring transparent fee disclosure before 2024. The CMA's investigation into fake online reviews across multiple sectors produced reports identifying the scale of the problem and the business models that enabled it. These investigations produced no fines under the old regime because the CMA lacked direct-fining power. The DMCCA changes that structural limitation.

The CMA's investigation into subscription services, opened before DMCCA commencement, found patterns including: sign-up processes that were significantly easier than cancellation, retention offers that delayed but did not enable cancellation, and notification practices that failed to remind consumers before renewal charges. These findings informed the DMCCA subscription contract provisions.

For current open cases and published guidance, the CMA's case pages at gov.uk/cma-cases are the authoritative reference. DMCCA enforcement is new and the published decision register will grow through 2026 and 2027.

How DMCCA differs from EU DSA and UCPD

UK businesses with EU customers may be subject to the EU's Digital Services Act and the EU's Unfair Commercial Practices Directive alongside DMCCA. These are separate regimes with overlapping but distinct obligations.

The EU Unfair Commercial Practices Directive (UCPD), as revised by Directive 2019/2161 (the Omnibus Directive), covers similar ground to DMCCA Part 4 but is implemented differently across EU member states. France's DGCCRF, Germany's Wettbewerbszentrale and the Netherlands' ACM each enforce the UCPD under their national implementing legislation, with different fine structures and enforcement styles.

The EU DSA imposes additional obligations on platforms and intermediary services based on user numbers and platform type. DMCCA does not have a direct equivalent to the DSA's large-platform obligations, though the CMA's concurrent powers under the digital markets provisions of DMCCA create some functional overlap for the largest platforms.

For UK businesses selling only to UK consumers, DMCCA is the relevant regime. For businesses with EU customers, both DMCCA and the applicable EU national implementations of UCPD may apply simultaneously. The substantive prohibitions on drip pricing and fake reviews are similar enough that a single set of compliant practices typically satisfies both regimes, but the enforcement exposure is doubled.

For how the DMCCA fine structure works in detail, see DMCCA fines: what 10% global turnover means. For the data-protection overlap in customer-data handling during checkout, see UK GDPR fines under the ICO.

---

This is technical analysis, not legal advice. Consult a solicitor for specific guidance on DMCCA compliance for your business.