Digital Fairness Act and gambling: what the EU proposal means for operators

The Digital Fairness Act proposal presented by the European Commission on 11 November 2026 is the most far-reaching reform of EU consumer law in twenty years, and gambling operators are squarely within its scope. Nothing in the text published so far carves out gambling. Every B2C practice is covered, from the bonus pop-up to the account closure flow.

The Digital Fairness Act turns the Unfair Commercial Practices Directive into a regulation that applies directly in every Member State, replacing 27 national transposing regimes. The sections below set out the six areas of the Digital Fairness Act that matter most for gambling, and what operators should start doing now rather than once the final text lands.

1. Digital Fairness Act and gambling interfaces: dark patterns and “fairness by design”

The proposal introduces a general prohibition on interface designs that deceive, manipulate or materially distort consumer decisions. On top of that, it expands the blacklist of practices considered unfair in all circumstances. The annexes reported before adoption include fake contact notifications, persistent scarcity messages at checkout and opt-out procedures that are disproportionately complicated.

Mapped onto a gambling product, the list of banned practices include:

• Bonus countdown timers, such as “offer expires in 5 minutes“, where the deadline is artificial or resets on the next login.
• Pre-ticked or pre-filled deposit amounts, especially when the default sits above the player’s usual deposit.
• Confirm-shaming, meaning wording that makes a player feel foolish for declining a promotion or for setting a deposit limit.
• Friction in withdrawals and account closure, including extra steps, buried menus or retention offers that appear exactly when the player tries to leave.

The cancellation rule deserves attention. Under the proposal, ending a contract should not be materially harder than entering it, and messages along the lines of “we are sad to see you go” would no longer be allowed. Account closure on most gambling platforms takes far longer than registration, so the gap will have to be closed.

Several gambling regulators already look at these features through licence conditions. The difference is that the DFA would make them a consumer law infringement, enforceable across the EU by consumer authorities that do not need a gambling mandate. Italian practice shows how quickly this can happen: the Supreme Court has already held that a checkbox is not enough to approve online contract terms, and the new digital withdrawal obligation points in the same direction.

2. Addictive design: switch-off tools for notifications, nudges and streaks

The Commission chose not to ban autoplay or infinite scrolling outright as those provided by by online slots. Instead, traders would have to give users accessible tools to switch off features designed, or reasonably foreseeable, to drive compulsive or excessive use. The examples in the proposal include automatic playback, notifications unrelated to the user’s own activity, engagement incentives such as streak rewards, and systems that simulate personal relationships. Specific restrictions for minors are left to the proposed EU KIDS Act.

For a casino or betting app, the translation is straightforward:

• push notifications on new markets, odds boosts or jackpot levels;
• “come back” messages triggered by inactivity;
• daily login rewards and loyalty streaks that are lost if a day is skipped;
• chat features or “VIP host” messaging that mimics a personal relationship.

None of these features is banned. The player, however, must be able to turn each one off easily, and the switch must work. A preference centre buried four levels deep in the settings menu is unlikely to pass the test.

This is the area where review should start now. CRM and retention teams usually own these tools, and they are rarely involved in regulatory projects until late. The “reasonably foreseeable” standard also means that intent is irrelevant: a feature built for engagement that in practice drives compulsive play falls within scope.

3. Paid variable rewards and virtual currencies: where gaming meets gambling

The proposal introduces the notion of paid-for variable reward systems, meaning virtual items offering random rewards or variable odds, and expressly names loot boxes, wheels of fortune and collectible card packs. The rules are written with video games in mind. They still reach operators running social casino products, gamified loyalty programmes or free-to-play spin mechanics.

The main obligations are:

1. a ban on paid variable reward systems, pay-to-win and pay-to-progress mechanics for products directed at minors;
2. for adults, disclosure of reward probabilities and tools to disable these features;
3. prominent disclosure of the real-money value of anything bought with virtual currency, in the currency used to buy it;
4. paid virtual currencies disabled by default for minors, with activation subject to parental approval (Yahoo/dpa).

One detail is easy to miss and matters for the sector. According to the published text, loyalty programme points are excluded from the definition of virtual currency. Operators should not read that as a safe harbour for loyalty schemes as a whole: a “spin the wheel” mechanic paid for with points or deposits can still qualify as a variable reward system.

The open question is where these consumer rules stop and national gambling law begins. Belgium and the Netherlands have long argued over whether certain loot boxes are games of chance under their gambling acts, and other Member States have reached the opposite conclusion. The DFA does not settle that question. It creates a parallel layer, so a mechanic can be lawful under gambling law and still breach consumer law, or the reverse.

The reaction from the games industry was immediate: Video Games Europe and the European Games Developer Federation called the proposal unworkable and disproportionate. The lobbying battle in Parliament will focus on this chapter, and gambling operators with social or free-to-play products have an interest in following it closely.

4. Influencer marketing: an EU-wide tool against banned gambling promotion

The influencer chapter has three elements that matter for gambling:

• commercial content must be clearly and prominently labelled as advertising or a commercial collaboration;
• influencers may not pressure adults into purchases, nor directly urge minors to buy;
• promoting products whose advertising is banned under EU or national law is prohibited, and brands and agencies share responsibility for compliance (proposal overview).

The third point is the one to watch in Italy. Gambling advertising has been largely banned since the Dignity Decree (Article 9 of Decree Law 87/2018), and AGCOM has so far carried the enforcement burden alone. The DFA would give consumer authorities a second, EU-wide basis to act against influencers and streamers promoting gambling, including the ones pushing offshore .com sites from outside Italy. That sits alongside the debates already open at national level, such as the AGCOM consultation on the infotainment exemption and the ECJ case on Google’s liability for gambling advertising.

The shared liability rule also reaches the affiliate ecosystem. An operator that pays an affiliate who then works with content creators would struggle to argue that the content was outside its control. Affiliate agreements will need audit rights, labelling obligations and termination clauses that actually get used.

5. Personalisation and vulnerable consumers: the responsible gambling paradox

The proposal sets targeted limits on personalisation rather than a general ban:

• profiling-based personalised pricing is prohibited where it is reasonably likely to harm a minor or a vulnerable consumer;
• profiling-based advertising is prohibited where the trader knows with reasonable certainty that the user is a minor;
• advertising based on special categories of personal data is restricted where it is reasonably likely to cause harm (proposal overview).

Bonuses, free bets and tailored cashback offers are, in substance, personalised prices. Operators that calibrate them on behavioural data should review that logic now.

Gambling operators are in an unusual position here. Responsible gambling rules require them to monitor play and to identify markers of harm. Once an operator’s own systems flag a player as showing signs of vulnerability, it will be hard to argue that it did not know. The same data set that proves compliance with the gambling licence can then prove a breach of consumer law if the player keeps receiving tailored incentives.

The practical answer is to connect the two functions. Risk flags produced by safer gambling tools should switch off personalised promotions automatically, with a documented trail. Where health-related inferences are involved, GDPR exposure follows as well, and the EDPB’s new fine methodology shows that regulators are not becoming more lenient.

6. Enforcement, reach and fines: why offshore operators should pay attention

The Digital Fairness Act comes with a reform of the Consumer Protection Cooperation (CPC) Regulation, and that reform changes who enforces:

• the Commission could investigate large-scale cross-border infringements directly, with fines of up to 6% of worldwide annual turnover;
• for relevant cross-border infringements, national penalty regimes would need maximum fines of at least 4% of annual turnover in the Member States concerned;
• traders established outside the EU that target EU consumers would fall within scope and would have to appoint a legal representative in the EU.

The legal representative requirement is the point offshore operators should not underestimate. Brands active in EU markets without local licences have relied for years on the distance between their place of establishment and national regulators. A mandatory EU representative gives consumer authorities a counterpart to serve and sanction, and the trend is visible in gambling enforcement too, as shown by the Dutch regulator’s recent actions against suppliers.

Timeline

The proposal now moves to the European Parliament and the Council. Under the draft, the regulation would enter into force 20 days after publication and apply 12 months later. Before the proposal, CMS did not expect the DFA to be in force before the end of 2028. A realistic planning assumption is application in 2029, which is one product cycle away.

How gambling operators should prepare for the Digital Fairness Act

The text will change in Parliament and Council, but the direction will not. Product roadmaps run on 12 to 24 month cycles, so features designed today will go live under the new rules. A pragmatic preparation plan looks like this:

1. Map the customer journey against the blacklist. Registration, deposit, bonus opt-in, limit setting, withdrawal and account closure should each be screened for artificial urgency, pre-selected values, confirm-shaming and asymmetric friction.
2. Build switch-off controls into the product now. Push notifications, reactivation campaigns, streaks and VIP messaging need a simple and working off switch for each feature, and the CRM team should own it.
3. Inventory every random reward mechanic. Wheels, mystery boxes, free spins tied to deposits and social casino coins should be classified against the definition of paid variable reward system and virtual currency, with odds and real-money values ready to disclose.
4. Connect safer gambling data with marketing logic. Vulnerability markers should automatically suppress personalised bonuses and tailored pricing, with an audit trail that can be shown to a consumer authority.
5. Renegotiate influencer and affiliate contracts. Labelling duties, approval workflows, audit rights and a ban on promotion in markets where gambling advertising is prohibited should be written in, since liability will be shared.
6. Review the EU footprint. Operators serving EU consumers from outside the Union should plan for the legal representative requirement and assess which entity will face enforcement.
7. Engage in the legislative process. The boundary between consumer law and national gambling law is still open, and the sector has a short window to argue for coherence with existing licensing regimes.

The Digital Fairness Act will not replace gambling regulation. It will sit on top of it, enforced by different authorities with different priorities. Operators that treat it as a design brief today will spend far less than those that wait for the first consumer authority investigation.