Evidency / Blog / DMCC Act: what obligations do businesses face under the UK consumer protection reform?

DMCC Act: what obligations do businesses face under the UK consumer protection reform?

Reading time: 6 min
Modification date: 30 April 2026

Following the EU Omnibus Directive in 2022, the United Kingdom has in turn significantly strengthened its consumer protection framework. On 6 April 2025, a substantial part of the Digital Markets, Competition and Consumers Act 2024 (DMCC Act)[1] came into force. This legislation reshapes the rules governing unfair commercial practices and grants the Competition and Markets Authority (CMA) unprecedented powers to impose direct sanctions.

Its scope is not limited to UK-based businesses: any organisation directing its activities towards consumers located in the United Kingdom is concerned, irrespective of its place of establishment.

This article first outlines the scope of the legislation and its implementation timetable, before examining the operational obligations (drip pricing, reviews, subscriptions) and the practical implications in terms of enforcement risk and compliance.

dmcc act uk horodatage qualifié prix promotionnels

Key points on the DMCC Act

  • Drip pricing prohibited: the total price must be displayed from the first price indication, including all mandatory charges.
  • Fake reviews prohibited: it is forbidden to publish, commission or facilitate them. Platforms are subject to an active prevention obligation.
  • Subscription contracts: enhanced regime expected from autumn 2026 at the earliest.
  • Sanctions: fines of up to 10% of global annual turnover, imposed directly by the CMA.
  • Extraterritorial scope: any business selling to UK consumers is concerned.

What is the DMCC Act and who does it apply to?

Adopted on 24 May 2024 (date of Royal Assent), the Act covers three distinct areas. Part 1 establishes a regulatory regime for digital markets, applicable to large platforms designated as having “Strategic Market Status”. Parts 2 and 3 reform UK competition law. Part 4, which is the focus of this article, reshapes the consumer protection framework.

This latter part replaces the Consumer Protection from Unfair Trading Regulations 2008 (CPRs)[2]. It retains the “transactional decision test”, under which a commercial practice is unfair if it leads the average consumer to take a decision they would not otherwise have taken. It also introduces new specific prohibitions, detailed below.

The extraterritorial scope of the DMCC Act requires particular attention. The CMA may act against any individual or entity directing activities towards UK consumers and may request information from businesses established outside the United Kingdom, provided a sufficient connection with the UK can be established. For a European company selling into the UK, compliance with the DMCC Act is therefore not optional.

Implementation timetable

The DMCC Act is being implemented in stages:

  • 24 May 2024: Royal Assent of the DMCC Act
  • 6 April 2025: entry into force of provisions on unfair commercial practices (drip pricing, fake reviews) and the CMA’s direct enforcement powers
  • Autumn 2026 (at the earliest): entry into force of provisions on subscription contracts, initially planned for spring 2026 but postponed by the Department for Business and Trade

First year of the DMCC Act: initial outcomes

Between April 2025 and April 2026, the CMA reported significant activity[3]: 157 warning letters were issued, 14 formal investigations were opened, 46 information requests were made, and £4.7 million in fines were imposed, alongside £760,000 reimbursed to consumers.

Drip pricing, fake reviews, subscription traps: three practices now regulated

The DMCC Act targets three categories of commercial practices that undermine consumer trust. Each is subject to distinct obligations, set out in the CMA’s guidance on unfair commercial practices[4].

Prohibition of drip pricing: displaying the total price from the outset

Drip pricing consists of presenting an attractive headline price, followed by the progressive disclosure of mandatory additional charges throughout the purchasing process. The consumer only discovers the actual amount at the point of checkout, when they are already engaged in the transaction.

The DMCC Act explicitly prohibits this practice. Where any price information is displayed, whether in advertising, on a product page or in search results, the total price must be shown. This price must include all charges that the consumer will necessarily have to pay (administration fees, mandatory delivery charges, taxes, etc.). Only genuinely optional extras may be presented separately.

This requirement aligns with the obligation imposed within the European Union by the Omnibus Directive[5], which requires disclosure of the lowest price applied in the 30 days preceding a promotion. The objective is comparable: ensuring price transparency. The mechanism differs, however: the DMCC Act focuses on real-time display of the total price, whereas the Omnibus Directive regulates promotional price references.

Fake reviews: an active prevention obligation

The DMCC Act goes beyond a simple prohibition on publishing fake reviews. It prohibits submitting, commissioning or facilitating misleading reviews. It also prohibits concealing the fact that a review has been incentivised.

Platforms hosting consumer reviews are subject to an enhanced obligation of means. They must implement “reasonable and proportionate” measures to detect and remove fraudulent reviews. This is not a passive duty of oversight. The CMA expects businesses to maintain documented policies, detection mechanisms and removal procedures. The burden of demonstrating that such measures exist and are effective rests with the business itself.

Subscriptions: towards the end of “subscription traps”

The third component of the DMCC Act concerns automatically renewing subscription contracts. These provisions are not yet in force. Their implementation, initially scheduled for spring 2026, has been postponed to autumn 2026 at the earliest by the Department for Business and Trade, pending secondary legislation required for their application.

The forthcoming regime will require businesses to:

  • provide clear and distinct pre-contractual information on renewal conditions,
  • send reminders at regular intervals prior to each renewal,
  • grant consumers a 14-day cancellation right upon renewal of contracts with an initial term of 12 months or more.

Enhanced sanctions and expanded CMA powers

Prior to the DMCC Act, the CMA could not directly sanction a business for a breach of consumer law. It had to obtain a court order in advance under Part 8 of the Enterprise Act 2002[6]. This mechanism, both slow and complex, limited enforcement effectiveness.

The DMCC Act changes this approach. The CMA now has direct administrative enforcement powers, aligned with its existing powers in competition law. It may investigate, determine an infringement and impose sanctions without prior court involvement.

Financial penalties reach significant levels: up to 10% of global annual turnover for businesses, and up to £300,000 for individuals involved in an infringement. In cases of continued non-compliance with an order, the CMA may impose daily penalties of up to £15,000 or 5% of global daily turnover. In the most serious cases, criminal proceedings remain possible.

The CMA has set out its enforcement strategy in guidance published in April 2025[7]. It indicated that initial action would focus on the most evident breaches:

  • aggressive commercial practices targeting vulnerable consumers,
  • objectively false information,
  • hidden charges,
  • manifestly unbalanced contractual terms.

At the same time, it has announced a supportive approach to compliance, particularly regarding drip pricing and fake reviews, as these new rules require a period of adjustment.

How can compliance with the DMCC Act be anticipated?

For businesses selling to UK consumers, compliance with the DMCC Act relies on a practical capability: demonstrating, at any time, that their commercial practices comply with legal requirements. In the event of an investigation or dispute, it is not sufficient to assert that a price was accurate or that reviews were genuine. This must be evidenced through dated, reliable and verifiable records.

This evidential requirement applies first to pricing transparency. How can a business demonstrate, six months after a promotional campaign, that the price displayed at a given moment complied with the obligation to display the total price? The same reasoning applies to review moderation policies: the business must be able to show that its preventive measures existed and were effective at the relevant time.

Qualified timestamping: establishing proof of compliance

Qualified timestamping directly addresses this requirement for pre-constituted evidence. This cryptographic mechanism associates a reliable date and an integrity fingerprint with a digital record, whether a displayed price, a pricing schedule, a moderation policy or a verification log. The resulting timestamp token certifies that the data existed in that exact form at the indicated time and has not been altered subsequently.

For businesses already compliant with the Omnibus Directive in the European Union, the DMCC Act represents its UK counterpart. The evidential mechanisms involved are similar: price traceability, data integrity and a reliable date for supporting records. Qualified timestamping solutions, such as those provided by Evidency, make it possible to centralise this approach and build evidential files suitable for both European and UK markets.

DMCC Act and regulatory convergence: why structuring compliance now matters

The DMCC Act forms part of a broader regulatory movement shared with the European Union. The Omnibus Directive, Digital Markets Act and Digital Services Act all reflect a convergence towards increased requirements for transparency, fairness and traceability in digital commercial relationships. For businesses operating across both European and UK markets, this convergence supports the adoption of a unified approach to digital evidence.

The UK regime is still in its early stages. The CMA has announced a gradual escalation of its enforcement activity, guidance on drip pricing remains under consultation, and the subscription provisions are not yet in force. Businesses that structure their compliance now, by documenting their practices and establishing dated and reliable evidence, will be better positioned as enforcement intensifies.

Disclaimer

The opinions, presentations, figures and estimates set forth on the website including in the blog are for informational purposes only and should not be construed as legal advice. For legal advice you should contact a legal professional in your jurisdiction.

The use of any content on this website, including in this blog, for any commercial purposes, including resale, is prohibited, unless permission is first obtained from Evidency. Request for permission should state the purpose and the extent of the reproduction. For non-commercial purposes, all material in this publication may be freely quoted or reprinted, but acknowledgement is required, together with a link to this website.

References

[1] Digital Markets, Competition and Consumers Act 2024, c. 13. Available at: https://www.legislation.gov.uk/ukpga/2024/13/contents

[2] Consumer Protection from Unfair Trading Regulations 2008, SI 2008/1277 (texte abrogé et remplacé). Available at: https://www.legislation.gov.uk/uksi/2008/1277/contents

[3] https://competitionandmarkets.blog.gov.uk/2026/04/17/direct-consumer-enforcement-one-year-on/

[4] CMA, Unfair commercial practices (CMA207), november 2025. Available at: https://www.gov.uk/government/publications/unfair-commercial-practices-cma207/unfair-commercial-practices

[5] Directive (EU) 2019/2161 of the European Parliament and of the Council of 27 November 2019 amending Council Directive 93/13/EEC and Directives 98/6/EC, 2005/29/EC and 2011/83/EU of the European Parliament and of the Council as regards better enforcement and modernisation of Union consumer protection rules. Available at: https://eur-lex.europa.eu/legal-content/FR/ALL/?uri=oj:JOL_2019_328_R_0002

[6] Enterprise Act 2002 (Part 8, ancien régime d’enforcement) : Enterprise Act 2002, c. 40. Available at: https://www.legislation.gov.uk/ukpga/2002/40/contents

[7] CMA, Direct consumer enforcement guidance (CMA200), avril 2025. Available at: https://www.gov.uk/government/publications/direct-consumer-enforcement-guidance-cma200

  • Stéphane

    Stéphane is the Managing Director of Evidency. Formerly the Chief Data Officer at The Economist Group, he has over 20 years of international experience in the technology and media sectors.

Recommended
for you

Cryptography applied to evidence: definitions of key concepts

Cryptography applied to evidence: definitions of key concepts

Key points to remember about cryptography applied to evidence Key points to remember about cryptography applied to evidence A hash function transforms data into a fixed-size hash value; it is designed to operate in one direction. The hash serves as a content...

Copyright: how to evidence human authorship in AI-generated content

Copyright: how to evidence human authorship in AI-generated content

Copyright protection, in the spirit of the Berne Convention, is in principle not subject to formalities. In theory, registration is not required for the right to exist. The World Intellectual Property Organization summarises this principle by stating that protection...

Timestamping (RFC 3161): formats and terminology

Timestamping (RFC 3161): formats and terminology

Key takeaways to note about timestamping The TSA (Time-Stamping Authority) is the provider that issues timestamp tokens in accordance with a standard protocol (most commonly RFC 3161). The TSP protocol defines a request (fingerprint, algorithm, nonce, policy, etc.)...