Following commencement of the new digital markets regime and merger control threshold reforms in January 2025, the CMA saw the
long-awaited consumer protection aspects of the Digital Markets Competition and Consumers Act (the “DMCC Act”)
come into force on Sunday 6 April 2025. This part of the DMCC Act restates the key provisions of consumer protection laws (
with some important amendments and additions) and provides the CMA with direct enforcement powers. As a result, the CMA is now able to decide itself whether consumer protection laws have been breached (rather than having to pursue infringements via the courts), with powers to impose a range of remedies including financial penalties (of up to 10% of global turnover), directions and customer compensation measures.
In recent days, the CMA has published a package of consumer protection guidance alongside an
“Approach” document setting out its planned approach to enforcement and engagement over the next 12 months. While much has been made of the government’s recent drive to reduce regulatory burden, a joint statement by the CMA and the Department for Business & Trade confirms that the CMA’s intended approach to enforcement in this area is strongly endorsed by the government. These powers are viewed as an important tool to increase not only consumer confidence, but also business confidence, thus contributing to economic growth. Businesses should carefully consider the CMA’s guidance and planned approach as a new era of enforcement gets underway.
We set out below what is expected from the CMA in the coming year, including some key headlines from the final guidance, and what businesses can and should be doing now that these powers are in force.
The CMA’s approach to consumer protection: what can we expect?
Priority areas for enforcement and compliance activity
The CMA’s Approach document makes clear that, in the short term, the regulator will focus on the most egregious practices where behaviour clearly infringes the law, such as:
- “Aggressive sales practices” that target vulnerable consumers;
- Hidden fees (that only appear near the end of a purchase process);
- Providing “objectively false” information to consumers;
- Unfair and imbalanced contract terms; and
- Behaviour that has already been the subject of enforcement action, such as drip pricing and fake reviews.
The CMA will continue to prioritise sectors that represent “essential spend” for consumers, with a selection of cases that aim to drive benefits for consumers and businesses across all four UK nations. When making prioritisation decisions, the CMA will also take into account factors such as the number of consumers that the practices are likely to impact, as well as any impact on vulnerable consumers; and whether its actions may benefit “competitive and fair-dealing” businesses who deserve to operate on a level playing field.
Fake review and drip pricing: high priority areas, but a phased approach
While the CMA has already taken enforcement action in relation to fake reviews (e.g. against
Amazon, Google and other online platforms) and hidden charges / “drip pricing” (such as investigations into
car rental intermediaries and
hotel booking websites), the DMCC Act includes specific provisions prohibiting these practices. In response to the CMA’s consultation on its draft guidance on these topics, many respondents raised concerns and questions regarding the implications of these new provisions and the CMA’s planned approach.
While these are clearly high priority areas for the CMA (having been the subject of previous enforcement action), the CMA has – recognising the concerns and questions raised – proposed something of a phased approach to enforcement over the coming months, as follows:
- For fake reviews, the CMA has confirmed that for the first three months of the new regime (i.e. until July 2025), it will focus on supporting businesses with compliance rather than enforcement, recognising that some businesses may need to make changes to their compliance infrastructure. The CMA has also provided additional examples in its final guidance and adopted a more pragmatic tone in some areas. For example, whilst businesses are still required to screen for fake reviews on their sites, it now seems that this need not be the “rigorous” or “regular and comprehensive” screening which was proposed in draft guidance. Similarly, the CMA has acknowledged that the extent to which businesses screen for and act to prevent the publication of banned reviews and misleading review information should be reasonable and proportionate in the circumstances of the case.
- For drip pricing, the CMA acknowledges that what is required of businesses is clearer for certain practices than others. As a result, it has confirmed that any enforcement action in the short term will only apply to drip pricing practices that are clearly prohibited and covered in the new guidance. For those practices where there is continued uncertainty (e.g. fixed term periodic contracts) the CMA will run a further guidance consultation in the summer and publish finalised guidance in the autumn. The CMA will not take any enforcement action on activities to be covered in this future guidance until its final version is published.
Improved processes and enhanced engagement
From a procedural perspective, as part of its renewed focus on growth the CMA has committed to process improvements centred around the so-called “4Ps”, namely pace, predictability, proportionality and process. In its Approach document, the CMA is clear that these commitments to better process will also apply to its consumer protection function, highlighting the following:
- Investigations will be conducted as efficiently as possible. This will include streamlining cases to focus on key areas of concern, keeping businesses up to date on investigation timelines and seeking to resolve suitable cases as early as possible (for example via settlement). The CMA also mentions implementing a “new case management system” to help reduce administrative tasks for both the CMA and businesses under investigation.
- The CMA’s guidance is designed to help improve predictability, with a number of helpful clarifications having been introduced in the final guidance (building on consultation responses). These include additional practical examples in a number of areas (for example fake reviews and online choice architecture), additional detail on the approach to assessing the scale of an infringement when calculating penalties, and helpful clarification that the CMA does not intend to use dawn raid powers in consumer protection cases unless necessary.
- Proportionality will be a key factor underpinning remedy decisions (including penalty levels). Not every case will result in a fine, with the CMA indicating that it will also prioritise consumer redress measures and measures to secure future compliance. Where penalties are imposed, the CMA has noted that they will likely to be lower in the first 12 months than in years to follow, as its penalty powers apply only to conduct that occurs after 6 April 2025. That being said, prior conduct may be taken into account when setting a penalty level as an aggravating factor (for example if the business concerned has failed to comply with previous enforcement action) or a mitigating factor (for example if the business can demonstrate that it had already commenced action to correct the infringing conduct).
- In a welcome move, the CMA has also confirmed that it is planning extensive engagement with businesses and consumer groups. As part of this engagement effort, the CMA has indicated that it is keen to understand where stakeholders would find more guidance helpful, as well as to explore opportunities for businesses to seek advice in areas lacking legal precedent.
Collaboration without borders
The Approach document makes it clear that stakeholders can expect the CMA to work closely with other UK regulators (e.g. the FCA), enforcement bodies (e.g. Trading Standards) and consumer groups (e.g. Citizens Advice and Which?). Its collaboration efforts will not be limited to domestic action: the CMA will work with international partners including via its participation in the International Consumer Protection Enforcement Network, the OECD and the UN Conference on Trade and Development.
Next steps for businesses
Many, if not most, consumer-facing businesses will already be well-versed in consumer protection laws. However, the DMCC Act represents a step change in risk profile, with the CMA (supported by government) clearly eager to get to work in promoting effective compliance and kickstarting enhanced enforcement and engagement activities. The CMA’s emphasis on the potential for consumer protection powers to be used as a force for benefiting not only end consumers, but also as a means of ensuring a level of playing field among businesses, is notable.
The CMA has recognised the limited guidance around existing consumer case law which has prompted it to get on the front foot in its development of guidance and ensure that firms have clear guardrails, particularly with regard to the most problematic conduct. The 4Ps are now firmly embedded in the CMA’s process and practices, and the CMA’s apparent focus on remediation as a priority (alongside continued engagement) is to be welcomed, in particular given the significant sanctioning powers now in the CMA toolkit.
Businesses are advised to take stock of the CMA’s updated guidance to ensure that internal compliance approaches to “at risk” trading practices are fit for purpose (for example regarding pricing, promotional practices / urgency claims, green claims online choice architecture, reviews). With further engagement, consultation and guidance to come on important topics, this is a subject area that is likely to remain high on the agenda for the CMA, businesses and consumer organisations in the months ahead.