DMCC Act overhauls UK consumer law enforcement and expands consumer rights

The Digital Markets, Competition and Consumers (DMCC) Act 2024, which was enacted on 24 May 2024, is to come into effect in phases via further secondary legislation to follow – with the provisions relating to consumer law enforcement expected to take effect in April 2025, the UK government recently said. The Act makes provision for the strengthening of consumer protection enforcement powers, particularly those of the CMA. It also restates and expands certain substantive consumer law provisions to further boost consumer protection. These developments will substantially increase non-compliance risk for businesses and individuals that infringe consumer law.

The DMCC Act will significantly impact all businesses which sell to UK consumers, particularly as it places consumer protection law on a par with competition law in terms of the strength of the CMA’s enforcement powers. It is critical that business get up to speed with these important changes and prioritise compliance efforts.

Dual-track enforcement

The DMCC Act creates a dual regime for consumer law enforcement by firstly revoking and restating the pre-existing court-based regime under Part 8 of Enterprise Act 2002 (EA02); and secondly creating a completely new direct enforcement regime that will be exclusively administered by the CMA.

The new legislation also introduces, for the first time, the power to impose substantial civil penalties on businesses or individuals, or both, for infringing consumer law. Penalties can be imposed by the court, or by the CMA, depending on which enforcement procedure applies.

The CMA, as well as certain other designated enforcers, can use the enhanced court-based regime to enforce consumer protection laws specified in Schedule 15 of the DMCC Act. However, the enforcers must inform the CMA before taking such action and the CMA may decide to take over the investigation itself. Conversely, the new CMA direct enforcement regime removes the need for lengthy court proceedings and applies to consumer protection laws enumerated in Schedule 16 of the DMCC Act.

This publication focuses on the CMA’s direct enforcement powers, which the DMCC Act has placed on a par with the CMA’s competition law powers under the Competition Act 1998 (CA98), and the civil, but not criminal, sanctions the CMA may be able to impose. The CMA’s competition law powers under the CA98, as well as the EA02, have also been further strengthen by the DMCC Act.

Consumer protection enforcement becomes the new antitrust

Under the DMCC Act, the CMA can directly enforce consumer protection laws and impose fines without first needing to obtain a court order if it has reasonable grounds for suspecting that a person has engaged, is engaging or is likely to engage in a commercial practice that constitutes a relevant infringement – or a person is an accessory to such a practice. The CMA cannot, however, impose monetary penalties in respect of conduct that has not yet occurred. The new powers are closely modelled on the CMA’s existing antitrust investigation and enforcement powers and procedures under the CA98. 

In July, the CMA opened a consultation on draft new guidance and procedural rules which detail how the new regime will operate, from the pre-launch and information gathering stage, through to formal case opening and the investigation process, to the issuing of provisional infringement notices (PINs) and final infringement notices (FINs). The use of various enforcement orders and directions, the acceptance of undertakings and case settlements, the formulation and imposition of remedies and redressive measures, and the calculation and imposition of civil penalties for substantive and administrative breaches, are all covered. The draft guidance and procedural rules also detail how parties can expect to engage with the CMA throughout the investigation and enforcement process, including the parties’ procedural rights and their rights of appeal before a court after the CMA renders its final decision.

The DMCC Act also strengthens the CMA’s pre-existing investigatory and information-gathering powers under consumer law, by introducing substantial monetary penalties that the CMA can impose on businesses and/or individuals for failing to comply with mandatory information notices. It also allows such notices to be served on parties located outside the UK, provided there is a “UK connection” – a concept that is broadly defined.

Undertakings, settlement and remedies

Under the direct enforcement regime, the CMA can resolve cases through undertakings or settlement. Undertakings are legally binding commitments offered by parties to modify their practices to address CMA concerns without admitting any wrongdoing. Settlement is where a party admits infringement and agrees to a streamlined enforcement procedure in exchange for a penalty discount. There are a range of different remedies the CMA can turn to for resolving cases.

The CMA may impose various directions, including enhanced consumer measures (ECMs), and can issue online interface notices (OINs), to address consumer law concerns or breaches.

ECMs can require a party to compensate or otherwise redress affected consumers (redress measures); to improve compliance with consumer law and reduce the likelihood of further breaches (compliance measures); and/or to help consumers obtain relevant market information enabling them to make better purchasing decisions (choice measures). OINs give the CMA broad powers to impose obligations on parties – including third parties based outside the UK – to take or refrain from taking certain actions with respect to websites, applications or other digital content used for the promotion or supply of goods, services or digital content to UK consumers. 

Penalties for businesses

The CMA’s new powers to directly impose monetary penalties for consumer law breaches represent one of the most significant changes introduced by the DMCC Act. Previously, the CMA could only establish that consumer law had been infringed by taking court action, and neither the CMA nor the courts were able to actually impose monetary penalties for such breaches.  

The CMA can now directly fine businesses up to £300,000 or 10% of their global annual turnover, whichever is higher, for substantive infringements of any consumer protection rules set out in Schedule 16 of the DMCC Act, including in areas such as unfair commercial practices, subscription contracts, and consumer savings schemes. The 10% global annual turnover penalty limit under UK consumer law mirrors the maximum fine businesses can face for substantive breaches of UK competition law.

In addition, the CMA may fine companies for administrative or procedural consumer law breaches, depending on the type of infringement, up to £30,000 or £150,000, or up to 1% or 5% of global annual turnover, whichever is higher. The £30,000 maximum fixed penalty or 1% worldwide annual turnover cap, whichever is greater, applies to breaches of investigatory requirements, such as failing to comply with mandatory CMA information requests, or providing false or misleading information to the CMA. The £150,000 maximum fixed penalty or 5% worldwide annual turnover cap, whichever is greater, applies to more serious administrative breaches of remedy requirements, involving undertakings, CMA directions or orders.

In cases of continued non-compliance, the maximum daily penalty that can be imposed on businesses is either £15,000 or 5% of daily worldwide turnover, whichever is higher, for all of the procedural infringements listed above, except for the provision of false or misleading information where daily penalties cannot be imposed.

As a result of the DMCC Act, there is now alignment between the maximum turnover-based administrative penalties that business can face for procedural consumer protection law breaches and for breaching UK procedural competition rules. This further underscores the alignment between CMA-enforced consumer protection and competition laws under the new legislation.

The CMA’s draft direct enforcement guidance details the different steps and processes the CMA will follow when calculating penalties for substantive and administrative consumer law breaches. When setting substantive penalties, the CMA will, amongst other factors, take into account non-economic harm, such as distress, delay, and/or loss of privacy, and will consider the impact on ‘vulnerable customers’ as one of the ‘escalating factors’ in penalty calculation. The CMA also notes that having in place an effective consumer law compliance programme is a factor toward showing that a company has a ‘low’ level of culpability for fine calculation purposes.

Under the DMCC Act, the CMA will also have the ability to extend consumer law requirements to, and impose infringement penalties on, so-called ‘interconnected bodies corporate’ of the infringing businesses. In effect, this can result in multinational businesses with a small UK presence being jointly and severally liable for the mandatory requirements and/or monetary penalties the CMA imposes on the corporate group’s UK subsidiary.

Penalties for individuals

Individuals who are an ‘accessory’ to substantive consumer law infringements by a company may personally face fines up to £300,000. This may include individuals such as directors or senior managers, but it might also capture other natural persons as the definitions of ‘accessory’ and the related concept of ‘special relationship’ in the DMCC Act are broadly defined.

Individuals may also be fined for procedural breaches in the context of consumer law investigations. For breaches involving legally-binding undertakings, CMA directions or orders, individuals can face maximum fixed fines of £150,000 or maximum daily fines of £15,000. Up to £30,000 fixed or £15,000 daily penalties can also be imposed for breaches of investigatory requirements – save that providing false or misleading information can only be punished by a fixed penalty.

Expanded consumer rights

The DMCC Act also makes certain substantive changes to consumer law, all of which in some way aim to address consumer protection issues that the CMA has examined in the past. Key changes are noted below.

Unfair commercial practices

The DMCC Act revokes and restates the Consumer Protection from Unfair Trading Regulations 2008 (CPRs), which protect consumers from unfair commercial practices. A commercial practice will likely be unfair if it results in a consumer making a transaction that would otherwise not have been taken as a result of misleading action or omission, an aggressive practice, or a breach of professional due diligence. The CMA’s recent focus on misleading green claims – so-called ‘greenwashing’ – as well as its work involving online choice architecture and other online selling and promotion activities, offer examples of its work on addressing unfair commercial practices. 

The CMA’s growing efforts to protect consumers from potential harms in the digital sector, including in rapidly developing technologies such as artificial intelligence (AI), are likely to involve DMCC Act provisions that prohibit unfair commercial practices, and are likely to be used alongside the CMA’s established competition law powers, and the new ‘ex ante’ digital competition regime, as the regulator deems appropriate.

Notably, the DMCC Act copies across 31 unfair commercial practices from the CPRs that are prohibited outright and adds a further new unfair commercial practice which bans ‘fake consumer reviews’. To avoid breaching the fake consumer reviews prohibition, traders will have to take ‘such reasonable and proportionate steps as are necessary’ to prevent the publication of, and remove from publication, any fake reviews or reviews which conceal that they have been incentivised. The 32 banned commercial practices are now contained in Schedule 20 of the DMCC Act.

The DMCC Act also prohibits ‘drip pricing’, a practice that occurs when consumers are shown an initial price for a good or service while additional fees are revealed, or dripped, later in the checkout process. The practice has been identified as a particular area of concern by the UK government, along with fake reviews. Businesses will have to set out the total, all-inclusive, price of a ‘product’, namely a good, service, or digital content, at the outset. If this is not possible, the business must clearly explain to consumers how the final total price will be calculated.

Subscription contracts

Subscription contracts will be subject to certain pre-contract information requirements, and businesses will be obliged to notify consumers before the end of a free trial or a low-cost introductory offer. Businesses will also need to ensure that consumers are able to exit a contract in a straightforward and timely manner. The new subscription contracts rules stem from the CMA’s previous consumer law investigations into auto-renewing subscription contracts. However, many types of subscription contracts are excluded from the new rules because they are already subject to other regulations, including contracts for utilities, insurance and financial services, medical prescriptions, rental of residential accommodation, and contracts regulated by Ofcom – like mobile phone and broadband contracts.

The UK government has confirmed that the new rules on subscription contracts will not take effect until spring 2026 at the earliest.

Consumer savings schemes

Consumer savings schemes will also be subject to greater protection under the DMCC Act. Where consumers make payments as a form of saving for goods, services, or digital content to be supplied by the business at a later date, the business will have to mitigate the risk of potential loss to consumers – in the event the business were to become insolvent – by setting up either an insurance or a trust arrangement.

Secondary ticketing

The DMCC Act makes certain amendments to clarify that the CMA can enforce pre-existing consumer protection rules concerning secondary ticketing under the Consumer Rights Act 2015 (CRA) and recover financial penalties. However more extensive substantive provisions aiming to reduce fraud and excessive mark-ups by ticket resellers in the context of secondary ticketing were abandoned when DMCC Bill was fast tracked during the parliamentary ‘wash up’ in May 2024 prior to the UK general election and have not materialised in the final DMCC Act.

Alternative dispute resolution (ADR)

The DMCCA Act also replaces the Alternative Dispute Resolution for Consumer Disputes (Competent Authorities and Information) Regulations 2015 and makes new provisions stipulating that ADR procedures in consumer contracts will be prohibited if the ADR provider is not accredited or exempt under requirements stated in the new legislation.

Unlike the substantive provisions mentioned above, the new ADR rules are not specified in Schedule 16 of the DMCC Act and therefore are not subject to the CMA’s direct enforcement powers. The UK government has said that the new ADR rules will commence after April 2025. 

Compliance and next steps

Despite the DMCC Act replacing and restating certain consumer law provisions, UK consumer protection legislation remains complex and highly fragmented. The CMA’s direct enforcement powers will apply to a wide range of legislative enactments detailed in Schedule 16 of the DMCC Act and as summarised in Annex A of the CMA’s draft new direct enforcement guidance. This complexity can make effective compliance more challenging for businesses. 

Notably, Annex B of the draft direct enforcement guidance also updates aspects of the CMA’s separate pre-existing guidance on the court-based regime for consumer law enforcement.

Adding further complexity, Schedule 19 of the DMCC Act sets out special transitional rules which concern potentially infringing practices that began before the DMCC Act commenced and continued after the DMCC Act came into force – known as ‘continuing conduct’. Where there is continuing conduct, the new law will apply to all of the conduct both before and after the relevant commencement date in April 2025. However any pre-commencement breaches can only be pursued under the old consumer law, therefore the CMA can only impose a monetary penalty where infringing conduct takes place after the commencement date.

The various DMCC Act developments outlined above will significantly impact all businesses which sell to UK consumers, particularly as the DMCC Act now places consumer protection law on a par with competition law in terms of the strength of the CMA’s enforcement powers. It is critical that businesses get up to speed with these important changes and prioritise compliance efforts. Affected businesses should review their current practices, develop and implement robust and effective consumer law compliance procedures, and train staff, to mitigate their risk exposure.

Businesses should also monitor for further news about when the various consumer law provisions within the DMCC Act will come into effect. The government has said it expects most of the provisions to take effect in April 2025, though there will be a delay with the new rules on subscription contracts until spring 2026 at the earliest and it has indicated that it will be April 2025 at the earliest before new savings scheme rules take effect, and that the new ADR rules will being to apply after April 2025, suggesting that those reforms could be decoupled from the timing for the delivery of the wider consumer law changes.

Secondary legislation regarding the CMA’s consumer law enforcement powers, as well as guidance on those powers, is to be is expected to be introduced into parliament in autumn 2024, but the government has not confirmed a timeline for this.

Co-written by Tadeusz Gielas of Pinsent Masons.