CMA issues first fines under its new UK direct consumer enforcement powers

The UK Competition and Markets Authority (CMA) has issued its first round of fines under the Digital Markets, Competition and Consumers Act 2024 (DMCCA), as it moves swiftly to demonstrate the strength of its new direct consumer enforcement powers.

The CMA launched a series of investigations in November 2025, the first to use its new direct enforcement powers. The investigations focused on suspected consumer law infringements involving the use of fees, misleading time-limited offers and the practice of automatically opting consumers into optional charges. Several investigations remain ongoing.

Drip pricing 

The CMA fined StubHub, an online marketplace for live event tickets in the UK, £889,200 for drip pricing, a practice prohibited under the DMCCA. Between April and December 2025, some consumers were required to pay mandatory delivery and service fees when purchasing tickets for concerts and sporting events, which were added at the final stage of the checkout process rather than being included in the total price from the outset.

StubHub will also have to refund more than 50,000 customers, with average refunds estimated at approximately £10 per transaction. The penalty includes a 40% reduction, reflecting the company's admission of the breach, swift action to end the conduct and early settlement with the regulator. As part of the settlement, StubHub also agreed not to appeal or challenge the CMA's decision in court.

Under the DMCCA, traders are prohibited from displaying an initial headline price to consumers and then introducing additional mandatory charges as a transaction proceeds. The total price must be made clear to consumers from the outset, presented promptly and in a way that the consumer is likely to see easily. The CMA has published guidance on price transparency to assist businesses interpreting the pricing requirements under the new unfair commercial practices regime under the DMCCA. 

The ticketing sector is expected to come under scrutiny more broadly, as indicated by the CMA in its response to the Business and Trade Committee's review of market function in the sector.

Charges and consent 

As part of another case opened in November last year, the CMA has also fined Marks Electrical £720,000 for pre-selecting and charging customers for additional services without their express agreement. Marks Electrical was similarly ordered to refund customers and received a 40% reduction to its financial penalty for early admission to the breach and agreeing to settle the case quickly.

Automatically opting consumers into additional payments under a contract without obtaining their express consent before the consumer becomes bound by it is prohibited under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013. The CMA has published specific guidance on obtaining consent for additional charges when selling online.

Procedural non-compliance

The CMA can also impose penalties simply for failing to engage with the regulator. Its £473,000 fine on Euro Car Parks for not responding to a statutory information notice serves as a reminder that procedural non-compliance carries its own risks.

The CMA served the company with an information notice in July 2025. Despite using multiple methods of service, including hand-delivery, post and email, Euro Car Parks did not respond until it received a provisional enforcement notice in October.

The case provided useful insight into how the CMA assesses what constitutes a "reasonable excuse" for non-compliance with information notices. Euro Car Parks excused its behaviour on the fact that the director to whom the notice was addressed was not involved in day-to-day management and was out of the country at the time the notice was served. Several officers also believed the CMA's correspondence to be a scam and had blocked the CMA's email addresses. 

The CMA rejected those arguments. It held that the notice could validly be served on any officer and that it remained the company's responsibility to ensure timely compliance and to manage staff absences. The CMA further found no objectively reasonable basis for treating its correspondence as fraudulent, noting that all correspondence used official CMA branding and was sent from official gov.uk email addresses. The company had also taken no steps to verify the legitimacy of the correspondence, such as contacting the CMA by telephone or in person.

Osborne Clarke comment

These cases demonstrate that the CMA's current approach appears to favour settling cases and imposing financial penalties, rather than agreeing undertakings with businesses. The regulator stated that the Euro Car Parks fine was intended to act as a deterrent both to the company and to others, signalling its intention to set precedents under its new powers. 

The CMA's enforcement priorities for 2026 to 2027 include aggressive sales practices that prey on consumers in vulnerable positions, the provision of objectively false information to consumers, and banned practices including those relating to fake reviews, hidden fees and unfair contract terms, such as terms that impose unfair exit charges on consumers. The CMA has also flagged that "businesses must get ready to comply" with the upcoming DMCCA subscription contracts regime expected to come into force in spring 2027. The use of AI, including AI agents, is a further  area the regulator has identified as a compliance priority for businesses.

On its own use of AI, the CMA has deployed agentic AI capable of "experiencing" and capturing the consumer journey at scale in order to identify potential infringements of consumer law such as drip pricing. Its StubHub, Marks Electrical and Euro Car Parks investigations were launched as a result of this investment. The CMA also uses AI across other areas of its enforcement practice, including identifying bid rigging in public procurement.

The CMA's enforcement activity sends a clear signal to all consumer-facing businesses, whatever their sector, to ensure compliance with consumer law. The authority's direct enforcement powers allow it to impose fines of up to 10% of a business's global turnover, or £300,000, whichever is the greater, for non-compliance.