Spanish regulators push on with domestic measures alongside upcoming EU Digital Fairness Act

Following a comprehensive fitness check of consumer law in the digital era, the European  Commission identified gaps in protecting consumers online. In response, it has launched a public consultation that closes on 24 October to shape the forthcoming Digital Fairness Act (DFA). The aim is to modernise EU consumer protection rules for the digital environment – strengthening consumer rights while simplifying compliance for businesses. Crucially, the DFA is being designed as an EU-wide framework to ensure a common level playing field and clear, enforceable rules across Member States.

Harmful online practices targeted

The DFA aims to target a range of manipulative or harmful online practices:

• Deceptive interface designs or “dark patterns”. User interface tricks that nudge or pressure consumers into unintended actions (e.g. hidden opt-outs, confusing consent flows). These misleading designs distort consumer choices and can amount to unfair commercial practices.
• Addictive design features. Digital products or apps engineered to exploit psychological biases (for example, through endless scrolls and gamified rewards) that encourage excessive use. Regulators are concerned that these features, especially in games or social media, foster dependency and exploit vulnerable users – and notably among minors.
• Influencer marketing transparency. The DFA seeks to tackle misleading marketing by social media influencers. Online content creators often promote products without clear disclosure, blurring ads with genuine content. New rules are expected to require obvious identification of paid promotions to prevent surreptitious advertising.
• Personalised offers and algorithms. The DFA is expected to address unfair personalisation practices. Consumers increasingly receive tailored prices, rankings or recommendations driven by algorithms, yet they often lack details regarding these processes. Future requirements may oblige businesses to inform users when artificial intelligence (AI) or algorithms materially shape outcomes; for example, personalised pricing or AI-driven chatbots interacting as customer service.
• Protection of minors. Special attention is given to protecting minors online. Younger users are early adopters of new digital services and often the most susceptible to manipulative design, like engaging game features or social media “likes”. The DFA is expected to reinforce safeguards for under-18s in areas ranging from addictive apps to age-inappropriate influencer promotions.

Spanish enforcement: influencers and manipulative interfaces

Spain’s regulators have already begun focusing on some of the practices that the DFA intends to regulate. Under the Spanish Audiovisual Communications Law, Spain’s media authority, the CNMC, was granted competences to supervise top online-content creators categorised as “users of special relevance”.

In 2025, the CNMC scrutinised influencer marketing activities on platforms and examined whether certain users of special relevance had published hidden or misleading ads in violation of audiovisual advertising rules. Although no infringements were ultimately found, these cases provide valuable insight into how the authority interprets “commercial communication” in the influencer context. The CNMC assessed elements such as the existence of a commercial relationship or compensation. the promotional intent of the content, and the clarity of disclosure to the audience.

Spain’s data protection authority, the AEPD, has likewise addressed manipulative digital design. In July 2024, the AEPD published a detailed report on addictive patterns in personal-data processing, analysing how certain interface designs and engagement mechanisms may infringe General Data Protection Regulation (GDPR) principles.

The AEPD links these patterns directly to the principles of lawfulness, fairness and transparency, noting that consent obtained through manipulative design may not be considered freely given. It warns that certain interface designs and algorithms manipulate users into prolonging screen time or oversharing data, undermining valid consent and fair processing. The AEPD’s guidance –echoing European Data Protection Board guidelines on dark patterns– urges organisations to avoid deceptive UX patterns and to uphold transparency and user autonomy in line with GDPR and the Spanish data protection laws.

Legislative trends in Spain: customer service and AI oversight

Recent and upcoming Spanish laws mirror the EU’s digital fairness objectives. Notably, Spain is on the way to passing a law on customer services aimed at bolstering consumer rights in after-sales and support contexts. Still a bill in the parliamentary procedure, it introduces stricter obligations on businesses when dealing with customers.

One headline provision targets the common problem of unwitting subscription renewals: companies will be required to inform consumers 15 days before an automatic contract renewal, highlighting the deadline to cancel and the consequences of not doing so.  The objective is to ensure that contract renewals are presented in a transparent and predictable manner, allowing the user to take a genuine and informed decision. This is aligned with the broader EU policy trend to increase visibility of lifecycle contractual mechanics in digital markets, rather than permitting renewals to occur without meaningful user awareness.

Beyond the draft bill, Spain is also exploring how AI-driven customer interaction tools -such as chatbots and virtual assistants- should be governed. The Ministry for Digital Transformation and Civil Service is currently developing guidelines and cooperation protocols to promote ethical and transparent use of AI in customer-facing services. 

Spain has also taken steps to address manipulative design in online gaming. In particular, the draft bill for the Protection of Minors in Digital Environments, now under parliamentary review, would restrict access to random reward mechanisms – that is, "loot boxes" – for under 18s, require clear disclosure of probabilities and costs; impose spending and time limits and ban advertising directed at minors or using misleading incentives. These obligations directly mirror the objectives of the upcoming DFA, which aims to combat addictive design and dark patterns that manipulate user behaviour or obscure key information.

Spain is also aligning with the EU’s focus on AI and algorithmic transparency by developing its own national framework for AI governance complementary to the EU AI Act, which places specific emphasis on AI systems that interact directly with consumers, including chatbots and virtual assistants used in customer service environments, and by creating its own AI supervisory agency –the Agencia Española de Supervisión de la Inteligencia Artificial – to oversee and enforce responsible AI use. The agency, the first of its kind in the EU, will help ensure that AI systems (from automated chatbots to recommendation engines) operate transparently and ethically.

In parallel, EU legislation such as the Digital Services Act has already imposed new transparency duties on online platforms; for instance, requiring disclosure of how algorithms recommend content or products. These developments mean Spanish businesses deploying AI or complex algorithms in consumer-facing services must be prepared to explain and audit their automated practices. 

Osborne Clarke Comment

Designing online interfaces and AI tools with transparency, choice and fairness in mind is rapidly shifting from a best practice to a legal requirement. It would be advisable for businesses to start auditing their user experiences (for dark patterns or undisclosed ads), updating customer communication workflows (for example, subscription renewal notices) and ensuring any AI-driven features are accountable. Adopting a proactive compliance strategy now will not only mitigate enforcement risks as the DFA and related laws take shape but can also enhance consumer trust and prove a true competitive advantage.