If you thought the recent wave of EU digital regulation was starting to recede, think again. The European Commission’s Digital Omnibus proposal and the anticipated Digital Fairness Act (DFA) are set to redefine what “digital fairness” means for both businesses and consumers in 2026 and beyond. As the legislative gears keep turning and the patchwork of compliance obligations gets stitched (or ripped apart) once again, digital stakeholders face another round of adaptation, scrutiny, and - yes - opportunity.
So, what can we expect on the horizon? Will businesses finally catch a break, or are consumers about to receive another double helping of regulatory protection? We unpack the state-of-play and looks ahead to a year that might well be remembered as the big digital clean-up.
The Digital Omnibus: simplifying or shifting the burden?
The European Commission’s Digital Omnibus proposal, published on 19 November 2025, brands itself as a “streamlining” initiative, aimed at cutting through the tangle of overlapping and sometimes conflicting EU digital rules. But is it simplification or simply a reshuffle?
Key takeaways:
- Major overhaul of the GDPR: for the first time since its entry into force, the GDPR faces comprehensive revision. One notably controversial proposal: the addition of a “legitimate interest” lawful basis for processing personal data in the context of AI development and operation, albeit with new safeguards. This is designed to encourage innovation but is already drawing fire from privacy advocates and some Member States, concerned about a potential dilution of individual rights.
- Delayed high-risk AI rules: the tricky, high-stakes requirements for “high-risk” AI systems under the AI Act will be subject to a new timeline, tied to finalisation of standards and guidance before coming into effect. But don’t get too comfortable: a statutory backstop means these rules will land by late 2027 or 2028 regardless. In addition, in a major structural shift, the Commission's AI Office gains oversight for AI embedded in Very Large Online Platforms (VLOPs) and Search Engines (VLOSEs) under the Digital Services Act.
- Consolidation of data laws: the Free Flow of Non-Personal Data Regulation, the Data Governance Act, and the Open Data Directive are set for repeal, with their core provisions folded into an enhanced Data Act. Cloud switching, data localisation, and data sharing get a unified regime, with strengthened trade secret protections and some business-to-government data access narrowed to well-defined emergencies.
- Incident reporting – the Single-entry Point (SEP): cross-border compliance for incident notification finally promises to get easier, with a centralised SEP (run by ENISA) covering reporting obligations under cyber, resilience, and data protection regulations. A practical upshot for data breach reporting: the GDPR notification deadline is about to be extended from 72 to 96 hours.
- Cloud and business wallets: alongside the Digital Omnibus, the Commission also launched a proposal for a “European Business Wallet”, i.e. a digital administrative tool intended to facilitate secure digital transactions, signatures, and seals for companies across the EU. In addition, it also published final versions of the model contractual terms on data access and standard contractual clauses on cloud computing under the Data Act.
Please read our in-depth analysis for further details to gain a comprehensive understanding of the proposed changes.
Despite genuine attempts at simplification, some observers are already flagging new compliance headaches, especially concerning incident reporting coordination and divergent interpretation of post-Omnibus GDPR standards. As with any major regulatory shift, scepticism and criticism are inevitable, so, only time will tell whether these changes will deliver the promised clarity and ease of compliance. However, this proposal is in its initial stages and may well undergo some changes before completion.
The Digital Fairness Act: what to expect in 2026
While the Digital Omnibus focuses on fixing, fusing, and future-proofing, the upcoming DFA is seen by many as the EU’s response to the perceived shortcomings of the EU's consumer protection regime applied to the digital world.
What’s driving the Digital Fairness agenda?
Prompted by the European Commission’s 2024 Fitness Check report, the legislative focus has shifted to a range of pressing issues: 'dark patterns', addictive design, opaque influencer marketing, intrusive personalisation, and unfair contract terms. The report is scathing about the effectiveness of current law and flags a need for bold, harmonised action.
Key priorities and measures
The Commission has flagged six main priorities:
- Ban on dark patterns: prohibit deceptive digital design, including misleading pop-ups and hidden opt-outs.
- Transparent pricing: outlaw 'drip pricing' and ensure all mandatory costs are disclosed upfront.
- Safeguard vulnerable users: tighten restrictions on marketing to minors or individuals in financial difficulty and possibly introduce default opt-outs.
- Address addictive design: regulate gamification and reward mechanisms, with special focus on protecting minors.
- Influencer marketing: require clear labeling of paid content across the EU.
- Simple contract management: ensure cancellation rights, transparent chatbots, and straightforward auto-renewal processes.
Scope and impact:
The DFA’s rules are expected to broadly apply across the digital B2C sector, notably affecting any business using online personalisation, recurring subscriptions, dynamic pricing, or interface design to influence consumer decisions. Targeted sectors include e-commerce, streaming, travel platforms, ride-hailing, digital health, fintech, and gaming.
What’s next?
- Public consultation concluded on October 24, 2025
- Impact assessment and summary of consultation in Q2 2026
- Draft proposal in Q4 2026
- Legislative process in 2026-2027 with final adoption expected in late 2027.
The EU’s 2030 Consumer Agenda: five years of strategy, not just new rules
2025 saw another milestone with the European Commission’s unveiling of the 2030 Consumer Agenda. This is a five-year strategic plan for EU consumer policy that aims to keep pace with rapid economic, technological and societal change. For Commissioner Michael McGrath, the message is clear: "In a time of economic pressure, digital disruption and climate challenge, this Agenda boosts fairness online and offline, drives sustainable choices and reinforces the rights that keep our Union strong," as he told Politico’s Playbook. "But don’t expect new rules, as the agenda is more strategic than legislative. Its four pillars — digital fairness, sustainable consumption, enforcement and product safety — repackage previously announced measures, such as next year’s Digital Fairness Act and the review of the Consumer Protection Cooperation Regulation".
What are these four pillars all about?
- Completing the Single Market for consumers: aims at eliminating cross-border obstacles for consumers by evaluating impact of the Geo-Blocking Regulation and enhancing access to cross-border financial services. Promises EU Digital Identity Wallets across all EU Member States.
- Digital fairness: focuses on tackling manipulative practices and digital market abuses, mainly through new initiatives like the DFA. Special emphasis is put on protecting minors and vulnerable consumers in the online environment. Aims at further eliminating cross-borders obstacles for consumers by evaluating the Geo-Blocking Regulation to assess its impact.
- Sustainable consumption: pushes for Member State implementation of laws against greenwashing, promotes sustainable products/circular economy, and highlights durable, repairable goods.
- Effective enforcement and redress: stronger enforcement and a review of the Consumer Protection Cooperation Regulation in 2026, in particular the need for centralised investigations and enforcement powers at EU level in specific cases to ensure more efficient cross-border cooperation. Emphasises safety across all products, especially digital and imported goods, through robust market surveillance and updated safety rules.
The Agenda’s findings and actions will be revisited at annual consumer summits and high-level forums, keeping the focus on strategy rather than new regulation.
Outlook: caution ahead - business realities vs. regulatory ambition
For businesses, the year ahead is not just about adaptation but also about navigating an increasingly interventionist EU regulatory agenda. While the Commission’s stated objectives such as digital fairness, transparency, and consumer empowerment sound compelling, the reality on the ground is more complex.
Despite promises to reduce the administrative burden and “streamline” compliance, the rapid layering of new frameworks (DFA, Omnibus, ongoing DSA/DMA enforcement, and the underlying Consumer Agenda) risks heightening operational uncertainty for businesses, especially those with cross-border or innovative digital business models. Each new wave of regulation means new technical adjustments, staff training, contractual overhauls, and ongoing legal costs. For many businesses, this shift is less about simplification and more about grappling with a shifting and ever-expanding rulebook, even if the driving force for the Commission is to promote growth and investment.
Looking ahead to 2026, businesses will need to be proactive, stay closely engaged with upcoming consultations, and factor significant compliance investments into their strategies. The EU regulatory appetite appears undiminished, but the balance between headline consumer protection and practical, innovation-friendly business environments remains delicate and increasingly up for debate.
