EU targets addictive design, Apple faces antitrust action, India penalizes dark patterns - Legal Updates

Fair Monday is FairPatterns' weekly analysis of regulatory developments, enforcement actions, and dark pattern cases affecting digital trust and consumer protection. Every Monday, we break down complex legal actions to help businesses understand how to build ethical digital experiences.

We deliver the latest developments in regulatory enforcement, class action lawsuits, and industry accountability, tracking how major platforms are being held responsible for deceptive practices that manipulate user behavior, exploit consumer trust, and undermine digital rights. Whether you're a legal professional, UX designer, compliance officer, or simply a consumer who wants to understand how digital deception works, Fair Monday provides the insights, case analysis, and precedent-setting developments you need to navigate the evolving landscape of digital fairness.

EU Parliament demands ban on addictive design features for minors

On November 26, 2025, the European Parliament adopted a comprehensive non-legislative resolution establishing a framework for enhanced digital protections for children online. The resolution, based on the Internal Market and Consumer Protection Committee's report on Protection of Minors Online (2025/2060(INI)), proposes sweeping changes that will impact social media platforms, video-sharing services, gaming companies, and AI-powered digital products across the EU.

Parliament calls for a harmonized EU-wide digital minimum age of 16 for social media platforms, video-sharing services, and AI companions. Users aged 13-16 would require verified parental consent to access these services, with privacy-preserving age verification systems mandatory. The resolution supports the European Commission's development of an EU age-verification app and digital ID wallet while emphasizing that age assurance cannot replace platforms' fundamental obligation to implement safety-by-design principles.

The resolution specifically targets addictive design mechanisms that exploit psychological vulnerabilities in minors.

Banned features include: infinite scroll, autoplay, pull-to-refresh functionality, reward loops, and harmful gamification elements. Additionally, engagement-based recommender systems (algorithms designed to maximize user attention and time-on-platform) would be prohibited for users under 16.

Parliament demands comprehensive prohibition of loot boxes, randomized rewards, in-app currencies, and gambling-like game mechanics in products accessible to minors. These features, which create unpredictable reward schedules similar to gambling, have faced increasing regulatory scrutiny across multiple jurisdictions.

The resolution urges strengthened Digital Services Act (DSA) enforcement, including platform bans and significant fines for non-compliance. Notably, MEPs advocate for personal liability provisions targeting senior executives in cases of serious or repeated violations.

EU authorities coordinate antitrust action against Apple

On November 25, 2025, Poland's competition authority UOKiK initiated proceedings against Apple for abuse of dominant position, alleging the company's App Tracking Transparency (ATT) framework uses manipulative consent design to disadvantage competing app publishers. UOKiK President Tomasz Chróstny stated that the way ATT policy is implemented may lead to unfair restrictions on competition, as Apple operates in a dual role: designing operating systems while also publishing apps and providing advertising services that compete with independent publishers.

Apple introduced its own definition of "tracking" as combining user data collected from one entity's app with user data collected from another entity's app, meaning Apple's collection of user data across its own services is not considered "tracking". Apple's developer documentation confirms this, defining tracking as linking data collected from your app with data collected from other companies' apps, websites, or offline properties, the critical phrase "other companies'" creates the regulatory problem.

Following February 2025 preliminary findings, Germany's Federal Cartel Office launched a market test of Apple's proposed remedies after explicitly identifying "dark patterns" in ATT's consent design. Required changes include neutral prompt design removing manipulative framing, harmonized language and visuals between Apple and third-party consent flows, and simplified query architecture. However, Apple refuses consent requirements for attribution tracking—advertising measurement. The Bundeskartellamt launched on December 2, 2025, a market test of Apple's proposed remedies, requiring both the ATT prompt for third-party apps and PA prompt for Apple's apps to be designed neutrally and free from what the authority explicitly identified as "dark patterns".

Andreas Mundt, President of the Bundeskartellamt, stated:

"Essentially, the key issue is who determines how apps gain access to user data – and therefore who has the better opportunities in a competitive environment"

Coordinated European action

Apple's privacy policy is under scrutiny in other countries. Antitrust authorities in Germany, Italy, and Romania are also examining the ATT policy. In March 2025, a French regulator issued a decision concerning Apple, imposing a fine of €150 million. Poland's proceedings carry potential penalties reaching 10% of global turnover. Italy and Romania maintain active investigations. All coordinate through the European Competition Network (ECN) and establish precedent: consent interface design—terminology, visual hierarchy, button placement—constitutes a competition law issue when systematically favoring platform owners over ecosystem participants

CCPA penalizes PharmEasy for dark pattern violations

On November 25, 2024, India's Central Consumer Protection Authority (CCPA) imposed a penalty on online pharmacy PharmEasy for employing basket sneaking, a deceptive design practice that automatically added paid "plus memberships" to user carts without explicit consent.

*Example from India's PharmEasy basket sneaking case - Case No: ССРА-2/20/2024-ССРА - Page 2*

The investigation revealed systematic violations spanning November-December 2023 and March-June 2024, affecting approximately 24,000 users. PharmEasy's checkout flow pre-selected the PLUS membership service, artificially inflating transaction amounts without affirmative user action—a clear breach of Rule 4(9) of India's Consumer Protection (E-Commerce) Rules, 2020, which mandates explicit consent before charging consumers.

CCPA classified the practice as basket sneaking under the 2023 Guidelines for Prevention and Regulation of Dark Patterns, defining it as an unfair trade practice that undermines consumer autonomy. The regulator rejected PharmEasy's technical malfunction defense, noting the company only disabled the feature after receiving a show cause notice, demonstrating reactive rather than proactive compliance.

The enforcement action mandates permanent removal of the dark pattern, comprehensive user refunds, terms and conditions revisions, and complete interface redesign to ensure affirmative consent mechanisms.

This case underscores growing regulatory scrutiny of manipulative design practices across digital platforms and the significant compliance risks facing e-commerce operators in India's evolving consumer protection landscape.

The regulatory message of this week is unambiguous: design manipulation, regardless of jurisdiction or sector, will face enforcement. The only variable is whether companies choose proactive compliance or reactive remediation after penalties, mandated redesigns, and damaged user trust make the choice for them.

Scan your platform for regulatory dark pattern risks with FairPatterns' automated compliance audits: https://www.fairpatterns.com/solutions/fairaudit-ai

References:

EU Parliament demands ban on addictive design features for minors

EU authorities coordinate antitrust action against Apple

CCPA penalizes PharmEasy for dark pattern violations

Trusted by clients worldwide

Cookie settings