Lessons from the first year of the new consumer enforcement regime

The Competition and Markets Authority (CMA) has made proactive use of the direct consumer enforcement powers introduced in April 2025 by the Digital Markets, Competition and Consumers Act (DMCC Act). See our April 2025 update for an overview of the regime.

In the first year of the regime, we have seen 14 investigations opened and over 150 advisory letters issued to businesses. In December 2025, the CMA used its fining powers under the direct consumer enforcement regime for the first time and fined Euro Car Parks almost £500,000 for failing to respond to an information request. This was followed by the first fine for a substantive infringement in April 2026 when the CMA fined the AA over £4 million for engaging in drip pricing.

What you need to know

• As anticipated, the CMA has made proactive use of its new powers to directly enforce consumer law, with 14 investigations opened, 150 advisory letters issued and significant penalties for substantive and administrative infringements in the first year.
• The first investigations advisory letters have covered a wide range of sectors from travel to transport to live event and cinema tickets to fashion.
• At the same time as it imposed a fine of £4.2 million on the AA for drip pricing of mandatory booking fees by the AA and BSM Driving Schools, the CMA required the AA to provide consumer redress which brings the total financial impact for the business to close to £5 million.
• The CMA has the power to impose penalties of up to 10% of a company's global turnover or £300,000 (whichever is greater) for breaches of consumer protection law. The first fine imposed included a reduction of 97% for proportionality and a settlement discount of 40%. The assessment of proportionality is expected to play a key role in determining the level of penalty, but reductions may decrease as the regime matures.
• The CMA concluded its first investigation in around five months (aided by the AA's acceptance of settlement), notably faster than typical competition law investigations.
• Enforcement activity is expected to continue to ramp up and we expect to continue to see enforcement activity relating to online practices, drip pricing, fake reviews and unfair terms, as well as subscription contracts when the new rules come into force in Spring 2027.

Background

It's just over a year since the UK's new direct consumer enforcement regime introduced by the DMCC Act came into force on 6 April 2025. Significantly, the DMCC Act enables the CMA to directly enforce consumer law through administrative proceedings. This has marked a step change in consumer law enforcement in the UK. The CMA has the power to issue infringement notices (i.e. decisions) setting out why it considers that conduct or terms breach consumer law and impose fines (of up to 10% of the global turnover on companies and up to £300,000 on individuals), as well as the ability to impose directions on businesses and award compensation to consumers. In addition, the CMA can enforce undertakings given by companies and fine companies which breach undertakings they have given or directions that have been imposed by the CMA. See our April 2025 update.

The DMCC Act also introduced important new protections for consumers, in particular in relation to fake reviews and drip pricing, as well as amendments to existing protections. New requirements on subscription contracts are expected to come into force in Spring 2027 (see our May 2026 update).

The CMA's approach to enforcement: targeting egregious harm

The CMA's recent blog post confirms the CMA is taking a two-pronged approach to ensuring compliance with consumer law:

• providing clear, practical guidance to help businesses comply; and
• taking targeted enforcement action where the CMA has identified egregious breaches.

To date, the CMA's enforcement action has focused on three areas (consistent with those set out in its April 2025 approach document): (i) drip pricing, (ii) fake reviews and (iii) online choice architecture (OCA).

Drip pricing

Drip pricing involves showing customers an initial price for a product which is not a total or final price because, for example, additional charges are introduced as the consumer proceeds with the purchase. Drip pricing relating to mandatory fees and charges is prohibited under UK consumer law. Traders must provide the required information clearly, in a timely way, and in a way that the consumer is likely to see it (see our February 2026 update for further guidance).

The first investigation concluded by the CMA under its new powers relates to drip pricing: in April 2026, the CMA fined the AA and BSM driving schools (both owned by the AA) £4.2 million and ordered them to refund more than 80,000 customers. The CMA's investigation found that, between April and December 2025, more than 80,000 learner drivers were not shown the total price upfront when booking driving lessons online as a mandatory booking fee was only included later in the booking process. The AA has been ordered to refund customers of the two driving schools over £760,000 which is the first time the CMA has used its powers to require compensation for customers in an infringement notice. The AA and BSM driving schools will contact affected customers and are required to report regularly to the CMA on their progress. The amount refunded to customers will vary depending on how many lessons they purchased but the average is expected to be around £9.

The CMA formally opened its investigation in November 2025 as part of its first wave of consumer investigations (see our November 2025 update). The investigation was concluded within five months which is much faster than most CMA competition law investigations. The AA received a 5% reduction for engaging constructively with the CMA throughout the investigation and a further 40% reduction for agreeing to settle the case.

Consistent with the five step approach outlined in its Direct consumer enforcement guidance (CMA200), the starting point for the penalty calculation is to determine the party's revenues relating to the direct or indirect sale of products or services to customers in the UK. This is not limited to those products or services which may have been affected by the infringing conduct or terms. In the case of the AA, the penalty calculation relied on the AA's full group as the starting point in the calculation. The decision applies the stepped approach as follows:

• Step 1 (starting point): the CMA assessed the level of harm / seriousness of the infringement and the culpability of the party to determine the % of UK turnover adopted as the starting point:
  • Step 1A (level of harm): According to the CMA, the infringement caused "moderate economic on non-economic harm to consumers", on the basis that it is important that customers have the key information (i.e. price) they need to make an informed decision and drip pricing has the potential to have a wider impact on fair dealing businesses and the market as a whole, as well as specific factors such as the number of consumer affected and the size of the dripped fee (both in absolute terms and relative to the value of the product).
  • Step 1B (level of culpability): Concluding that the level of culpability for the infringement was high, the CMA noted that it does not need to identify a deliberate intention to break the law for infringements to fall into this category. It also noted that the CMA had published guidance on unfair commercial practices and had emphasised in other public documents that it may take enforcement action against drip pricing.
  • Step 1C (starting point code): Applying its findings on harm and culpability, the starting point code was B (from the available range of High A to Low D) which means in the range of 15 to 22.5% of the relevant turnover. The CMA concluded in this case the appropriate starting point was 15% of the AA's UK turnover.
• Step 2 (adjustment for deterrence / size of party): No adjustment needed.
• Step 3 (aggravating / mitigating factors): The CMA applied a 5% discount for AA's cooperation with the investigation.
• Step 4 (adjustments for proportionality / statutory maximum): The level of penalty calculated at the end of Step 3 was £206 million. However, the CMA assessed this to be disproportionate and considered a penalty of £7 million to be appropriate, therefore applying an approximately 97% reduction for proportionality. The proportionality discount took into consideration the fact that only a small proportion of the AA's UK turnover related to the products / services affected by the infringement, the duration of the infringement for which penalties can be imposed (less than a year since the new direct enforcement regime came into force), the fact the CMA has required the AA to make consumer redress and the AA's cooperation with the investigation.
• Step 5 (settlement discount): Finally, the CMA applied a 40% discount for settling the case, which is the maximum level of discount available for settlement in advance of the CMA issuing a Provisional Infringement Notice.

Currently, the CMA has several ongoing investigations which relate to alleged drip pricing, involving:

• Gold's Gym: to review the presentation of a one-off joining fee for annual memberships which is displayed part-way through the consumer sign-up process and not factored into its advertised membership cost.
• StubHub and viagogo: to look at the presentation of mandatory fees and whether these are included in the total price the customer sees at the beginning of the process.

Fake reviews

The new protections in relation to fake or misleading consumer reviews or review information have also been a focus area for enforcement. The new banned practices, which came into force on 6 April 2025, relate to the submission, commission and publication of fake reviews or concealed incentivised reviews (see our July 2025 update). In April 2025, the CMA indicated that businesses had a three-month grace period during which it would support businesses to achieve compliance and uplift existing processes, rather than taking enforcement action. At the time, Sarah Cardell (Chief Executive of the CMA) commented that "fake reviews strike at the heart of consumer trust" and that the CMA had given businesses time to get things right but would now be focused on enforcement action to "tackle some of the most harmful practices head on".

Initial enforcement action began in July 2025, when the CMA announced that it had carried out a sweep of the websites of over 100 businesses, which was followed by advisory letters being sent to 54 companies which the CMA considered were failing to comply with the new rules and the CMA's guidance. These related, in particular, to whether those businesses had a consumer review policy on their websites. According to the CMA, 90% of the businesses contacted made changes in response.

In March 2026, the CMA announced that it has opened five investigations into fake and misleading reviews, including investigations into:

• Autotrader and Feefo (treatment of negative reviews): whether a number of 1-star reviews (moderated by Feefo) were not published on Autotrader's platform and were not included in overall star ratings.
• Dignity (misleading reviews): whether Dignity asked staff to write positive reviews about the company's services.
• Just Eat (star ratings): whether its ratings system inflated certain restaurants' / grocers' star ratings.
• Pasta Evangelists (discounts for reviews): whether customers were offered discounts on future orders if they left a 5-star review on delivery apps.

In its press release, the CMA highlighted that it is looking at key stages in the online reviews ecosystem which allows it to investigate multiple practices that can "shape what people see when they search, shop or book online".

Online choice architecture

The design of the online customer journey and practices that seek to unfairly influence consumer behaviour have continued to come under scrutiny. In November 2025, the CMA opened new investigations relating to (i) the use of sales countdowns and time-limited promotions, including whether sales offers ended when stated (involving Wayfair and Appliances Direct) and (ii) at the use of default enrolment into optional charges / services unless customers actively opt out or deselect the option (involving Marks Electrical and Appliances Direct).

The CMA has also been assessing the use of AI agents in consumer interactions and published guidance in March 2026 on how businesses should ensure compliance with UK consumer protection law when using AI agents (see our March 2026 update).

Other investigations

The CMA has also opened an investigation into Adobe to investigate concerns that early cancellation fees applicable to memberships for certain products may breach consumer protection laws. For annual plans that are billed monthly, customers who cancel more than 14 days after signing up have to pay 50% of the remaining yearly cost but lose access to the product at the end of billing period for the month in which they cancel. The CMA is considering whether these terms are unfair and if customers receive clear and timely information about the cancellation fees upfront. The investigation is ongoing.

Following the publication of its draft updated unfair terms guidance in January 2026, further enforcement is expected into unfair consumer terms (including unfair cancellation or exit fees).

Fines for administrative breaches

In December 2025, the CMA used its new fining powers for the first time and fined Euro Car Parks £473,000 for failing to respond to requests for information. In July 2025, the CMA issued Euro Car Parks with a formal information notice. The CMA made 7 attempts to secure a response to its notice, including hand delivery. Euro Car Parks ultimately responded, but only after the CMA issued a provisional notice (around 3 months later) stating that it was considering financial penalties for failure to respond to the notice. The CMA rejected Euro Car Parks' arguments that the information request appeared fraudulent, including an argument that the letter delivered looked fraudulent due to the "unprofessional appearance" of the envelope. Euro Car Parks had blocked CMA email addresses after deciding that the correspondence was a scam.

Notably no consumer enforcement investigation into Euro Car Parks has currently been announced but the CMA stated that, by failing to respond to the information notice, Euro Car Parks had delayed the CMA's work and the CMA had to use extra resources to get the requested information. Under the DMCC Act, the CMA has the power to impose penalties of up to 1% of a company's annual turnover for this type of breach. At £473,000 the fine imposed was 75% of the maximum possible fine, reflecting the CMA's assessment of the seriousness of Euro Car Parks' failure to respond. The CMA did not, however, impose daily penalties (which can be up to 5% of a company's daily turnover) after taking into account Euro Car Parks' proactive engagement after the provisional notice which the CMA commented amounted to a "very substantial discount on the penalty that could otherwise have been imposed".

This is an important reminder that businesses need to have internal processes to identify and escalate statutory notices. In consumer protection cases, the CMA can issue statutory requests before it has opened an investigation (meaning that recipients may not necessarily be expecting to receive a request) and non-compliance with these requests can attract significant penalties.

Looking ahead: what to expect

The first year of the new direct enforcement regime has, as anticipated, seen a marked increase in the level of consumer protection enforcement activity by the CMA. The decision to impose a substantial financial penalty on the AA (£7 million before the application of the settlement discount), in addition to requiring redress to be paid to affected consumers, also illustrates the prospect for significant fines increased risks now faced by businesses in the UK. It also confirms that penalties under the new regime are likely to be substantial, and in some cases may even be equivalent to the level of fines more typically imposed for breaches of competition law in the UK.

Over the next year, we expect the CMA to continue to focus on "areas of essential spend where consumers feel the pinch the most". The CMA's message to businesses for the upcoming year is to prioritise compliance in the following areas:

• Price transparency, with the ongoing investigations into drip pricing likely to provide further guidance.
• Fake reviews, as the CMA progresses its investigations across the ecosystem of fake reviews.
• Terms in contracts with consumers, such as the terms being scrutinised in the CMA's investigation into Adobe. The CMA has indicated that we should expect an increasing number of similar investigations into standalone conduct.
• Subscription contracts, in light of the new rules expected to come into force in Spring 2027 (see our May 2026 update).
• How businesses are using AI, including agents. The CMA recently published guidance for businesses on how to use agentic AI (see our March 2026 update) which emphasises the importance of monitoring AI agent performance and acting quickly to refine AI agents when problems are identified, particularly where agents interact with large numbers of people or vulnerable customers.