eco on the ENISA 2026 Report: Europe’s Cybersecurity Is Improving – but Implementation Gaps Remain

The European Commission is presenting its draft Digital Fairness Act (DFA) today, with the aim of strengthening consumer protection in digital markets. In an initial response to the draft, details of which have emerged ahead of its official publication, eco - Association of the Internet Industry calls on the Council and the European Parliament to uphold the Commission's original overarching objective of simplifying regulation and making it more accessible. Any new regulatory requirements must be proportionate, provide legal certainty and remain consistent with the existing European legal framework.

"A high level of consumer protection and a competitive Digital Single Market go hand in hand. New requirements must therefore specifically address areas where demonstrable gaps in protection exist. Additional regulation must not result in companies having to assess the same issues under different regulatory frameworks, repeatedly adapt their processes or comply with additional review and documentation obligations," says Alexandra Koch-Skiba, Head of the eco Complaints Office.

The draft addresses, among other issues, dark patterns, influencer marketing, personalised advertising and pricing, practices that encourage increased spending, and addictive design features in digital services. At the same time, existing rules under the Unfair Commercial Practices Directive are to be incorporated into an EU regulation. In doing so, the Commission aims to combine greater harmonisation with new substantive requirements for digital business models.

One new law, many existing obligations: Where is the legal certainty?

From eco's perspective, it is essential that new requirements do not result in the same service features or business processes being regulated multiple times, potentially in different ways. A wide range of regulatory requirements already exists in the area of consumer protection. The DFA is expected to overlap with the General Data Protection Regulation (GDPR), the Digital Markets Act (DMA), the Digital Services Act (DSA), the Artificial Intelligence Act (AI Act), the Audiovisual Media Services Directive (AVMSD) and the EU KIDS Act proposed in September 2026. Companies must therefore be able to understand which provisions apply to their specific services and how these interact. Where gaps exist in current legislation, they should be addressed through targeted and coordinated measures. From eco's perspective, it is generally preferable to amend existing legislation rather than create new regulatory frameworks. Where new legislation is unavoidable, particular attention must be paid to ensuring consistency with existing rules. Otherwise, legal uncertainty will arise.

"Instead of introducing ever more obligations, the EU should first strengthen the consistent and uniform enforcement of existing rules. Companies must be able to rely on comparable situations being assessed consistently across Member States. Divergent interpretations and additional requirements make implementation more difficult in practice, particularly for small and medium-sized enterprises that do not have large legal and compliance departments," says Koch-Skiba.

More regulation is no substitute for effective enforcement

eco therefore calls for the DFA to focus on genuine gaps in consumer protection. New legal requirements should only be introduced where existing rules do not adequately protect consumers. It must also be recognised that not every digital business practice carries the same level of risk and that identical requirements are therefore not necessary in every case. Rules should reflect the actual scale of potential harm to consumers while remaining practical and proportionate for businesses. At the same time, unnecessary administrative burdens should be avoided and cooperation between the relevant authorities strengthened. The guiding principle must be to improve consumer protection in a targeted manner without unnecessarily restricting legitimate business models or the competitiveness of European companies.

Joint open letter by Dot Europe, together with eco, BVDW, the German Startups Association and others