Moving At Pace: The CMA’s Use Of New UK Consumer Protection Powers And What To Expect In Year 2

In April 2025, the Competition and Markets Authority (CMA) acquired new powers to enforce consumer rights under the Digital Markets, Competition and Consumers Act 2024 (DMCCA). The CMA has deployed these new powers at pace in the first fourteen months. It has imposed a £4.2 million fine combined with an order to refund £760,000 to consumers for drip-pricing practices; imposed a £720,000 fine combined with an order to refund £600,000 to consumers for automatic opt-in charges; issued 157 advisory and warning letters; sent 46 information notices (and imposed a substantial fine for non-compliance); opened investigations into 14 businesses, and settled with two others. This sends a clear message to businesses to expect swift and active enforcement of consumer protection in the UK under the new regime. We set out below a short recap of these new powers, a summary of the CMA’s enforcement to date, and what to expect in Year 2.

Recap of the CMA’s New Consumer Protection Powers

The DMCCA has fundamentally reshaped consumer rights enforcement in the UK. It gave the CMA direct enforcement powers to determine whether consumer rights have been breached and to impose sanctions directly, without first seeking a court determination. The CMA’s investigation and fining powers under consumer protection rules now broadly align with those available for competition law enforcement, and include additional enhanced remedial consumer redress tools. These include the power to:

• Conduct dawn raids, send formal information requests, and impose penalties of up to 1% of global annual turnover and additional daily penalties for non-compliance with such requests;
• Impose fines of up to £300,000 or 10% of global annual turnover (whichever is higher) for substantive breaches; 
• Impose “Enhanced consumer measures” (i.e., conduct requirements, such as mandatory consumer compensation) and “online interface notices” (i.e., orders to change online interfaces, such as to modify or remove online content);
• Apply criminal sanctions for certain breaches; and
• Agree settlements, accept undertakings, and impose fines for any breach of those undertakings.

The unfair commercial practices (UCPs) prohibited under the DMCCA remain substantially unchanged, albeit the DMCCA clarifies the rules, streamlines, and removes certain tests, making it easier to establish a breach. In summary, UCPs are practices that are “likely to cause the average consumer to take a transactional decision that the consumer would not have taken otherwise” as a result of a misleading action, omission, aggressive practice, or a contravention of the requirements of “professional diligence”. The DMCCA also specifies 32 commercial practices that are considered unfair in all circumstances and prohibits the omission of material information from an invitation to purchase. Further new rules on subscription traps are expected in Spring 2027. Most of these practices were already unlawful under preexisting law. Still, the DMCCA now expressly prohibits drip pricing (i.e., adding hidden mandatory charges late in the purchasing journey) and fake or misleading reviews.

The CMA’s Enforcement Activity to Date

In the last fourteen months, the CMA has conducted a review of 400 businesses across 19 sectors, focusing primarily on three priority areas: drip pricing, fake reviews, and online choice architecture, with the stated aim of targeting the most serious breaches in sectors that matter most to household spending.

Drip pricing. The CMA was most active in relation to drip pricing. In April 2026, it imposed a £4.2 million fine on AA Driving School (Automobile Association Development Limited), accompanied by an order to refund over £760,000 to some 80,000 learner drivers for failing to include a mandatory £3 booking fee in the upfront price. The fine would have been much higher, but AA Driving School received a 40% reduction for early admission and settlement.

This fine could well be dwarfed in the near future if the CMA’s investigation into Ryanair, opened on June 10, 2026, results in a finding of infringement. In this case, the CMA is investigating Ryanair’s £8 additional booking fee for a “mandatory family seat” to secure an adjacent seat for a child aged 2-11, including whether the fee is presented upfront or is “dripped” later in the booking process.

The CMA has four additional drip pricing investigations ongoing, opened in November 2025, against two secondary ticketing sites, StubHub and Viagogo, as well as Gold’s Gym and BSM Driving School. It has issued warning letters to 100 businesses regarding drip pricing, suggesting there may be further enforcement on this issue in the coming months if the CMA’s concerns are not addressed.

Fake reviews. Continuing its work in recent years on fake online reviews, in March 2026, the CMA opened formal investigations into five businesses for suspected fake and misleading reviews, namely Autotrader, Feefo, Dignity, Just Eat, and Pasta Evangelists. This followed warning letters sent to 54 businesses in July 2025.

Online choice architecture. On June 18, 2026, the CMA imposed a fine of £720,000 on Marks Electrical plus an order to refund around £600,000 to around 40,000 customers for automatically opting customers in to purchasing additional services when buying its appliances. As in the case concerning AA Driving School (see above), Marks Electrical received a 40% reduction for early admission and settlement. The CMA has two additional investigations ongoing, opened in November 2025, concerning time-limited sales and/or default opt-ins in the household goods sector against Wayfair and Appliances Direct.

Other conduct. Beyond these three areas, the CMA launched an investigation into early cancellation fees in March 2026. Separately, in February 2026, the CMA issued a fine of £473,000 for failing to comply with an information notice, which demonstrates that even procedural non-compliance carries its own significant risk.

What to Expect in Year 2

The CMA has been explicit about its Year 2 priorities, which are: price transparency, fake reviews, consumer contract terms (including subscription contracts where new rules come into force in Spring 2027), and AI and its deployment by businesses. For in-house teams, the immediate practical steps are to ensure pricing is transparent and all-inclusive from the outset, review policies around online reviews for authenticity and accuracy, audit consumer-facing contracts (including exit and cancellation fee provisions) against the CMA’s most recent guidance, and consider how AI-generated or AI-assisted customer interactions are disclosed and governed.

Businesses that received warning letters last year in key areas of consumer spending – including operators in train and bus travel, cinemas, parcel delivery, and food and drink delivery – could face a formal investigation if they do not bring their practices into line.

Where the application of the law is genuinely uncertain, businesses should engage early and proactively with the CMA, which has clearly signaled its openness to dialogue with stakeholders and its willingness to provide bespoke and practical guidance.

An attractive enforcement tool for the CMA

The new consumer protection regime equips the CMA with investigative and fining powers akin to those under the competition regime, but enforcing it will potentially be far easier and quicker. This is because establishing a UCP does not require complex and detailed economic analyses of market definition and dominance, as is required in competition investigations, which often run for years. By comparison, the CMA’s first consumer protection settlement case and fine against AA Driving School was concluded in less than five months. That pace, combined with fines of up to 10% of global turnover, makes consumer protection enforcement an efficient and high-impact — and therefore attractive — tool for the CMA to deploy. Given the parallels between the investigative and enforcement powers under the consumer protection and competition regimes, a question that arises is whether the CMA may be able to address certain types of conduct through the consumer protection regime rather than pursuing conduct as an abuse of dominance. Enforcement of this type would be limited to consumer-facing conduct; there, examples of the kind of conduct that theoretically might be capable of being pursued under both regimes could be excessive pricing, as well as tying and bundling. However, it seems such conduct would need to be combined with opacity/ a lack of transparency or aggressive practices (such as exploitation of vulnerable consumers) in order to constitute a UCP. Also, the practice would need to be “likely to cause the average consumer to take a transactional decision that the consumer would not have taken otherwise”. Given these difficulties, the CMA may not be tempted to seek to deploy its new powers in this way, at least in the short term. In the meantime, given the pace set in the first fourteen months, the number of current ongoing investigations, and an ambitious set of priorities for Year 2 (including in relation to the deployment of AI by businesses), the next ten months will be interesting.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.