The DMCC Act at One Year: £4.7M in Fines and What It Means for Your Online Shop

When the Digital Markets, Competition and Consumers Act received royal assent, it was easy to dismiss as another piece of Westminster legislation that would gather dust. One year into active enforcement, nobody is dismissing it anymore. The Competition and Markets Authority has issued £4.7 million in fines across 23 enforcement actions, sent warning letters to 157 businesses, and established a pattern that makes one thing clear: the era of light-touch e-commerce regulation in the UK is over.

The DMCC Act gave the CMA powers it never had before. Previously, the regulator had to go through courts to enforce consumer protection law — a process so slow that bad actors could operate for years before facing consequences. Now the CMA can directly fine companies up to 10% of global annual turnover for consumer law violations. No court order required. The shift from reactive to proactive enforcement has been dramatic, and the early cases reveal exactly which practices are in the crosshairs.

Drip pricing tops the enforcement list. The AA Driving School case — a £4.2 million fine for hidden fees added during the booking process — set the precedent. The CMA found that unavoidable charges were being added after customers had already invested time in the booking flow, making the initially advertised price misleading. If your checkout adds fees that aren't disclosed on the product page — booking fees, service charges, mandatory "processing" costs — you are operating in the CMA's primary target zone. The 157 warning letters sent alongside the AA fine suggest a sector-wide sweep, not a one-off action.

Fake reviews are the second major enforcement area. The DMCC Act makes it explicitly illegal to submit or commission fake consumer reviews, and to publish consumer reviews without taking reasonable steps to verify authenticity. Several marketplace operators have already been sanctioned. The practical implication: if you can't demonstrate a verifiable link between a review and an actual purchase, you're carrying regulatory risk. Platforms that rely on third-party review plugins with no purchase verification are particularly exposed.

The mandatory Alternative Dispute Resolution framework, which took effect in April 2026, adds another compliance layer. Every UK e-commerce business must now provide access to a certified ADR provider and inform customers of this right in their terms and conditions. The requirement applies regardless of business size — sole traders on Shopify are covered just as much as enterprise retailers. Non-compliance is a strict-liability offence, meaning the CMA doesn't need to prove harm, only that you didn't comply.

Perhaps most significantly, the DMCC Act gives the CMA powers to enforce against "subscription traps" — auto-renewing contracts where cancellation is deliberately difficult. The requirement for clear pre-contract information, explicit consumer acknowledgment of recurring payments, and straightforward cancellation mechanisms mirrors the strongest provisions of California's Automatic Renewal Law. UK subscription businesses — and that increasingly includes e-commerce retailers with membership or loyalty programmes — need to audit their cancellation flows. If it takes more clicks to cancel than to subscribe, you're non-compliant.

What should operators do today? Start with a checkout audit. Document every fee added between product page and payment confirmation. If any are mandatory and weren't disclosed at the initial price display, fix that immediately. Next, verify your review systems — can you prove each published review came from a verified purchaser? Third, confirm your ADR registration is in place and referenced in your terms. Fourth, test your cancellation flow for any subscription or membership product. The CMA's £4.7 million in year-one fines is likely just the beginning. The businesses that treat compliance as a competitive moat rather than a cost centre will be the ones still standing when enforcement intensifies further.

Data sources: CMA enforcement data (£4.7M total fines, 157 warning letters, 23 actions), AA Driving School £4.2M drip pricing penalty, ADR framework effective date (April 2026), DMCC Act penalty structure (up to 10% global turnover). All figures from Quantis Intel UK Knowledge Base, compiled from CMA publications and regulatory filings.