UK Consumer Protection Regime – Lessons From the First Investigations by the UK’s Competition and Consumer Regulator

In April 2025, new consumer protection measures under the Digital Markets, Competition and Consumers Act 2024 (DMCCA) came into force. This ushered in a new and significantly enhanced consumer protection enforcement regime administered by the UK Competition and Markets Authority (CMA) which has now been in force for almost 18 months and has not wasted any time in flexing its enforcement muscles. In that period, and across several sectors, the CMA has opened investigations into 19 businesses, issued more than 100 advisory letters, imposed fines of close to £6.2 million and ordered over £1.95 million in consumer redress. Further, the CMA shows no signs of stopping.

In this alert, we discuss key lessons which can be drawn from the first round of investigations and comment on what businesses should expect from the CMA going forward.

1. The CMA’s new powers

The DMCCA introduced new direct consumer enforcement powers and updated and expanded existing consumer protection prohibitions. Each of these developments is significant in its own right, and we summarised them in our April 2025 alert. Importantly, the CMA is now able to conduct investigations and issue infringement decisions without recourse to the court system (which is now only engaged in the event of an appeal against a CMA decision by the undertaking involved), and notably, is able to impose very significant fines.

As well as introducing a new enforcement approach, the DMCCA also updated the UK’s consumer law powers with various amendments and new prohibitions designed to better reflect the digital economy. As a result, the CMA’s stated current enforcement priorities have targeted three areas: fake reviews, drip pricing and online choice architecture.

2. Key lessons from recent investigations

The CMA is pursuing significant and aggressive enforcement and is actively monitoring businesses operating in the UK. The CMA has opened investigations into 19 businesses in just under a year across a wide range of sectors, including travel, ticketing, driving schools, gyms, parking, fashion, homeware and technology. In addition, the CMA has issued approximately 160 advisory and warning letters and approximately 50 information notices. At least three of these advisory letters are known to have since led to investigations. The CMA is clearly investing resource in delivering on its promise to act with pace.

It is also evident that the CMA is actively monitoring businesses. With the relevant conduct in most cases being publicly visible online, this is a relatively straightforward task for the CMA, which has developed its own sophisticated data tools allowing it to monitor and screen a wide variety of business practices. Businesses should take note that an advisory letter from the CMA is to be taken seriously and could lead to enforcement action if the CMA identifies through its monitoring that the issues identified have not been swiftly addressed. Key lesson: Businesses would be well advised to investigate quickly (under privilege) when warning letters are received, as prompt action to establish whether or not there is any wrongdoing, and consequential rectification can mitigate risk and level of enforcement.

Getting it wrong leads to meaningful fines and consumer redress is a key feature of the enforcement matrix. Out of the 19 investigations opened, three have concluded via the CMA’s settlement route. The CMA’s settlement procedure offers a reduction in the fine of up to 40% in exchange for an admission of liability and full cooperation. Notwithstanding this discount, fines have run into the millions of pounds and, in each case, the settlement included a consumer redress scheme to refund those affected by the relevant conduct.

• The AA and BSM Driving Schools: Redress of £760,000 to affected learner drivers and a total fine of £4.2 million for engaging in drip pricing. The CMA’s investigation found that, between April and December 2025, more than 80,000 learner drivers were not shown the total price upfront when booking driving lessons online, as a mandatory booking fee was only included later in the booking process.
• Marks Electrical: Redress of £600,000 to affected consumers and a fine of £720,000 in relation to online choice architecture where consumers were automatically opted in to certain services without their consent.
• StubHub UK: Redress of £590,000 to affected consumers and a fine of £889,200 in relation to failing to include mandatory fees in the price of tickets shown at the beginning of the sales process (‘drip pricing’).

In addition, in February 2026, the CMA imposed a £473,000 penalty on Euro Car Parks for failure to respond to an information request. This was the first procedural penalty under the new regime and was imposed before the CMA had opened a formal investigation into the company. While the penalty remains under appeal, the CMA has since opened a full investigation into Euro Car Parks to examine whether its practices at petrol stations and its wider appeals process are in breach of UK consumer protection law. Key lesson: The CMA is open to settling these matters, but the reality is that it is not settlement in the way that companies might be used to in ordinary commercial litigation. It is highly procedural, involves an open admission of liability and the settled fines still remain notable.

Consumer enforcement takes priority. The CMA’s enthusiasm to use its new powers is matched by the current government’s focus on cost of living and doorstep issues. As a result, the CMA is now seemingly prioritising consumer over competition law enforcement. In its 2026 annual plan (which we wrote about in April 2026), the CMA indicated that this would be the case. This objective has been supported by aggressive enforcement in practice and significant investment in expanding the consumer enforcement team. To date, the CMA has launched only two antitrust investigations using its powers under the Competition Act 1998 (CA98) during 2026, which stands in stark contrast to the 19 consumer law investigations launched by the CMA since November 2025. Key lesson: Your commercial practices are under the spotlight, and proactive compliance should be seen as a key risk mitigation tool.

The CMA is investigating a broad array of practices. Whilst most cases opened to date fall within its priority areas (fake reviews, drip pricing and online choice architecture), the CMA is also looking at a broader range of consumer protection issues. Other investigations include whether early cancellation fees are unfair and misleading, changes to subscription terms and conditions, time-limited promotional offers and unfair fees. Key lesson: All businesses selling goods and services to consumers should consider themselves in scope.

Being small is no defence. The CMA is not focused only on the largest businesses or any particular sector. Its enforcement targets span a wide range of sectors and business sizes ranging from large US technology companies to smaller UK businesses and small and medium-sized enterprises (SMEs). Key lesson: Compliance matters regardless of size.

Quick resolutions and high case throughput. The CMA has been explicit that it will aim to conduct investigations with pace, prioritising cases that establish precedent and create a deterrent effect in order to promote both business confidence and consumer trust. So far, it seems to be delivering on its promise.

In contrast, a recent UK High Court judgment brought to a close a four-year enforcement case against Emma Matratzen GmbH (Emma Sleep) conducted under the CMA’s previous enforcement powers. The case principally concerned the use of recommended retail prices (RRPs) and ‘was’ pricing and regularity of promotions. While Emma Sleep settled and/or admitted certain elements of the case, the CMA lost on the ratio between products Emma Sleep had to sell at full price versus those it could sell at a discount, with the High Court finding that the CMA’s approach to reference pricing was unjustified and unworkable. The case is, for the time being, damaging to the CMA’s ability to pursue reference pricing breaches and it is to be expected that the CMA will seek to close cases by way of settlement to avoid other cases moving to protracted appeals with the risk of unhelpful precedents. Key lesson: If you are involved in an investigation, you can expect matters to move much more quickly than traditional court proceedings.

Greater CMA focus on consumer protection is consistent with other regulators and a global approach to compliance is recommended. In general, we see heightened and similar activity by consumer regulators in other jurisdictions, focusing largely on the companies’ online activities. In particular, certain of the UK’s new provisions are similar to Section 5 of the , which bans business practices that cause harm to, or are likely to mislead, consumers, supplemented by narrower federal statutes such as the Restore Online Shoppers’ Confidence Act (ROSCA) for subscription/negative-option features, which we have written about here. Whilst the FTC, unlike the CMA, does not have direct enforcement powers, consumer law compliance programmes for international businesses – particularly those with common online interfaces and promotional mechanics – should be developed from a global viewpoint.

We are also anticipating an enhanced regime in the EU where the Digital Fairness Act will look to build upon the existing consumer protection measures around unfair commercial practices, and, similar to the DMCCA, look to bring them up to date with the digital economy. Whilst no draft legislative text has been tabled as yet, when it does appear, it is anticipated that it will cover dark patterns, addictive design, personalised decision-making and pricing, influencer marketing, protection of minors and vulnerable consumers, and will enhance current enforcement measures. Key lesson: This is a global issue, and businesses will need to look at compliance top down and bottom up.

3. Looking ahead – Future enforcement priorities and next steps

The CMA has signalled that in year two of its enforcement of the DMCCA, which we are now in, it will focus its enforcement efforts on the following areas:

• Subscription contracts: New rules around subscription contracts are expected to come into force in January 2027 as part of the government’s series of ‘everyday fixes’ to help UK consumers with the cost of living, with guidance to be issued around a similar time. Businesses will need to provide clearer information upfront, regular reminders and an easier exit. The CMA expects businesses to comply with the new rules as and when they come into force. We anticipate that the CMA is already actively monitoring businesses now with a view to launching investigations as soon as the new powers come into force.
• Price transparency: Businesses are advised not to use ‘dripped’ or unlawful partitioned pricing. Any claims in relation to discounts must be true and not misleading.
• Fake reviews: The CMA expects businesses to have “robust policies” in place, so reviews give consumers a good and honest indication of what others are saying (and businesses are expected to enforce and implement these policies)
• Terms in contracts with consumers: Businesses should review their terms against the CMA’s revised guidance to ensure their terms are fair and transparent. This is especially relevant if contracts impose exit fees on consumers.
• The use of AI, including agents: Specific focus is also placed on how businesses use AI, including AI agents. We wrote about this in March 2026.

These developments are set against a wider legislative picture whereby the UK government is expected to launch a consultation in the autumn of 2026 to assess whether false or misleading “was” prices and RRPs should be added to the list of automatically banned practices under the DMCCA. These practices are currently not on the list of practices that are always considered unfair in the DMCCA. Instead, they require an assessment of whether the prices are misleading and have caused a consumer to take a transactional decision that they would not have otherwise taken, but given the adverse ruling in the Emma Sleep case, we may see these practices added to the list.

Whilst enforcement action is ramping up, the impact for current or prospective defendants of investigations remains to be seen – particularly, whether we will see follow-on damages actions and/or if the government chooses to expand the opt-out class action regime to cover consumer law breaches in the same way as it applies to the competition regime.

Overall, compliance with consumer protection regimes is a multidisciplinary effort requiring coordination from legal, engineering, marketing and audit against increasingly complex and fragmented international laws and regulations. Businesses are advised to review compliance for each step of the consumer’s journey – from marketing through to post-sale services – and assess compliance from a global viewpoint.

The Cooley team continues to monitor these developments closely. If you would like to speak to someone about your compliance with UK or global consumer protection regimes, please contact a member of the Cooley team listed below.