On an e-commerce team, basic SEO concepts circulate naturally across roles. SEA runs on its own rules and shared vocabulary, but most people know the main principles.
After a few years of adjustment, GDPR has become routine. A legal basis or proof of consent no longer surprises anyone around a meeting table.
Accessibility is following the same path, a bit behind, but it is starting to show up on roadmaps since the European requirement that makes it mandatory.
But one area still gets far less attention, even though it goes to the heart of conversion work: how an interface leads someone to make a decision.
This ground has been regulated for years. The administration has gone to the trouble of publishing the list of practices it considers unlawful, and a European text now in preparation should widen its scope in the coming months. Yet few teams are genuinely aware of what this regulation covers.
So we took the time to review it lever by lever: what the law says today, what is likely to change soon, and what you put in place when a tactic no longer passes.
Nobody changed jobs, but the lines have moved
Most of the tactics discussed in this article entered interfaces at a time when they were simply part of the shopkeeper's craft, with old equivalents in physical stores, from the end-of-line sign to the announcement of a last day of sales. They settled into checkout flows through tools that made them easy to deploy, often with a single line of configuration, and they produced measurable results that were enough to legitimize them.
The framework then tightened, layer by layer and with no apparent coordination.
In 2022, the transposition of the European Omnibus directive changed how prices, discounts and reviews are displayed. That same year, the purchasing power law made an online cancellation feature mandatory. The DGCCRF published its list of unlawful practices in November 2023. In 2024, the European Digital Services Act began regulating interface design on the largest platforms.
Each of these layers arrived through legal channels, with no dedicated training and no shared vocabulary, which goes a long way toward explaining why the profession never really had a collective discussion about it.
The topic also reaches into areas we thought were purely technical. In our interview with Tomy Ferreira of Payplug, the same dynamic showed up on the payment side, with a regulatory deadline changing checkout flows that nobody thought to reopen.
The reference document that went unnoticed
The most directly useful document fits on one page.
The DGCCRF (the French Directorate General for Competition, Consumer Affairs and Fraud Control) details eight families of practices it considers unlawful on e-commerce sites, each with a definition and concrete examples:
- False time pressure
- Fake stock
- Fake activity
- Unwanted cart additions
- Paid options selected by default
- Hard-to-cancel contracts
- Hidden information or information revealed too late
- Disguised advertising
The list is explicitly presented as non-exhaustive, and the administration specifies that each case is always assessed individually, in light of the context surrounding the practice.
An unfair commercial practice carries a fine of up to €300,000 and two years in prison for an individual, and up to €1.5 million for a legal entity. That amount can be raised to 10% of average annual revenue or 6% of worldwide revenue, in proportion to the benefits gained from the offense.
The amounts give a sense of what is at stake in this regulation.
At the European level, the consumer law fitness check published by the Commission in October 2024 puts the harm to European consumers from all the problems they encounter online at no less than €7.9 billion a year. It sets this against a compliance cost for businesses of no more than €737 million a year.
European authorities estimate that nearly 40% of online stores are affected by at least one bad practice.
Still, not all bad practices belong in the same bucket. Some tactics become unlawful the moment the information shown is false. Others are unlawful because of what they leave out, or when they disclose it.
A few remain allowed under conditions, and that is where the upcoming European text, called the “Digital Fairness Act,” should move the line.
Real urgency is still perfectly legal
Countdown timers, displayed stock levels and activity messages make up the first group, where the line is clearest.
False time pressure means suggesting that an offer is time-limited when it isn't. The countdown that restarts endlessly is the classic example.
Fake stock covers scarcity claims with no reality behind them, from "only a few left" to "high demand, complete your order." Fake activity refers to messages like "twelve people are viewing this product" when the number is simulated.
Urgency and scarcity remain legitimate sales arguments, as long as they are real.
A private sale that really ends Sunday at midnight can show its countdown. The last piece in a size can be flagged as such. A restock expected in three weeks can be announced.
What the European text should change is more consolidation than novelty.
Its scope would extend beyond the largest platforms, the burden of proof would shift closer to the advertiser, and qualification would no longer depend entirely on a case-by-case assessment.
The question of what to use instead opens up if you trace scarcity back to its source. A limited run comes from a workshop's capacity, a sales window from the decision to open and then close it, a weekly drop from the regularity of its return. In all three cases, the display simply reports a fact.
That is what our guide to the four schools of scarcity maps out. The Supreme case shows zero pressure and maximum anticipation, since everyone knows what is coming and when.
A second family of urgency remains, one that benefits the customer: shipping cutoff time, last delivery slot, restock date, production lead time.
The right price
All the regulation around price boils down to one idea you can remember without being a lawyer: when someone commits, they must know what they will pay.
The texts talk about pre-contractual information. The list includes shipping and ancillary fees, and the requirement is mostly about timing, since the information must arrive before the decision.
Four design habits work against this idea, and they are easy to spot once you've named them:
The first is letting the price arrive late.
The DGCCRF targets material information that is hard to see because of its size or position, or revealed too late. Its examples are familiar: small print below the fold, a part of the page the journey never displays, shipping costs that appear once the address is entered. You know the trace this leaves in reports: the drop-off between the delivery step and the payment step, which is often blamed on a slow form.
The second lets the amount grow along the way.
The final cart contains a warranty nobody asked for, the pre-checked box you have to remember to uncheck, the free trial that becomes a subscription after thirty days. Two of these tactics, unwanted additions and preselected paid options, are named explicitly in the list of unlawful practices. Teams are often surprised, since most solutions on the market enable them with a single line of configuration.
The third concerns the crossed-out price.
An announced discount must be measured against the lowest price charged in the previous thirty days. That settles the fate of the reference price that was never actually charged, and of the permanent promotion that ends up becoming the real price.
The fourth is the most interesting because it remains open: individualized pricing.
It is allowed in France, under a condition almost nobody applies: since May 2022, the consumer code requires informing people that a personalized price is being applied to them based on automated decision-making.
An engine that adjusts an amount based on browsing history, device or visit frequency is therefore still possible, provided you say so. Since you almost never come across this notice, a good share of the systems in production are probably already out of bounds without anyone having looked. This is also where the European text states its intentions most clearly, with unfair personalization among its four pillars and attention to systems that exploit financial, cognitive or age-related vulnerability.
The line would then shift from a duty to disclose to a ban on certain uses.
What replaces all this comes down to two moves. Showing the total cost as early as possible, with an estimate on the product page or a postal code entry before the checkout, is probably the most profitable trade-off in this whole inventory, because it removes the unpleasant surprise at checkout that triggers abandonment.
Our method for running a full cart audit details best practices for cost transparency and for handling the free shipping threshold. The one for checkout covers options and steps.
On personalization, the work is to move from opaque individual pricing to segments that are owned and published: loyalty pricing, volume discounts, member pricing, first-order offers. The differentiation stays real, the rule can be explained in one sentence, and the brand stops depending on an opacity that the next comparison tool will expose.
Leaving should be as easy as joining
Hard-to-cancel contracts are also on the list, under a name English-language writing has made memorable: the roach motel.
“The way in is wide and the way out is nowhere to be found.”
French law has addressed this imbalance since 2022, in two stages.
First stage, cancellation. Since the purchasing power law of August 16, 2022, which took effect in 2023, a cancellation feature must be directly and easily accessible from the interface whenever the contract can be signed online.
Second stage, withdrawal, and it's the big change this year. Since June 19, 2026, a dedicated, free function must let people exercise their right of withdrawal directly online, available throughout the legal withdrawal period, with an unambiguous label.
A PDF form and an email to customer service are no longer enough.
The obligation came through a directive on financial services, which explains why merchants paid it so little attention, even though the French transposition wrote it into the general regime for distance contracts. Every online sale to consumers is therefore affected.
A store that sells products often thinks cancellation doesn't concern it. That is less and less true with subscription boxes, paid loyalty programs, extended warranties and unlimited delivery offers. On withdrawal, it is affected without exception. The European text should extend the same logic, with explicit consent when moving from a free trial to a paid service and a reminder before each renewal.
Pop-ups and emotional manipulation
The same symmetry plays out here, this time between accepting and declining, between signing up and moving on.
For tracker consent, the rule is written and well known.
CNIL doctrine holds that refusing must take the same effort as accepting, and that the refusal option must appear on the banner's first layer.
The December 2021 decisions against Google and Facebook, at €150 million and €60 million, were precisely about this asymmetry, and enforcement has since extended to much smaller players. Nothing new on that front.
For the pop-up offering a newsletter or a welcome code, no symmetry rule exists… at least for now.
It's a gray area that lets some teams run windows whose decline button reads "No thanks, I'd rather pay full price."
The name the European text gives this technique is revealing: emotional manipulation. It describes the mechanism well: the pressure falls on someone who has already decided.
Consumer law today penalizes the most serious cases, and the Digital Services Act already regulates, for platforms, interfaces that make people doubt a choice they have expressed. A brand selling direct is, for now, outside that scope.
The fix comes down to wording and frequency. Two labels of equal weight, one prompt per session, and an interface that remembers a refusal.
This is interface writing work, a topic we covered in our interview with Morane Touati, which showed how much words weigh on conversion.
A matter of collective common sense
Regulation rarely comes first.
It observes a practice, measures what it produces, and eventually sets a limit when the market hasn't set one itself. This natural, logical process explains the lag we see in interfaces: the tactics described in this article circulated for fifteen years before the law took them up.
Part of today's work is closing a gap in awareness rather than a gap in compliance.
What makes this moment unusual is the speed at which these tactics are now deployed.
A generated theme, a component produced from a few sentences, a module installed in one click: these tools bring along design habits they didn't choose, and they reproduce them because those habits were the majority in what existed before. The decorative countdown and the guilt-tripping pop-up now spread without anyone deciding to put them there.
Asking where what's displayed comes from becomes all the more necessary as the distance grows between the person who installs and the person who designed.
But let's stay optimistic: there is an encouraging precedent. SEO, accessibility and page load performance followed this path. Each began as a specialist concern, often seen as a brake, before becoming a shared reflex, then a quality criterion built into the tools themselves.
Nobody argues anymore about the value of a fast site or enough contrast. These topics have moved out of the realm of constraint and into the realm of doing good work.
Dark patterns can follow the same trajectory, and waiting for a law is not the best way to get there. A team that decides to show nothing it can't justify takes a position that is simple, sustainable and easy to explain to management, without needing to know the article of the code behind it. It is also what separates an experience you stand behind from one you hope won't be inspected.
The European text will eventually arrive, in a form we don't know yet.
The question it raises is already on the table, and nothing says you have to wait to answer it.
