EU Digital Services Act Provisions Affecting Subscription Transparency

The Digital Services Act's dark-pattern rule, Article 25, says platforms can't make it harder to cancel a subscription than it was to sign up. That single idea touches more everyday wallets than almost anything else in the regulation, but the protection it offers is narrower than most subscribers assume, and the law alone can't fix the real reason people keep paying for things they don't use. Understanding how Article 25 actually works, where it stops applying, and what fills the space it leaves open turns a right on paper into money back in an account.

The Digital Services Act and the platforms it covers

The DSA doesn't treat every website the same way. It sorts digital services into tiers and hands out obligations based on size and reach, so a small forum answers to a lighter set of rules than a company serving tens of millions of people.

The regulation groups "intermediary services" into three buckets: mere conduit, caching, and hosting. Online platforms are the apps, marketplaces, and social networks people actually subscribe to, and they sit inside the hosting category. The strictest obligations land on a smaller group within that category: very large online platforms (VLOPs) and very large online search engines (VLOSEs).

The line for VLOP status is 45 million or more monthly users in the EU. That threshold catches most of the subscription services a typical consumer deals with: streaming platforms, e-commerce marketplaces, social media apps. Size isn't incidental to the DSA's design: it's the trigger for the toughest rules, and it happens to sweep in exactly the services where subscription traps tend to live.

The DSA also reaches past EU borders. A platform based outside the EU that markets to European users or has a large EU user base has to follow these rules just the same as a company headquartered within the bloc.

What Article 25 prohibits in subscription cancellation

Article 25 is a broader rule about interface design, and subscription cancellation falls inside it because the obstructive flows platforms build to keep people enrolled fit the legal definition of manipulation.

The actual test in the text: platforms can't design, organize, or run interfaces that deceive, manipulate, or materially distort or impair a user's ability to make a free and informed decision. Online platforms are specifically barred from using "dark patterns," the nudging techniques built into interface design to steer a user away from what they'd otherwise choose.

Cancellation sits squarely in that definition because of a simple asymmetry. If signing up takes one click and canceling takes five steps, a phone call, and a retention offer, the law treats that gap itself as evidence of distortion. Article 25 is built to catch friction that appears only on the way out, never on the way in.

The clearest case on record is Amazon's "Iliad Flow," the multi-step cancellation design that made leaving Prime far harder than joining it. EU regulatory literature treats this as the textbook example of what Article 25 targets: a design built to extract one more billing cycle by making exit cost more effort than entry ever did. This pattern has a name in dark-pattern taxonomies, "forced continuity," auto-renewal that kicks in without the user actively confirming it, paired with a cancellation process that takes real, unreasonable effort.

The Consumer Rights Directive runs alongside Article 25, but it covers ground that is related and distinct. It requires subscription providers to say whether a contract renews automatically, and for free trials, it requires them to say clearly that a payment obligation follows once the trial ends unless you cancel first. Article 25 governs the design of the interface. The CRD governs the disclosure. Both matter, but they're separate levers.

Where Article 25's scope is narrower than it appears

Article 25 has an exclusion clause, and it cuts the law's reach down to a fraction of where subscription dark patterns actually happen. A hidden carve-out, in practice, confines the prohibition to situations the Unfair Commercial Practices Directive doesn't already cover, and the UCPD already covers most consumer-facing commerce.

Article 25(2) sets up a hierarchy. Where the UCPD already applies to a given practice, Article 25(1) steps back rather than adding a second layer of protection on top of it. That's a meaningful distinction for anyone trying to use this law: the two instruments don't combine forces against a given dark pattern. One replaces the other.

This produces a result that runs against what the rule seems designed to do. Rather than reinforcing the consumer's position by stacking the DSA's dark-pattern ban on top of the UCPD's existing protections, the exclusion clause takes Article 25 off the table in exactly the business-to-consumer interactions where most subscription traps occur. The provision written to stop manipulative cancellation flows ends up deferring to older law in most of the cases where manipulative cancellation flows actually happen.

Legal analysis of the framework points to four specific weaknesses. Article 25's general prohibition is vague, but the UCPD's rules are far more detailed. Its subjective scope is narrow, so many online traders fall outside its reach. The Article 25(2) hierarchy replaces what could have been cumulative protection with an opaque deferral to the UCPD. And the soft-law mechanisms meant to update the rule for new dark-pattern designs move slowly, so enforcement guidance lags behind the tricks platforms are using now.

For a subscriber, this has a direct practical consequence. You can file a complaint under DSA Article 25 against an obstructive cancellation flow, but that doesn't mean the regulator will handle it under Article 25. The complaint may get routed to the UCPD instead, and that redirection carries no promise of a faster process or a stronger remedy. Knowing which law applies where matters if the goal is actually getting money back, not just understanding the theory.

Enforcement cases regulators have already brought

In the early enforcement record, the European Commission acts first and largely doesn't wait for individual subscribers to complain. Systemic scrutiny of platform behavior is the operating mode the DSA was built around.

X, formerly Twitter, became the first platform the DSA fined. The Commission's case cited the platform's blue checkmark, obtainable without identity verification, as a deceptive design practice falling under Article 25. The fine also covered failures in the platform's advertising repository and violations around researcher access to data.

Temu was fined on 28 May 2026, in the largest DSA penalty issued so far. The Commission found Temu failed to adequately identify, analyze, and assess the systemic risks tied to the sale of illegal products on its marketplace. That fine, larger than the one against X, establishes that the Commission is prepared to escalate well past its first penalty when the violation warrants it.

Shein entered formal proceedings on 17 February 2026. The Commission's case looks at addictive design, including reward mechanisms built to keep users engaged, plus a lack of transparency around how the recommender system works and the sale of illegal products. Separately, the consumer group BEUC filed a complaint against Shein over fake discounts and pressure-selling tactics, including "low stock" pop-ups meant to rush a purchase decision. BEUC's complaint lines up with the same urgency manipulation Article 25 was written to stop.

TikTok's case, decided the same day as the X fine, took a different shape. The Commission accepted TikTok's proposed commitments on advertising transparency rather than issuing a penalty. Enforcement under the DSA runs on two tracks: fines for platforms that resist, negotiated commitments for platforms that cooperate early.

The penalties behind all of this are large enough to function as a real deterrent. Violations can draw fines of up to 6% of a company's worldwide annual turnover. Giving misleading information during an investigation carries its own, smaller percentage penalty. If non-compliance continues, it can trigger periodic penalty payments on top of either.

Subscriber rights under the current framework

The DSA and the laws that run alongside it hand subscribers a specific set of rights that can be claimed in concrete situations. None of them work automatically. Each one requires the subscriber to know it exists and to have the facts needed to invoke it.

The first is a right to a cancellation path that isn't harder than sign-up. Any exit flow that forces a subscriber through multiple steps with no equivalent process on the way in can be challenged, either under the Article 25 framework or under the UCPD, depending on which one governs that particular platform and practice.

The second covers free trials. Before a trial converts, the Consumer Rights Directive says a platform has to clearly disclose that a payment obligation follows unless the subscriber cancels first. A platform that lets a trial convert to paid status without having made that disclosure clear has broken a rule that stands on its own, separate from Article 25.

A third right runs through advertising transparency. The DSA requires platforms to disclose how they target ads, including the parameters behind a personalized price. A subscriber who was shown a higher price based on personal targeting, then later sees the same service advertised at a lower rate, has documented grounds for a complaint. That complaint can run under the DSA's transparency rules and the UCPD at the same time.

Beyond individual rights, the DSA sets up a path for raising a complaint that doesn't require a lawsuit. Every online platform, except those small enough to qualify as a micro or small enterprise, has to run an internal complaint management system. EU member states have to make sure certified out-of-court dispute settlement bodies exist for unresolved content moderation disputes, but the DSA doesn't require member states to build those bodies themselves.

None of this works passively. Every one of these rights depends on the subscriber noticing something first: a subscription that kept billing after cancellation, a trial that converted without warning, a price that climbed with no notice given. The right exists. Claiming it still depends on catching the moment it applies.

The gap in noticing the problem that the law cannot close

The DSA changes what platforms are allowed to build. It does nothing to change how often a subscriber actually checks their bank statement or account dashboard and catches a subscription converting, a price quietly rising, or a promised refund that never arrives. Rights written into law only help the subscriber who's watching for the moment they apply.

Money lost to unused subscriptions is usually a story about friction, about cancellation flows designed to wear a person down, and about how easy it is to forget a service exists once the first charge clears. Subscription sprawl isn't a single mistake sitting in the past. Each new service adds a standing obligation that needs ongoing attention to catch the moment it becomes unwanted or overpriced.

You have real, enforceable rights right now, to free trials, price-drop windows, and delivery guarantees. They go unclaimed for one simple reason: no one is watching the clock at the exact moment the window for claiming them opens, or closes.

The DSA's enforcement model runs from the top down. Regulators look for systemic, platform-level violations, not individual subscriber complaints. That structure means a platform coming into full compliance with the DSA doesn't automatically put money back into any one subscriber's account. Compliance at the platform level and savings at the individual level are two different outcomes, and one doesn't guarantee the other.

The Digital Fairness Act, still forthcoming, is expected to close some of what's left: addictive design, unfair personalization, subscription and cancellation traps the DSA doesn't fully reach. Even once it passes, the core problem stays exactly the same. A subscriber who isn't paying attention can't claim a right they don't know has been triggered.

Proactive monitoring as the gap-closer the DSA leaves open

The DSA can govern what a platform is allowed to build into its interface. It can't make a subscriber pay attention. Closing that gap doesn't take a better law. You need to give every subscriber something close to a permanent, attentive auditor, watching for the exact moments the law says they're owed something.

Trial-conversion dates, price changes, auto-renewal cycles, refunds that were promised but never arrived: these are the specific moments where the DSA and the CRD create a claimable right, and they're also the moments best suited to automated detection rather than a person trying to remember a date months in advance.

The security architecture for this kind of monitoring already exists. Under PSD2's Account Information Service framework, a read-only connection to a bank account is a defined, regulated category. An Account Information Service Provider can read account data, but it cannot move money. Consent is bounded by identity, by the type of data shared, by how long the access lasts, and by what it's used for. That's the structure that makes passive, read-only monitoring something a consumer can authorize safely rather than a risk to manage.

PSD3 extends that structure further. On 27 November 2025, the European Parliament and Council reached a provisional agreement, and they published final compromise texts on 23 April 2026. Together, the new payment services regulation and PSD3 raise the performance standards required of banking APIs, add permission dashboards inside banking apps so consumers can see and manage what access they've granted, and phase out screen-scraping as a fallback method. That infrastructure is what makes continuous, automated account monitoring more reliable going forward, not less.

A subscriber who connects more accounts to a monitoring tool sees specific, dated, claimable rights that would otherwise stay invisible. The fuller the picture of what a subscriber is actually paying for, the more precisely each right, each trial deadline, each price change, each broken refund promise, can be caught the moment it applies rather than months after the window has already closed.