Consumer protection: New powers of the CMA under the DMCC Act 2024

In this article, we will look at the new powers vested in the Competition and Markets Authority (CMA) under the Digital Markets, Competition and Consumers Act 2024 (DMCC) to enforce compliance with consumer protection laws. 

What is the DMCC Act?

The purpose of the DMCC is to give more tools and sharper teeth to the CMA in its regulation of consumer law. The legislation ties together the regulation of the online sale and supply of goods and services in the UK, with greater accountability for companies engaging with UK customers, highlighting the importance of compliance with consumer protection standards. 

The CMA plans to target a number of key areas of consumer law, including:

• Aggressive sales practices (such as dynamic/surge pricing)
• Hidden fees, 
• Fake reviews,
• Subscription models, 
• Online choice architecture, and
• Greenwashing.

What are the CMA’s new powers?

The CMA has both civil and criminal consumer enforcement powers. This could mean court-based litigation (under both the civil and criminal regime), however the CMA now has the ability, under Parts 3 and 4 of the DMCC, to directly enforce consumer law. 

Previously, the CMA’s powers were limited by the Enterprise Act 2002, which allowed the CMA to investigate breaches of consumer law, agree undertakings with companies to remedy breaches, and apply to the courts to enforce these undertakings. Now, the CMA has the power to directly and autonomously determine whether consumer law has been breached, and take enforcement action, without the need to pursue these matters through the court system. 

Provisional Infringement Notices (PINs) 

PINs are the first enforcement step following the commencement of an investigation by the CMA. A PIN is a notice which requires a company to stop infringing consumer protection law. Additionally, the CMA can require a company to publish the notice made against it, as well as (where applicable) issue or publish a statement of correction. 

Financial Infringement Notice (FINs)

Where a company does not comply with a PIN, the CMA can next issue a Financial Infringement Notice (FIN) and impose financial penalties.

Corresponding with the CMA’s power under competition law, these fines can reach £300,000 or 10% of the company’s global annual turnover – whichever is greater. 

The CMA also has the power to fine the company for not complying with the terms of their investigation (e.g., if the company does not disclose relevant information or frustrates the investigation in some way). Fines here can reach £30,000 or 1% of the global annual turnover – again, whichever is greater. 

Accepting undertakings and imposing penalties for non-compliance

The CMA still has the power to accept an undertaking rather than issue one of the new notices if an investigation identifies consumer law breaches. 

The CMA can also make directions. These include Enhanced Consumer Measures (ECMs) which require a company to compensate affected customers, improve compliance with the regulations to prevent additional breaches, and/or assist customers to obtain relevant market information to enable them to make better purchasing decisions. The other direction available to the CMA is an Online Interface Notice (OINs) which provide the CMA with broad powers to impose obligations on companies to take or refrain from certain actions with respect to websites, applications or other digital content used for the promotion or supply of goods, services, or digital content to UK consumers.

Breaches of undertakings, orders, or directions can result in a fine from the CMA of up to £150,000 or 5% of the global annual turnover. To add a further sting in the tail the CMA can impose a daily penalty of up to £15,000 or 5% of the company’s global daily turnover, per day, until compliance is met. 

It is important to note that daily penalties cannot be imposed where the offence is one of providing false or misleading information. Here, the CMA can require companies to produce evidence (under the burden of proof) that any factual claims made are accurate. 

Limited liability companies: Further considerations

Directors and senior managers of limited liability companies must be alive to the constraint of the limited liability principle here. The DMCC allows for the CMA to enforce its powers (including the issuance of financial penalties) to certain individuals or ‘accessories’ within a company. In practice, this means that if an individual has a certain level of control over the affairs of a company and their behaviour is deemed to be directly attributable to the infringing activity, they can personally face liability for up to £300,000. 

Jurisdictional reach

The DMCC allows for broad jurisdictional reach – the CMA has power to act against any person or entity infringing UK consumer protection law, so long as they:

• Have a place of business in the UK, 
• Undertake business in the UK, and/or
• Direct their activities to consumers in the UK.

Another point of interest is that the CMA has the ability to require information about suspected infringements of UK consumer protection law from companies based outside of the UK and third parties that have a UK connection – with ‘connection’ being subject to a broad definition. 

Will these powers come into effect immediately?

There will be no specific ‘transition period’, however, it is understood that the early stages of this new regime will focus the CMA’s attention on the most ‘serious’ infringements which will work to provide companies with a grace period, expected to last around 12 months into 2026. In addition, until early June 2025, the CMA has stated that it will prioritise supporting companies to comply with the new regulations, instead of taking a punitive approach from day one. 

The financial penalties issues are also likely to be lower in the initial period of implementation, and the DMCC does not apply retrospectively to activity that took place prior to the date of Royal Assent. 

Nevertheless, the CMA has confirmed that it may have regard to past conduct of a company when determining penalties. Therefore, companies should consider that previous failure to comply with enforcement action may work against them.

What is the CMA’s approach to enforcement action?

The functional aim of the DMCC’s strengthening of the CMA’s powers is to ensure high impact results by changing market behaviour and deterring potential rule breakers. 

In particular, the CMA will have mind to:

• Where breaches of the law point to systemic failures in a market,
• Where changing the behaviour of one business would set a precedent or have other market-wide implications,
• Where there is an opportunity to set an important legal precedent, or
• Where there is a strong need for deterrence or to secure compensation for consumers. 

Can the CMA’s decisions be appealed?

Yes – any person to whom a relevant notice is given may appeal against the CMA’s decision to give directions or to impose a penalty. A person may also appeal the nature and/or amount of any such penalty. Any appeal will be made to the High Court in England, Wales, and Northern Ireland. In Scotland, the appeal is made to the Outer House of the Court of Session.

Where can further guidance be found?

The CMA has published its own guidance document, Direct consumer enforcement guidance: CMA200, which is worth reviewing to ensure companies have a full understanding of the impact of these new enforcement powers.