In short. DSA Article 25 prohibits deceptive or manipulative interfaces on covered online platforms, excluding practices covered by consumer law or the GDPR.
Definition: Article 25 of the Digital Services Act (DSA) prohibits covered online platform providers from designing, organising or operating interfaces that deceive or manipulate users, or otherwise materially distort or impair their ability to make free and informed decisions. Its scope includes exclusions for small providers and practices covered by specified consumer or data protection law.
Key facts
- The DSA's Article 25(3) identifies unequal prominence of choices, repeated requests after a choice, and cancellation procedures that are harder than subscription as practices on which the Commission may issue guidelines.
- The General Data Protection Regulation (GDPR), Article 7(3), requires withdrawing consent to be as easy as giving it.
- The Unfair Commercial Practices Directive, Article 3(1), covers unfair business-to-consumer commercial practices before, during and after a commercial transaction concerning a product.
Which interface practices fall within the prohibition?
The DSA, Article 25(1), establishes the general prohibition on deception, manipulation and material interference with free and informed decisions. Paragraph 3 identifies specific practices, including pop-ups that repeatedly request a decision already made. It authorises Commission guidelines on applying the prohibition to those practices.
Recital 67 describes dark patterns as practices that materially distort or impair autonomous, informed choices, either on purpose or in effect. Its examples include presenting choices non-neutrally through visual or auditory prominence, making cancellation significantly more cumbersome than signing up, and default settings that are very difficult to change and unreasonably bias decisions. The recital also identifies unreasonably difficult procedures for discontinuing purchases or signing out of an online marketplace.
Which websites and providers are covered?
Under the DSA, Article 3(i), an online platform is a hosting service that stores and disseminates information to the public at a user's request, subject to an exception for minor, purely ancillary features. Article 3(m) defines an online interface to include websites, parts of websites and mobile applications. Operating a website alone therefore does not establish online-platform status.
Article 2(1) covers intermediary services offered to recipients established or located in the EU, irrespective of the provider's place of establishment. Article 93(2) sets the DSA's general application date at 17 February 2024.
Article 19 excludes qualifying micro and small platform providers from the section containing Article 25. It refers to Recommendation 2003/361/EC for those categories and extends the exclusion for 12 months after loss of that status, subject to the designated very large online platform exception. Designated very large online platforms remain covered regardless of micro or small enterprise status.
How does Article 25 interact with other laws?
The DSA, Article 25(2), expressly excludes practices covered by Directive 2005/29/EC or Regulation (EU) 2016/679. These are the Unfair Commercial Practices Directive and the GDPR respectively.
For commercial information, the Directive's Article 7(2) addresses hiding material information or providing it unclearly, ambiguously or too late, where this causes or is likely to cause a different transactional decision. For personal-data consent, GDPR Article 7(2) requires a consent request within a written declaration covering other matters to be clearly distinguishable, intelligible and easily accessible, with clear and plain language.
Related terms
- Which DSA platform duties have a microenterprise exemption?
- DSA advertising transparency
- How must a website let visitors withdraw consent under GDPR Article 7?
FAQ
Does Article 25 ban every offer of an additional service?
Recital 67 of the DSA preserves direct interaction with recipients and offers of new or additional services. It also distinguishes legitimate advertising practices that comply with EU law from dark patterns.
Can business users fall within the protected group?
Yes. Article 25 protects recipients of the service, and the DSA, Article 3(b), defines a recipient as any natural or legal person using an intermediary service, including to seek information or make it accessible.
Sources
- EUR-Lex, "Regulation (EU) 2022/2065 (Digital Services Act)", 19 October 2022
- EUR-Lex, "Regulation (EU) 2016/679 (General Data Protection Regulation)", 27 April 2016
- EUR-Lex, "Directive 2005/29/EC (Unfair Commercial Practices Directive)", consolidated text of 27 September 2026
Check how a page reads to answer engines. Open the GEO score analyzer