The UK’s new digital competition law is coming online. What do you need to know?

The Digital Markets, Competition and Consumers Act 2024 (DMCCA) came into force at the start of the year after new legislation was passed last May. The Act is part of an effort to protect consumers and smaller businesses from the big tech companies.

What does this mean for businesses?

With this Act, the government is taking bold steps to promote fair competition and strengthen consumer protections. This landmark legislation hands significant new powers to the Competition and Markets Authority (CMA) to regulate major digital firms, crack down on unfair business practices, and ensure that UK consumers are treated fairly. In an era dominated by tech giants, the DMCCA is a direct response to concerns about market dominance, misleading marketing tactics and outdated competition rules.

The big changes

Big tech in check

The Act introduces a Strategic Market Status (SMS) designation for large digital firms that have significant power in specific markets linked to the UK. Once designated, these companies will face stricter regulations to ensure they don’t engage in anti-competitive behaviors like favoring their own products in search results or limiting access to their platforms for smaller competitors. The CMA is also empowered to enforce Pro-Competition Interventions (PCIs) which are measures that could require major tech firms to improve data-sharing or even change how their algorithms operate.

Tougher scrutiny on mergers and acquisitions

The DMCCA updates UK merger control rules to reflect the realities of the digital economy. Key changes include:
  • Raising the turnover threshold for merger reviews from £70m to £100m
  • Introducing a new test where acquisitions can be reviewed if one party has a 33% share of supply in the UK and a turnover exceeding £350m
  • Requiring SMS-designated firms to report mergers and acquisitions before completion, ensuring deals that could harm competition face regulatory scrutiny upfront

Stronger consumer protections

Hidden fees and deceptive marketing tactics could be a thing of the past. The DMCCA introduces new rules to protect consumers from unfair business practices, including:
  • Fake reviews, which means companies can no longer manipulate ratings or post misleading testimonials
  • Crackdown on hidden fees that only appear at checkout. This must be made clear from the outset
  • Businesses must make it easier for consumers to cancel unwanted subscriptions 
For the first time, the CMA has direct enforcement powers, meaning it can fine businesses up to 10% of their global turnover for breaching consumer law. This is a game-changer, as it allows for quicker and more effective crackdowns on unfair practices.

Why was the DMCCA introduced?

There are a number of factors that drove the UK government to introduce this legislation:
  • Companies like Google, Amazon, and Meta have been accused of stifling competition by favoring their own products, restricting interoperability and acquiring potential rivals before they can grow.
  • Subscription traps, fake reviews, and misleading pricing practices have become rampant in digital markets, leading to growing frustration and complaints.
  • UK competition rules were designed for traditional markets and struggled to keep up with the fast-moving digital economy.
  • The EU’s Digital Markets Act (DMA) and increasing scrutiny in the US show that governments worldwide are clamping down on big tech.
  • By preventing monopolistic behavior, the UK aims to create a fairer environment where startups and small businesses can thrive.

What should you do?

If your business operates in the digital space or interacts with UK consumers, the DMCCA will likely impact you. Here’s what to do:
  • Assess your SMS risk. If your company has significant market power, you may face new compliance obligations under SMS rules.
  • Review any M&A plans. Make sure your mergers or acquisitions don’t fall foul of the CMA’s revised thresholds and reporting requirements.
  • Audit your consumer practices. Check your advertising, pricing and subscription models to ensure compliance with new consumer protection laws.
  • Implement more effective compliance programs. Train your staff, update policies and monitor regulatory changes to stay ahead of enforcement actions.
  • Engage with the CMA. This is important. If in doubt, seek guidance from regulators and proactively address compliance concerns before they become legal issues.
The DMCCA indicates a major shift in how digital markets are regulated in the UK. It’s a clear message to tech giants that unchecked dominance won’t be tolerated. Businesses that adapt quickly and embrace the act will manage and even thrive, while those that ignore these changes could face tough penalties. The bottom line is if you’re in the UK’s digital marketplace, you need to take notice and get ready.
How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.