"We're Just Getting Started": The CMA's New Consumer Enforcement Powers in Action

Introduction

One year on from the coming into force of its extensive new direct consumer enforcement powers, and associated fining regime, under the Digital Markets, Competition and Consumers Act 2024 ("DMCCA"), the Competition and Markets Authority ("CMA") has moved with notable speed and purpose. Consumer enforcement is now a frontline regulatory priority, backed by meaningful financial penalties and mandatory redress orders. Importantly, these powers extend beyond consumer-facing subsidiaries - liability can be traced up through corporate structures to parent companies, particularly relevant to financial sponsors. In its first year (April 2025 to April 2026), the CMA opened investigations into 14 businesses, ordered more than £1.3 million in consumer refunds, imposed fines approaching £6 million, issued 157 advisory and warning letters, and sent 46 information notices. Since April 2026, the CMA has continued to work at pace in this area, opening further cases and issuing updated guidance. To date, the CMA has focused, in particular, on drip pricing, fake reviews, and online choice architecture (countdown timers, default opt-ins, etc.), with work also undertaken in more traditional areas of unfair contract terms and unfair commercial practices. This Legal Update summarises emerging trends, lessons from the first wave of cases, and practical steps businesses should be taking now.

Strategic Context: Consumer Enforcement as a Growth Priority

The CMA's 2026–2029 Strategy places consumer protection at the centre of its mandate to drive economic growth. The government's Strategic Steer directs the CMA to "grow the economy through promoting consumer trust and confidence, while deterring poor corporate practices." In line with this, the CMA has established a new Consumer Forum and routinely conducts stakeholder surveys to keep consumer perspectives at the heart of its decision-making. The CMA's 4Ps framework, Pace, Predictability, Proportionality, and Process, means faster investigations, clearer expectations, and a more efficient enforcement machine. This has been seen in consumer work, in particular, where the lumbering old regime has given way to rapid enforcement and resolution of issues.

Cases So Far

1. AA and BSM Driving Schools: Drip Pricing

The CMA's first enforcement case imposing penalties under the new regime targeted drip pricing by the AA Driving School and BSM Driving School. The investigation found that more than 80,000 learner drivers were not shown the total price upfront when booking lessons online; instead, a mandatory £3 booking fee was added later in the checkout process. The CMA ordered more than£760,000 in refunds and imposed a fine of £4.2 million. AA received a 40% reduction for admitting the breach and settling early; the fine before the settlement discount was £7 million. CMA Chief Executive Sarah Cardell commented: "If a fee is mandatory, the law is clear: it must be included in the price from the very start–not added at checkout… With our new powers, it will never pay to break the law or treat consumers unfairly."

2. Marks Electrical: Default Opt-In

In June 2026, the CMA found that Marks Electrical had pre-selected and charged customers for extra services (recycling of old appliances and packaging removal) without their express agreement. Nearly 40,000 customers were affected. The CMA imposed a fine of £720,000 and ordered approximately £600,000 in refunds. As with the AA, Marks Electrical received a 40% reduction in the financial penalty for admitting the breach and settling early. Emma Cochrane, Executive Director of Consumer Protection at the CMA, stated: "The law is absolutely clear that automatically opting customers into extra charges is never ok… All businesses need to check their policy on automatic opt-ins–the bottom line is that they should not be used."

3. StubHub: Hidden Fees

Also in June 2026, the CMA imposed a financial penalty of £889,200 on StubHub for infringing consumer protection law in relation to the presentation of mandatory fees. The penalty included a 40% reduction for settlement. As part of the settlement, StubHub is required to refund mandatory fees paid by affected consumers and must report back to the CMA over the following six months with updates on the refund process.

4. Euro Car Parks: Information Notice Fine and Parking Charges Investigation

The CMA's enforcement activity in relation to parking charges is notable in three key respects, in addition to its obvious popularity with motorists and as a part of wider CMA activity in cost-of-living-related areas.

• First, the CMA used its significant DMCCA fining powers for procedural breaches for the first time. In February 2026, the CMA fined Euro Car Parks ("ECP") £473,000 for repeatedly failing to respond to an information notice (which is subject to appeal by ECP). The CMA can issue a fixed penalty of up to 1% of the company's annual turnover for this type of breach. The fine in this instance represented 75% of the maximum possible fixed charge, showing that the CMA intends to impose fines towards the upper end of what is possible.
• Second, in July 2026, the CMA went further, opening a substantive investigation into whether ECP's practices, including charging drivers while they queue for, or use, petrol pumps and forecourt facilities, as well as its customer appeals process, breach consumer protection law. As Emma Cochrane put it: "Parking companies must treat motorists fairly at all stages–and a clear and consistent appeals process must be at the heart of this."
• Third, and more broadly, the private parking intervention illustrates the CMA's evolving approach to consumer enforcement – one that extends well beyond individual cases. Alongside the ECP investigation, the CMA announced a package of sector-wide measures. It wrote open letters to private parking operators highlighting concerns about unfair appeals processes and additional recovery charges, and engaged with trade associations to outline practical steps firms can take now to improve their handling of disputes with motorists. The CMA also issued recommendations to government on the new private parking Code of Practice. These interventions underscore a broader strategic point: the CMA is increasingly willing to deploy a mix of enforcement action, industry engagement, and regulatory advocacy to drive sector-wide change focusing on its consumer law mandate.

Key Themes and Emerging Trends

• Focus areas and pipeline: The CMA has focused on drip pricing, fake reviews, and online choice architecture (e.g., countdown timers, default opt-ins). It "deliberately cast a wide net" across these areas and compliance is now expected. The work on car parks shows the CMA is concerned more broadly about "unfair practices," and its pipeline is likely to reflect this - including unfair cancellation fees. The CMA's July 2026 publication of updated unfair contract terms guidance may also signal increased attention in this area. Most recently, in July 2026, the CMA opened an investigation into a major American technology provider over whether customers could have been misled about subscription options and pricing for services – a clear signal that consumer compliance is expected from all consumer-facing businesses, not just smaller or domestic operators.
• Redress is central: The CMA has shown that it will routinely seek direct consumer redress (or enhanced consumer measures) by infringing businesses. For instance, the first three cases included substantial refund orders from infringing companies to affected customers. Where conduct has continued since the new powers came into force, redress is more likely. The CMA has also imposed significant fines to deter future infringements, so this is very much a two-pronged approach, and substantial fines should also be expected.
• Penalties and corporate liability: Fines can reach 10% of global turnover and are not limited to the consumer-facing entities. Parent companies may be held liable for subsidiary conduct. Penalties for non-compliance with CMA directions or undertakings demonstrate that the CMA will not tolerate disregard of its processes.
• Settlement discounts: The cases which have got to a decision already have all settled with a 40% penalty reduction. The unreduced fines are significant (£7 million for AA). Businesses must weigh the pros and cons of early admission carefully.

What Businesses Should Be Doing Now

The risk of fines and reputational damage is real. With more enforcement expected, businesses should act now:

• Audit the consumer journey: Identify hidden charges, default opt-ins, and potentially manipulative design features (e.g., countdown timers, pre-selected options etc.). Fix pricing transparency issues before the CMA finds them. In short, the lodestar is consumer fairness.
• Quantify your risk exposure: Map compliance risks across all sales channels and your corporate structure. While the CMA's fines are not legally tied to relevant revenues, it has demonstrated that it will consider actual consumer harm in its assessment of the proportionality of any fine. Therefore, businesses should assess risks, prioritizing their largest consumer-facing business areas. Nonetheless, the magnitude of potential exposure should be assessed by reference to group turnover (for financial sponsors by reference to all entities under common control of the sponsor).
• Monitor CMA signals: Review guidance and open letters to your sector–even older materials remain relevant. The CMA often signals enforcement priorities before acting, and competitor complaints can trigger investigations. For instance, the CMA's signals to date on drip pricing, fake reviews and online choice architecture, where it will consider businesses fairly warned. If there are signs of CMA interest, preserve relevant data and prepare for information requests covering pricing decisions, sales journeys, and complaint handling. Care should be taken in internal documentation to ensure business decisions are accurately described, mindful of loose drafting that could be misinterpreted.
• Note the new unfair terms guidance: In July 2026, the CMA published updated guidance on unfair consumer terms along with a new technical note. According to the CMA, these resources are designed to make it easier for businesses to understand unfair contract terms law and help them to comply. The guidance also reflects other relevant developments, including the CMA's direct consumer enforcement powers under the DMCCA. The timing of this publication, issued alongside the CMA's early enforcement activity, may indicate that unfair contract terms will be a focus of future enforcement action.
• Prepare for upcoming rules: New subscription contract rules are due to arrive in Spring 2027; review renewal and cancellation processes now. AI guidance confirms businesses will be held responsible for AI agents in consumer-facing contexts.
• Embed a compliance culture: The CMA treats prior regulatory findings (e.g., ASA decisions) as aggravating factors. Senior leadership must own this agenda. They should also have a strategy ready for how to respond if an investigation is opened. The first cases show significant penalty discounts are available for early admission and settlement, but this requires accepting liability.

Conclusion

Consumer enforcement under the DMCCA is not a theoretical threat, but a major legal risk, given significant penalties and redress powers, both for consumer-facing businesses and those who control them. With liability extending to parent companies and fines calculated on global turnover, groups with UK consumer operations need to take notice at all levels. As the CMA has said: "We're just getting started."