Digital Fairness Fitness Check

Automated interactions (chatbots)

ECCs often receive cases where it is almost impossible to contact a manager on site or an online trader, as no direct contact means are provided on their website. To reach them consumers have to fill out an online form or to use a chatbot or other automated system. In addition, some traders do not respond unless the case reaches another more formal and official state. 

Artificial intelligence 

Communicating with customers through live chat interfaces has become an increasingly popular means to provide real-time customer service in many e-commerce settings. Today, human chat service agents are frequently replaced by conversational software agents or chatbots, which are systems designed to communicate with human users by means of natural language often based on artificial intelligence (AI). Though cost- and time-saving opportunities triggered a widespread implementation of AIbased chatbots, they still frequently fail to meet customer expectations, potentially resulting in users being less inclined to comply with requests made by the chatbot and complaining about poor customer service preventing the application of their consumer rights. Consumers also regret that chatbots or automated systems are the only way to get in touch with some traders, any other contact detail being well hidden or inexistent.

Challenges for consumers?

• Chatbots might give irrelevant responses to the queries. 
• Inability to understand the query and lack of precise response.
• Privacy concerns, and consequently, information disclosure, attitudes, and recommendation adherence.
• Users mostly do not know how their sensitive personal identifying information (PII) is treated, used, stored, or even shared.
• Traders should invest in building bots with an option to connect with human customer service agent, give relevant responses and concrete help. There must be a seamless transition between the chatbot interface and connection with the customer service agent.
• Traders should let customers know that they are interacting with a robot to improve the experience.
• Conversational biases—there can be chatbots (social bots) created to manipulate people’s opinions, for example, during selling, in forums, on social platforms, during political elections, and so forth. Such malicious chatbots can create huge damage.

Directive 2000/31/EC

Directive 2000/31/EC of the European Parliament and of the Council on electronic commerce in Article 5 indicates as mandatory information the details of the service provider, including his electronic mail address, which allow him to be contacted rapidly and communicated with in a direct and effective manner. The CJEU1 has confirmed that these are key requirements also under the Consumer Rights Directive. These provisions should remain applicable in all circumstances even if chatbots will be allowed. Furthermore, some countries have already put responses in place, guaranteeing that the consumer’s complaint is handled. However, we should aim at harmonising legislation across the EU, to ensure that all European consumers have the right to be heard.

Subscription traps 

ECC-Net encounters regularly cases in which consumers indicate that they have been trapped into subscriptions with no information on the main characteristics but also no possibility to terminate the contract. Often consumers only realise that they are dealing with automatic or tacit renewal contracts when the second payment is deducted from their bank accounts which sometimes is even higher than the initial first payment so locking them in contracts they no longer want/need.

Directive 2011/83/EU

Directive 2011/83/EU on consumer rights foresees in Article 5&6 the following Information requirements for contracts. Before the consumer is bound by a contract, or any corresponding offer, the trader shall provide the consumer with the following information in a clear and
comprehensible manner, (if that information is not already apparent from the context for contracts other than distance or off-premises contracts). 

• The duration of the contract, where applicable, or, if the contract is of indeterminate duration or is to be extended automatically, the conditions for terminating the contract.

Council directive 93/13/EEC

Council directive 93/13/EEC on unfair terms in consumer contracts foresees in its annex the following terms which may be regarded as unfair:

• Terms which have the object or effect of automatically extending a contract of fixed duration where the consumer does not indicate otherwise, when the deadline fixed for the consumer to express this desire not to extend the contract is unreasonably early.

Only some EU Member states provide for specific legislation when it comes to automatic renewal of contracts. But is this protection sufficient? What would be missing for an EU action to bring a real added value to consumers?

Specific regime for automatic renewable contracts

This specific regime exists in Austria, Belgium, Bulgaria, Denmark, France, Germany, Italy, Netherlands, Romania and Sweden. In Belgium in case of fixed-term service contracts with a tacit renewal clause, certain requirements are laid down with regard to the form and content of a tacit renewal clause:

• Appear in bold in a box separate from the text, on the front of the first page of the contract.
• Mention the consequences of the tacit renewal as well as the final date on which the consumer can oppose the tacit renewal and the methods of notification of this opposition.
• Indicate that after the first tacit renewal of the contract, the consumer may terminate this contract, without compensation, subject to compliance with a notice period of two months at most.

This provision also applies to sales contracts which relate to both goods and services. We are
thinking here, for example, of goods sold and installed by the same company, such as fitted kitchens, tiling etc.

Fixed-term contracts

Fixed-term contracts for the delivery of goods, such as subscriptions to magazines, book clubs, are not affected by this provision. The possibility has however been provided for of extending the royal decree deliberated in the Council of Ministers to certain categories of goods.

• In Denmark a consumer is allowed to terminate a subscription after 5 month to be eliminated after 6 months. Some modifications to this rules apply e.g. for very expensive contracts such as car leasing (12 month) or if specific rules apply to a certain sector as for instance insurance contracts.
• In Germany new rules apply to contracts for the regular supply of goods and services (e.g. streaming services, magazine subscriptions, gyms, electricity, gas) that are newly concluded from 01.03.2022. From this date on, contracts may generally only run for one year. Longer contract terms of up to two years are now only permitted if the customer also receives an offer for a one-year contract at the same time, which may be a maximum of 25 percent more expensive on a monthly average. After this so called “initial contract period”,contracts may only be automatically extended if they no longer specify a fixed contract period, but run for an indefinite period and can be terminated at any point in time with a notice period of one month.

Context

Previously, this period was three months to the end of the contract. Consumers can now terminate future contracts with a maximum notice period of one month before the end of the initial contract term. Not covered: e.g. insurance contracts.

Conclusion of contract

From 1 July 2022, traders are also obliged obligations concluded on the internet. This button must be easily accessible and clearly visible on the website. If the trader fails to provide such a button, the consumer may terminate the contract at any time.

A few other countries only foresee rules for specific type of contracts such as energy provision, insurances or communications service agreements (Czech Republic, Finland, France, Portugal).

In general, the consumer needs to be made specifically aware of the fact that the contract will renew before the conclusion of the contract but whereas many countries allow this to happen in the general terms and conditions, some countries impose that the trader also makes the consumer aware of this fact prior to the renewal:

• Concerning the information in the T&C, only Belgium foresees that the automatic renewal clause must be mentioned in bold characters in a frame apart from the text and on the first page of the contract.
• In Italy it is enough to include such information in the T&C but the clause has to be signed twice otherwise the consumer can cancel the contract at any moment, also in France every contract needs to be validated twice (double click rule).
• In Portugal contractual provisions written in a font size inferior to 11 or 2,5 mm, with spacing inferior to 1,15 are forbidden (DL. n.O 32/2021). 
• Supplementary information requirements prior to the renewal exist only in Austria, Czech Republic, France and Sweden.

Note: Telephone, mobile phone and internet contracts may also no longer be automatically renewed and must have a one-month notice period. For these contracts, the mentiondes changes have already applied since 01 December 2021 and also for old contracts concluded before 01 March 2022 (so retroactively!). 

Automatic renewals based on a contract concluded before 1 March 2022 are subject to the former regulation, i.e. the contract is automatically extended by up to one year. The notice period of three months also continues to apply to these types of contracts. 

How this information has to be provided? Of course, it has to be given in writing.

• The Czech Republic foresees that this information has to be provided in the way in which the invoice has been issued.
• In France and Austria, the trader must inform the consumer in writing, by means of a specific letter or e-mail so it must be separated from other information addressed to the consumer.

Timing of the information on the renewal

• Austria: The information needs to be provided an adequate period of time before the renewal (e.g. two weeks).
• Czech Republic: max. 3 months and min. 1 month before a relevant contract expires.
• France: no earlier than three months and no later than one month before the end of the period allowing for the rejection of renewal.
• Portugal: the professional has to inform the consumer up to the celebration of the contract about the validity period of the contract or, if the contract has an undetermined period or an automatic renewal, about the conditions for the termination or the non-renewal of the contract, the consequences of it and any compensation for the early cancellation of the contract with minimal contractual period.
• Romania: 30 days before the renewal.
• Sweden: The reminder must be in writing and submitted no later than one month prior to the time the contract must terminated.
• Portugal: Art. 218 civil code normally states that silence is deemed as an agreement when law, custom or contract foresee it.

DL 446/85 art. 22 (cláusulas proibidas) however restricts this possibility as contractual provisions that allow an automatic renewal based on the silence of the other part are forbidden, when the date to express their intention is far from the termination of the contract period.

There is no legal definition of what is considered as “far from the termination period”, but case law for example may decide that the trader’s notification of the cancellation /non-renewal of the contract 90 days previous to the deadline of the contract would be considered as an excessive period of time or as being far from the termination period of the contract.

Content of the information

• In Austria, the reminder needs to include the date of renewal, the renewal period and the period of time for terminating the contract.
• In France the dedicated letter or e-mail needs to include information on the possibility of not renewing the contract in clear and comprehensible terms and shall mention, in a visible box, the deadline for non-renewal.

What happens if the trader does not remind the consumer? 

• In Sweden the reminder must mention the date of renewal, price and the means to stop the subscription. What happens if the trader does not remind the consumer?
• In Austria the contract is not renewed in the first place, so new contract was concluded. The consumer should point out to the trader that the contract renewal was not correct and that therefore there is no contract. 
• In France, the consumer may terminate the contract free of charge at any time from the renewal date. Advances made after the last renewal date or, in the case of open-ended contracts, after the date of conversion of the initial fixed-term contract, shall in this case be reimbursed within thirty days of the date of termination, after deduction of the sums corresponding, up to that date, to the performance of the contract.
• In Sweden, if the trader does not remind the consumer, the consumer has the right to terminate the agreement with immediate effect. Has the initial contract period not yet expired, the consumer has the right to terminate the agreement when the contract expires.

Necessity to conclude a new contract is foreseen in Bulgaria and Finland

• In Bulgaria a fixed-term contract may be extended solely with the express written consent of the consumer concerning the conditions for extension. Where no consent has been given, after the expiry of the duration of any such contract it shall be transformed into an openended contract under the same conditions. The consumer shall have a right to withdraw from the open-ended contract on one month’s notice without penalty.
• In Finland an ongoing contract is valid until it is terminated. It ends after the period of notice specified in the contract. Typical ongoing contracts include electricity supply, waste management and district heating contracts and magazine subscriptions.

A fixed-term contract expires at a specified date, for example after 12 months. A fixed-term contract cannot normally be terminated. 

Renewing fixed-term contracts automatically is prohibited; this means that when the expiry date has been reached, the contract may not be automatically renewed as another fixed-term contract. However, a fixed-term contract may be turned into an ongoing one after a certain date if the ongoing contract can then be terminated with a normal period of notice. If a company offers this contract model to a consumer, the consumer must be clearly told in advance that the contract will automatically continue until further notice when the fixed-term contract period expires.

Typical fixed-term contracts include gym memberships and pay-TV, broadband and telephone subscriptions. For example a telecommunications operator shall not extend a time-limited agreement by another time-limited agreement without concluding a new agreement in writing with the subscriber.

Special focus

• Short term contract less than 3 months (including short trial periods)
  Often consumers inform the ECCs that they have been trapped in a renewed contract but of which the duration is longer than the first period they subscribed to which often has an effectct on the price of the service. Under French law, a fixed-term contract may be renewed by law or by agreement of the parties but the renewal gives rise to a new contract with the same content as the previous one but of indefinite duration. Which would mean that as soon as duration or price change, the consumer is not in a renewed contract after the trial, but in a new agreement, which needs to be validated according to the “double clic” rule and should offer the consumer a cooling off right, where applicable.
• Free trial periods
  As generally these contracts are designed to renew automatically, consumers are asked to provide their bank details right from the start. In ECC-Nets opinion, consumers should be requested to provide those with a dedicated information about the renewal of their contract only. There should also be specific chargeback possibilities in all EU Member states, in case the trader has not respected this rule.

Dark patterns

We all have had this feeling of having been trapped into accepting something we didn’t want, in buying something we didn’t intend to buy or usually wouldn’t have bought, in keeping a subscription we wanted to cancel, but how did we get there? Is this on purpose? is there a specific technique begin this? The answer is Yes, and they undermine your autonomy as consumer. 

Many webshops, marketplaces, apps, social media but also search engines and even newsletters use very specific deceptive design elements or features, called dark patterns to influence consumer behaviour online. Based on behavioural psychology, they will nudge, persuade or trick individuals so that consumers play along exactly as intended by the seller.

Colours, button sizes and wording are the first elements to look out for on a website. Their aim is to get consumers into buying something they didn’t necessarily want, as fast as possible. But this isn’t all.

ECCs have taken a step back and looked carefully, and could observe a certain number of techniques, which relate either to triggering consumers into purchasing something or into keeping them in a specific relationship with a trader.

Tricked into (impulse) purchases 

• Hidden costs
  Consumers are only confronted with at every step of the transaction or at the very end of the order. This is done because usually consumers do not want to start over again, they may just accept service fees, additional options or insurances, cleaning fees etc. But only if all additional costs are displayed from the start consumers can compare if the purchase is still interesting or search for other offers. This technique is often coupled with an impossibility to compare prices as every seller adds fees at a different time and the content is never exactly the same. For example luggage options for airline tickets. It is often very difficult for consumers to check if the offer really corresponds to their needs. When ordering there are already items in the virtual basket that either the consumer needs to remove or he/she will be able to get for free if a certain total amount is reached. Often the website reminds the customer with phrases such as ‘only 5.99 €’ left to benefit from this free gift otherwise charged € 25.99.
• Situation of urgency
  Well displayed messages create a situation of urgency, of the consumer missing out on a good deal. ‘Only 3 hotel rooms of this category available at this price on our portal’, ‘free cancellation, nothing to be paid now’, ‘47 other people are watching this article’, ‘limited time offer’, ‘limited supply in Berlin on your travel dates: 12 3-star hotels like this are no longer available on our site’ or ‘prices could rise, so confirm your booking today’. Some sellers may just artificially reduce the number of items by creating specific categories. Also traders including flight booking intermediaries try to pressure consumers during the booking process by regularly informing them that the price can change quickly.
• False scarcity
  ‘Only three items left in stock’? Often false scarcity tricks consumers into placing something in their basket just not to miss out on it. Not only do consumers associate scarcity with high value goods, as soon as they have added the item to the basket, they might already have subconsciously committed to buying it. Maybe the website will even send e-mails the next days asking consumers what is holding them back from purchasing this item or using the service which ‘honestly comes at a really interesting price’. But does it? While looking for something specific the website shows the consumer other options that might interest him/her and deals that he/she is missing out on. The consumer receives deals and discounts allowing to buy more for the same amount of money but he/she always ends up spending more as of course not everything he/she chose is on sale?
• Reviews
  Consumers are looking at all the comments and reviews posted by influencers or other users telling them how good this product is. Social proof via testimonials is also one of the dark patterns used to get them into buying specific items.
• Cancellation of purchase
  A consumer decides not to go for a product or service and wants to cancel the purchase? A well displayed message such as as ‘no thanks, I hate saving money’ or ‘no thanks, I hate receiving good deals, I prefer to pay full price’ will try to shame them into compliance.
• Insurance
  Some booking intermediaries, if the consumer doesn’t add the proposed insurance (travel, baggage insurance, etc.), will ask if he/she really wants to travel without insurance, as this can be a higher risk.
• Click bait
  Some consumers think they have seen an important news but once they click on it, it turns out to be an add for a product.

Tricked into a subscription

• Free trial
  The first thing you see is a free trial (for goods or services) but you have to give your credit card details? Look carefully, somewhere hidden you are most certainly entering a subscription with a monthly or annual fee if you do not cancel the subscription in time. And the trader might just forget to inform you that the free trial period is running out. Always carefully read all the tick boxes and options. It takes a little time but might prevent bad surprises.
• “Vip” or “Prime” subscriptions
  The price applying to the “VIP” or “Prime” subscription is more visible (bold) than the initial price, Consumers do not always notice that they subscribed in the end to a “VIP” or “prime” option to have access to this better tariff.
• Cooling-off period
  Keep in mind that you might have a cooling off right. If French law is applicable, be aware that there are also rules governing automatic renewal of contracts.
• Regular deliveries of the same
  The website leads you into believing that with regular deliveries of the same (type of) product you will save money (and never run out). Don’t get pushed in a subscription and overconsumption. You may be entitled to a cooling off right. If so, and as the contract provides for the regular delivery of goods during a defined period, the cooling off period starts the day after the first goods are received.
• Terms and conditions
  For some offers proposed via social media, no reference is made to any terms and conditions. They are only visible on the website of the trader. When trying to cancel, a new order, less pricy with little less content is always offered to stay in the subscription. 

Impossible to cancel an online subscription

Sometimes consumers actually remember to cancel a subscription but whereas it took only a couple of clicks to subscribe, it takes them in circles on the website and they still can’t figure out how to get out of this contract. They have really looked everywhere but there is no possibility to cancel the subscription on the app they downloaded, they need to connect on the PC version of their customer account. This is burdensome and shouldn’t be like this. Enforcement authorities should look into this pattern.

Automatic renewal of contract? Please see the specific ECC-Net input on this topic on this page under subscription traps.

Consumers receive software update notifications indicated as ‘vital, ‘crucial’ or ‘necessary’ but they can not cancel this option or opt out of it. Even though the trader must make sure that customers are fully informed about the consequences of accepting the change, see also a recent action of the CPC network and European Commission concerning a major messaging service.

Confused by unclear questions or wording

Only when looking carefully consumers see that negatives or positives are in a wrong place. Double negatives actually got them into something they didn’t want to do. 

Consumers are not really presented with a choice but a double question, the second just formulated differently than the first one tricking them into saying actually yes not no, or opting in instead of out.

Currencies and personal data in video games: many games use in-game currencies and since the currency does not contain explicit information about how much it corresponds to in a real currency, it is easy for consumers to spend more than you first thought. See ECC-Net input on In app purchases & in-game purchases: the billion-dollar business with additional content as well.

Tricked into revealing more of your privacy then consumers intended

Consumers have seen these messages telling them that tracking will help them to get an improved service. But the trader doesn’t actually tell them what they are using your data for? The social media consumers want to subscribe to have a preselection of privacy settings which encourage to make personal data and posts available to all, or a larger audience than initially intended. Only manually, can consumers restrict the reach.

Not to allow access to personal contacts or location consumers need to go through multiple steps to opt out from this preselection. Sometimes revealing personal data can allow to secure a discount. 

ECCs have seen cookie banners popping up everywhere. Consumers do not know that they do not have to accept cookies. Also dark patterns are used for example only announcing ’I accept’ or ‘I want to learn more’ buttons not showing an easily recognisable refusal option. Sometimes consumers also have to manually deactivate every single non-essentiel cookie.

The French data protection authority CNIL has published guidelines applicable to all French users saying that users need to have a clear choice between ‘accept’ and ‘reject’, if there is a possibility to accept all, there must be a possibility to reject all as well.

Dark patterns are used to getting consumers into spending money but this is what this is really about: consumers spending more time on these websites, apps etc, and giving out as much data as possible about themselves. Data has a real value for many businesses and the more data consumers reveal the more connections the seller can make and target them with advertising. Digital marketing has come to a point where even sales interfaces are different according to the users, their patterns and behaviours.

Is there a legislative response in the EU to dark patterns?

Today, there is no specific definition nor legislation for dark patterns within the EU. Dark patterns, concern many policy areas from competition, to consumer law and data protection but also artificial intelligence etc. The directive on consumer rights prohibits preticked boxes.

Some techniques may fall under the UCPD, for example describing goods or services for free if you have to pay form them or attracting consumers with especially attractive items and prices which are actually not available, but to go more into specific dark patterns, the directive would need a revision or an update to be more consistent with digital practices. The European Commission has added this as an action point into the new consumer agenda.

More recently dark patterns have specifically been mentioned in the European Commission’s 2020-2025 action programme the Commission making the fight against these techniques one of its priorities.

Also the Digital Services Act (DSA), together with the Digital Markets Act (DMA) provide for reforms aiming at restricting the collection of personal data and the use of behavioural advertising techniques and dark patterns by online platforms and intermediary services.

Dark patterns are also discussed with regard to the new ePrivacy Regulation which should tackle the use of cookies, direct marketing etc.

• In the meantime, first enforcement actions can be seen based on data protection legislation, the GDPR, when dark patterns circumvent privacy principles. See for example the French authority CNIL who has fined a major tech companies, social media and search engines, for making it more difficult to refuse than to accept cookies.
• Other enforcement authorities have also looked into these techniques. The Netherlands Authority for Consumers & Markets (ACM) has published guidelines consumers online against deception.
• The UK Competition and Markets Authority CMA has published a market study recommending that “the government passes legislation to establish a new pro-competition regulatory regime”.
• The French General Directorate for Competition Policy, Consumer Affairs and Fraud Control (DGCCRF) is working together with the manipulent (europe-consommateurs.eu), an Inter ministerial guidelines Directorate for designers and developers on how to protect Public Transformation (DITP) to better protect consumer against online fraud by including behavioural sciences.
• Also more and more information for consumers is out there such as the Irish regulator of advertising listing some rules that Irish consumers need to be aware of.
• The Swedish Halla Konsument has worked on a project about information to consumers about dark patterns during 2021-2022. The project resulted in an informative article on the website as well as information in their and their CPC’s social media channels.
• ECC France has launched a campaign in June 2022 excisting of an article, a press release and social media campaign.

In-app purchases & in-game purchases

Big game titles from American and European developers are no longer only available for consoles or PCs, but mostly for mobile devices such as the smartphone or tablet.

Big game titles from American and European developers are no longer only available for consoles or PCs, but mostly for mobile devices such as the smartphone or tablet.

Free games

Free games, better known as Free-to-Play (Free2Play, or F2P for short), are particularly popular and successful with children and young people.

However, free games are often designed in such a way that a consumer has to invest a lot of time in order to progress or it is difficult to progress without spending money. This happens mainly through in- game and in-app purchases or advertising.

So the supposedly free games offer numerous additional contents for which a fee is charged,
including extra lives, skins (outfits) or loot boxes (treasure chests) that can be earned or unlocked
for real money. Loot boxes are virtual objects, generally presented in the form of a chest, which
offer the player improvements in the game. Also, in Pay-to-Win-Models advantages over other players can be bought in the form of items.

Especially when children and youngsters have unsupervised access to a smartphone or tablet, in-app purchases can become costly, especially when a payment method has been saved to the smartphone and the app has access to it.

It should be noted that usually there is no cooling-off right, once the app or game has been downloaded and the consumer has access to its content. In some cases, as commercial gesture, a trader may allow a consumer to test a game for a couple of hours.

So often the only recourse for parents is to check if their child could conclude a legally binding contract. But this differs highly depending on the national rules applicable to the contract.

• In Austria, any purchase made by a child under the age of 7 is not valid. From the age of 7 to 18, any purchase for which the price is higher than the money they have available can be contested by their parents if they have not given their consent.
• In Finland, minors can only make ordinary, small purchases without the guardian’s consent. This also applies to purchases made on the Internet, for example using a mobile phone or a gaming console. Children may not be enticed to make purchases on websites intended for children, or in games that interest them. Operators, creditors and companies offering games and other services share the responsibility for resolving problem situations. Purchases that a child cannot make independently and to which the guardian has not given their consent are not binding and may not be charged for. The binding nature of the purchases depends on whether the purchases a child has made can be regarded as ordinary and small, considering the child’s age. If many small purchases add up to a whole, which is typical for purchases made in a game, their total value should be examined. When the parent buys a mobile game, their credit card information is usually stored on the device and may be accessible to their child for purchases made as part of the game. Under the contract concluded with the provider, the parent is responsible for the costs of using the mobile device or credit card. The parent may not receive full compensation if their carelessness was partly to blame.
• In France, a minor’s purchase is valid if it is considered an act of daily life. The principle is that any purchase by a minor under the age of 16 must be authorised by a parent. However, if the purchase is reasonable in relation to the minor’s financial situation, in line with his or her daily habits or usual for children of his or her age, it can be considered an “act of everyday life” and cannot be contested by the parents.
• In Germany, children under the age of 7 are not free to make purchases. Beyond that, they can only spend their money on purchases for which they have obtained parental consent. One exception to this is the so-called pocket money paragraph. Children and adolescents may freely use their pocket money as long as their legal guardians agree with the purpose. This means that no prior permission is required to buy toys or sweets. If minors repeatedly make in-app purchases, case law assumes that the parents have at least tolerated this expenditure. In this case, it becomes difficult to dispute the bill. The same applies if the child or young person were given the password for an in-app purchase.
• In Ireland, minors can legally make “basic necessity” purchases (clothing, food, etc.). For other purchases, it is on a case-by-case basis, their validity will depend on their benefits for the child.

Questionable purchases by minors

• Purchase of virtual currency or online sports betting by a child.
• Purchase of an accessory for his character made by a 3 year old child on his parents’phone.

Purchases by minors that can be considered as an act of daily life

• Purchase by a teenager of a dance for their character in an online game.
• Purchase by a teenager of music on an online platform (e.g. Apple Music, YouTube Music....).

Special focus: Lootboxes

Loot boxes are virtual boxes within a game that can contain different items. Depending on the game mechanics, players can unlock the boxes for achieving certain goals, find them or buy them for real money.

The problem is that players usually do not know what to expect when buying them, as the items are randomly generated. The game value and usefulness of the included lootbox content can vary greatly. 

Loot boxes can contain weapons, clothing or special items to customise the appearance of the virtual character. 

• The use of loot boxes is criticised as they contain incentives to buy and gambling-like features. Although the purchase of loot boxes is voluntary, incentives are always created within the game mechanics so that users decide to buy them. This would also be associated with a certain addiction potential. In the meantime, more and more scientific studies are strengthening this hypothesis. But only in Belgium and the Netherlands, paid loot boxes are considered illegal gambling so far.
• In Germany the Federal Government launched a new Youth Protection Act at the beginning of May 2021 which foresees that games that contain incentives to buy and gamblinglike elements are to be labelled accordingly. Furthermore, the addition of loot boxes inside a game might also affect the age classification of that game.
• At European level, the European Parliament published a study in July 2020 on the subject of loot boxes and called for the creation of a European legal framework that is distinct from classic gambling and that protects minors.

Special focus: perma banning of players

Many gamers are attached to their game account. This is because all progress and achievements are usually linked to the respective account and virtual hero.It is all the more annoying when these are lost due to a perma ban (permanent account blocking).

Often, not only a lot of time is invested in unlocking achievements, but possibly also a lot of real money. But when is a provider allowed to block an account? And what can a consumer do against a perma ban? Usually the T&Cs will allow a trader to block player accounts:

• Serious violations (e.g. insulting other players, for example in chat messages or voice chat; Use of prohibited or offensive images and symbols; Use of bots, cheats or similar software, for example, aimbots or wallhacks) against the terms of use can lead to a perma ban.
• Minor violations may result in a warning or temporary ban.

Some providers reserve the right to block an account at any time and for no particular reason. Especially in the case of titles that can generally be played free of charge (“Free-to-play”, “Free2Play” or F2P for short), such a provision may be permissible in individual cases.

Influencers' obligations and responsibilities

Influencers have become an indispensable part of modernmarketing in Europe. Companies have recognised the potential of influencers and use them for their advertising campaigns. Very present on social networks, influencers who test, praise and promote products of all kinds have one mission: to encourage you to buy them. And it works! From lipsticks to tooth whiteners, from slimming products to branded clothing from all over the world, many consumers click on the link of the featured brand to buy the featured product. If influencers are mostly paid or receive gifts for this activity (free hotel stay, clothes, beauty products...), they do not always inform consumers who then think that it is a personal, spontaneous opinion without clearly identifying the commercial promotion of the product. Is this practice legal? What are the obligations of an influencer towards consumers in Europe? Are the rules of influencer marketing the same all over Europe or would EU intervention be suitable to hold influencers liable?

What are the obligations of influencers in Europe?

The Unfair Commercial Practices Directive may apply to influencer marketing3 in their position
as traders and may provide for some protection for consumers but not all complaints received by the ECC-Net can be handled based on UCPD only, especially as no direct remedies are provided for for consumers. For example, UCPD considers that advertising which does not clearly indicate its commercial nature constitutes a misleading commercial practice and is therefore prohibited but does not provide for direct remedies if a consumer entered a contract based on the influencer’s message.

The E-Commerce Directive 2000/31/EC (art.6) as well as the Audio-visual Media Services Directive (EU) 2018/1808 require all influencers in Europe to disclose their commercial partnership as well as the company for which this communication is made. This information and transparency obligation is applicable in every EU Member State. So, an influencer needs to state clearly and comprehensibly that his post/content is an advertisement.

In December 2020, the European Commission proposed two pieces of legislation to overhaul digital business practices in the EU and increase accountability and fairness online: the Digital
Markets Act and the Digital Services Act. Under the Digital Services Act, influencers, as content creators, will have to accept greater responsibility for the content they publish online. While online social media platforms must be clearer and more transparent about how their content algorithms work, and are obliged to monitor posts and remove them if necessary or even suspend accounts, influencers will also have to ensure that their content is appropriate and not misleading or illegal.

Pending European harmonisation, the rules therefore vary from one country to another. Here is an overview by country: 

• The Austrian Media Act and the Code of Ethics of the Austrian Advertising Council require the influencer to state clearly and comprehensibly that it is an advertisement.
• In Belgium the trader who pays influencers to promote products on social media need to ensure that they clearly mention that this is an advertisement. Also Flemish media service providers need to make commercial communications recognisable as such. According to the Flemis Minister for Media, influencers who earn income from commercial communication should be considered as media service providers. 
• There is no specific legislation for influencers in Bulgaria. They have to comply with all the rules on advertising, unfair and deceptive marketing practices.
• In Cyprus, there is no legal basis for influencers. But brands are advised to be careful in their selection of influencers to promote their product or service.
• In France, according to art. 20 of law n°2004-575 of 21/06/2004 for confidence in the digital economy and the transposition of directive 2005/29/EC on unfair commercial practices, influencers must specify that their communication results from a partnership with a brand or a professional and that they are paid to promote the products they present. This can be done verbally, in a text or via the integrated features of social networks (links). If the influencer mentions the partnership orally, in a video for example, he/she must specify it again in his/her description in the first three hashtags associated with the post, this can be done via hashtags for example #sponsored; #partnership. Influencers in France must not undermine human dignity: they must not offend the sensibilities of their audience, they must not devalue another person based on physical, radical or religious criteria, they must not trivialise violence, etc. If the content being promoted is aimed at children or adolescents under the age of majority, they should be informed that parental permission will be required. Influencers should also not engage in unfair competition, i.e., disparaging the products or services of a competing brand or another influencer.
• In Finland the commercial cooperation between companies and influencers should be communicated to consumers in targeted influencer marketing in accordance with the Consumer Protection Act and influencers are required to clearly inform the consumer of the commercial nature of their marketing. In 2019, the Finnish Consumer Ombudsman issued a guideline for influencer marketing in social media.
• In Germany influencers who sell goods, offer services or market their own image using social media such as Instagram are running a business. Promotional posts should be clearly identified. Any reference to a brand or product is considered an advertisement if there has been an agreement between the brand/vendor and the influencer and the influencer receives compensation (remuneration or benefit in kind). The advertisement must then mention the term “Werbung” or “Anzeige” at the beginning of the post or video (+ in its description). However, courts have ruled that the labels “#sponsored by” or “#ad” are not sufficient. It is also not sufficient that the advertising nature of the post becomes only apparent upon closer inspection. Rather, it must be obvious to an average user at first glance that the post in question is advertising. However, the post must be excessively promotional by promoting the product uncritically and beyond factual information in order to be considered as advertising. The BGH (German High Court) has ruled, for example, that influencers are allowed to refer to companies on the internet using features built into social networks (such as “tags” in photos on Instagram, which redirect users to manufacturers’ or brands’profiles), without this being considered as advertising. If, on the other hand, the influencer links directly to the brand’s website or Instagram account, this would be advertising.
• In Ireland, Marketing of all types in Ireland is currently regulated by the Consumer Protection
  Act 2007, which prohibits “misleading, aggressive or unfair commercial practices” and now by the Consumer Bill 2022. The new Consumer Rights Bill, Part 9 provides that consumers harmed by unfair commercial practices will have access to effective remedies, including compensation for damage suffered by the consumer and, where relevant, a price reduction or the termination of the contract.
• In Italy, there is no specific legislation on influencer marketing, but influencers, bloggers,
  celebrities, etc. must indicate that their publication is promotional (Directive 2005/29/EC and Italian Consumer Code (transparency principle)). They must mention this at the beginning of the post, in the first hashtags, or in an associated message (#Pubblicità/ #Sponsorizzato da / “prodotto inviato da” (product sent by). The Italian advertising standardisation authority “Digital chart regulation” also stipulates that commercial communication must clearly show its promotional objective in the case of product reviews or endorsements, videos, invitations to events, advertising games, etc.
• The Lithuanian Law on Advertising stipulates that surreptitious advertising is prohibited. Advertising must be clearly identifiable. If consumers are not able to identify the advertisement broadcast in the media, this advertisement must be marked with the word ‘advertising’. If the influencer only receives a free item or service in exchange for being mentioned online, he/she should mention this and use the hashtag #gifted (or #dovana in Lithuanian). If monetary compensation has been received or a long-term partnership has been established, the influencer should indicate that it is an advertisement for a product with the hashtags #ad (or #reklama in Lithuanian).
• In Luxembourg, there is no specific legislation for influencers. They have to comply with all the legislation on advertising. ALIA (Autorité Luxembourgeoise Indépendante de l’Audiovisuel| ALIA) is responsible for monitoring the application of the rules relating to audio-visual services and the media and has the power to impose sanctions. 
• In Malta, there is no specific legislation governing influencer marketing. The rules are the same as those that apply to advertising and marketing, namely the Unfair Commercial Practices Regulation (transposition of the Unfair Commercial Practices Directive 2005/29/EC), incorporated in Part VIII of the Consumer Affairs Act.
• In the Netherlands, influencers are obliged to indicate the advertisement. All forms of advertising on social media are covered by the “Stichting Reclame” code. In addition, the Dutch Media Authority, which controls advertisements on traditional media, also regulates influencers on social networks on the basis of the Dutch Media Act (transposition of Directive 2018/1808).
• Influencers must inform the consumer whenever they receive a payment or a gift for promoting a good or service. Portuguese law considers any communication with a commercial relationship (with monetary or in-kind payment) to be advertising. The same applies when the publication promotes specific products or services through links or a promotional code.
• In Spain, it is an illegal practice to conceal a partnership. There is a Code of Conduct for influencers who advertise, which states that all content (graphic or audio-visual) generated by partners or adherents to the Code is considered advertising content subject to control by the Spanish authority “Autocontrol”, if it promotes products or services in the context of a commercial partnership (editorial control of the brand over the content) with compensation
  (payment or free delivery of a product, free entry to an event, gift vouchers, trips, etc.).  Also, the advertising nature of influencers’ comments or the digital content they disseminate must always be properly identified to their followers/potential consumers. If the nature of the advertising is not clear and obvious, they should supplement their posts with mentions such as “#advertising”, “#advertisement”, “#Brand ambassador”, “#Thank you to [brand]”, “Gift from [brand]”, “Sponsored travel”, etc. There is also an ex-post control mechanism which allows complaints about breaches of the code to be made to the Autocontrol advertising panel (which is an ombudsman body). 

How can influencers know about their obligations?

• The Austrian Advertising Council has created a website to enable influencers to check whether their message should be considered as an advertisement or not.
• The Belgian Advertising Council and FeWeb have published recommendations on online influencer marketing to help influencers comply with the legislation and better protect consumers. The Jury for Ethical Advertising Practices monitors compliance with these rules by giving preventive advice and taking non-binding decisions following complaints. But these guidelines only apply to influencers who receive compensation (monetary or in-kind) for their advertising and only if that advertising is controlled by a professional, a brand that gives clear instructions to the influencer on how to advertise its product. According to the guidelines, these influencers must mention the word “advertising” or “sponsorship” in their advertisements in a way that is understandable to the average consumer they are addressing. The use of a hashtag is one possible way to do this. It is also recommended that the logo or brand of the professional for whom the influencer is promoting is clearly mentioned, to make it clear that this is a commercial message. It is the influencer, not the marketer, who is responsible for following these recommendations. 
• The National Council for Self-Regulation (NCSR), a non-commercial association of public utility, has published ethical rules for advertising and commercial communications in Bulgaria which also apply to influencers or bloggers. The full set of rules is available in English.
• The Finnish Consumer Ombudsman has also published guidelines on how sponsored content should be mentioned in social media.
• The Hungarian Competition Authority issued guidance for influencers and also conducted official proceedings against some of them.
• In Ireland, a 2021 survey by the Advertising Standards Authority Ireland (the marketing regulator) found 51% of surveyed Irish consumers were concerned by the lack of transparency in influencer marketing. They have the following guidelines. 
• In 2019, the Consumer Rights Protection Authority in Lithuania (SCRPA) carried out a check on influencer marketing, it was found that only some of them clearly indicated that they had received some form of monetary payment, a product or service for free, a commission. Thus, in December 2019, guidelines on social media advertising were published. 
• The local Maltese authority is in the process of preparing guidelines to the influencer marketing industry on how and when to disclose commercial practices. The scope of these guidelines will be that of facilitating the industry’s compliance with the relevant rules.
• The Polish Office of Competition and Consumer Protection (UOKiK) penalised some well-known influencers in the past for misleading claims and blurring the lines between honest, unbiased reviews and blatant advertising. in cooperation with stakeholders from the marketing/advertising landscape (such as the Advertising Council and relevant trade associations) they are in the process of preparing a code of practice for influencers.
• The “Direção-Geral do Consumidor”, the Portuguese advertising authority, has published
  a guide for influencers in 2019, a best practice guide for digital marketing. The guide is now
  available in a bilingual version (PT and EN). 
• The Swedish Consumer Agency did a review of influencers obligations and responsibilities in social media in 2020-2021. Inadequate influencer marketing was the consistent impression after the review. The Swedish Consumer Agency has produced a guide to help those who blog or write in other social medias to do the right thing when it comes to marketing, and also how to follow the law. More information can be found in Swedish on their website. Also, OECD has published in 2019 a “Good Practice Guide on Online Advertising” 

Can influencers be liable for nondelivery or non-conforming purchases?

Influencers who present a partner brand’s products or services on social networks do not force consumers to buy them. They are not salespersons either, since by clicking on the link they share with consumers, the latter are usually redirected directly to the brand’s website or social network page, where they can buy the product or subscribe to the service.

This way, influencers cannot be held directly responsible if there is a problem with the order. If a consumer doesn’t receive an order or receives a faulty product, the consumer should contact the seller who is solely responsible for the order. 

The only exception would be influencers have created their own brand (e.g. of jewellery, clothes or make-up) and therefore their own company. 

The only recourse for consumers EU wide against an influencer who has promoted a defective product or a fraudulent site is to take legal action for unfair or misleading commercial practice on the basis of Directive 2005/29/EC, which has been transposed in each EU country.

Pitfalls of influencer marketing

Through their strong presence in social networks, influencers are valued and their opinions are considered important and trustworthy. In this way, they have a targeted influence on the opinions, purchasing decisions and interests of their subscribers and consumers. And it is precisely this direct access to specific groups of people that companies value in influencer marketing.

Know Your Customer (KYC)

KYC generally refers to an internal process for verifying the identity of a customer in order to avoid identity theft or payment fraud as far as possible. This term is particularly present in the banking sector but also telecommunication where verification includes the fight against money laundering and terrorism.

The aim of these checks is therefore to minimise the risk of fraud by trying to find out from the start of the registration or ordering process whether a consumer is a “good” customer. But not only that... 

What is the basis for this verification? 

The consumer’s personal data and purchasing behaviour! The more easily accessible the data is, the better for the online merchant. So what data is used? Very classic, it will first of all be 

• The consumer’s name
• Postal address
• E-mail address
• Telephone number
• IP address, or even the type of equipment
  used (PC, smartphone, operating system,
  etc.)

The name and place of residence are often enough to query in real time a so-called “scoring” service that evaluates the solvency of customers according to rating methods. Many merchants are indeed tempted to implement software on their sites that connect to such databases. If, for example, a consumer lived in Germany and bought from a German e-tailer, the Schufa will allow him to check the debt rating.

The professional will then check the bank or payment card details. The aim is to check whether it is:

• False credit card details
• Stolen credit card or bank account details
• stolen account information

In principle, an online merchant operating in France cannot request a copy of the payment card even if the visual cryptogram and part of the numbers are masked. This might not be the case in all EU countries.

When scoring, the data provided goes through a mathematical prediction process that determines a scoring value. This value then provides a current prognosis of the customer’s future payment behaviour. If the value is very good, the customer can be offered all payment methods from the first order onwards, e.g. also payment only after receiving an invoice. If, on the other hand, the customer has a poor value, he or she will only be offered the option of prepayment, for example. Regular customers are naturally offered riskier payment methods such as credit cards, SEPA direct debits, for example.

It is also possible that the e-tailer will ask the consumer for a copy of the identity card, or even a second document proving the consumer’s identity, in order to avoid the risk of usurpation. Particularly since the switch to biometric identity documents, many software packages are available to merchants to facilitate these checks. 

• In Bulgaria a law prohibits traders, except for some, from requesting a copy of an identity card. According to the Personal Data Protection Act, “An administrator or processor may copy an identity document, a driving license, or a document for residence only if provided by law.” At the moment, this is not provided for in the Consumer Protection Act or other consumer laws.
• In the Czech Republic, according to the AML Act, in case of anti-money-laundering measures, the seller is allowed to make copies of identity cards and passports even if a consent of the holder is not granted. The Czech law makes no difference between online and offline orders in that matter.
• In France, for a payment by card, the merchant can indeed ask for proof of identity but cannot demand it. The customer can refuse. The French data protection authority CNIL clearly states that if the collection of the cardholder’s identity is not necessary for the transaction, it should not be collected.
• In Germany there is no law prohibiting full copies of an identity card. However, the ID card holder must be informed that he or she may black out any information that is not relevant for the intended purpose. This includes the serial number, the personalised security thread, the access number and the machine- readable zone. However, it must be recognisable that the copy of the identity card is a copy. For example, the note “copy” on the printout is sufficient for this. But: Persons other than the ID card holder are not allowed to pass on the copy to third parties.
• There is also no specific law in Hungary prohibitting online sellers from asking a consumer for a full copy of an identity card, but since it is not necessary for the fulfilment of an online contract it might be considered a breach of data protection provisions.
• In Italy, there is no law prohibiting complete copies of the identity card, but it’s not allowed to pass the copy to third parties. 

Some professionals, including payment services, offer identity verification by selfie or video with verification of the consumer’s ID. 

Recently, consumer protection authorities in several countries have again taken an interest in this issue in the context of the practices of the Vinted platform, which are being monitored by European data protection authorities. They are focusing in particular on the operation of the website, which requires the sending of a scanned copy of the identity card in order to release the amount of transactions made on a user’s account. Checks will also be carried out on the legal basis associated with this scheme, the procedure and criteria for blocking an account and the data retention periods. 

Specific rule in the field of tourism

When booking a hotel or other tourist accommodation, consumers may be asked to send a copy of their ID.

• For accommodation bookings in Austria, a guest sheet must be filled out (“Gaesteverzeichnisblatt”). Several pieces of information are required from the main traveller, first name, surname and date of birth are sufficient from the fellow travellers. If there are more than 4 fellow travellers, a supplementary sheet must be attached. The guest register is to be kept either electronically or with a signed guest register sheet collection. This data must be kept for 7 years, or longer if necessary to fulfil legal obligations.
• In Bulgaria hotels fill in “Address card” and register accommodated tourists. The staff may request to see the ID card to check the data necessary for filling this Address card, but they have no right to photocopy it. According to the Tourism Act -”Persons performing hotel activity keep a register of accommodated tourists with the content of the data approved by the Minister of Tourism and published on the website of the Ministry of Tourism. The entries in the register shall be made immediately upon the tourist’s accommodation. According to Foreigners in the Republic of Bulgaria Act, “persons, performing hotel business, upon accommodation of a foreigner shall register him in the register under the Tourism Act, in which they enter the full foreigner’s names indicated in the passport, the date and year of birth, citizenship, passport number or the travel document replacing him, as well as the period of his residence at the tourist site.” But as indicated above, they have no right to take a copy of the identity document.
• In the Czech Republic; accommodation providers, or foreigners, are requested to provide to state bodies the following information: Data provided to the Czech Statistical Office. – this report contains, among other data (not related to the guest), country of domicile of the guest and duration of the stay (number of nights) – this applies to all providers of mass accommodation (more than 5 rooms or more than 10 beds, i.e. mostly hotels, but not Airbnbs). Data provided to foreign police – this report contains name, duration of supposed stay, date of birth, nationality, passport number, visa number, domicile abroad, address of stay in Czech republic and signature. This applies to almost all foreigners (some exclusions apply, e.g. persons younger than 15 years). Foreigners are usually providing this data via the accommodation provider. 
• In France, upon arrival, a police form is required when a foreign guest stays in a hotel. The accommodation provider is therefore obliged to have the foreign guest (whether or not an EU citizen) complete and sign an individual police form. Its legal status was simplified and modernised by decree no. 2015-1002 of 18 August 2015 (article R611-42 of the Code on the Entry and Residence of Foreigners and the Right of Asylum). The police record may be kept in dematerialised form. The system leads to the creation of personal data processing exempt from declaration to the CNIL because it is constituted for a reason of general interest, but all necessary precautions must be taken to preserve the security of the data processed (confidentiality, integrity, etc.). At the end of a six-month period, the files must be destroyed in a definitive and secure manner. The host has no authority to check the authenticity of the identity document supporting the information entered by the foreign national in a police record (Article L611-1 of the aforementioned Code), nor to take a copy of it. The foreigner’s refusal to fill in the police form (an obligation in the public interest) could be regarded as constituting a legitimate reason for refusing to sell within the meaning of Article L 122-1 of the Consumer Code. On the other hand, contractual clauses may provide for the transcribing of information provided by the customer at the time of booking, who only has to sign the form upon arrival (information of 26 January 2013 Nor INTV 1602523).
• In Germany this depends on the federal state where the hotel is located. Most states require hotels to fill in so called “Meldescheine”. This is primarily for statistical purposes of the city/community, not for the police. The form contains the dates of the stay, name and nationality of all travellers (if they are from a foreign country) and also the number of the identity card of the “main traveller”. The forms must be kept for one year and then have to be destroyed within 3 months after that time period has ended. 
• Also in the Hungarian hotel sector, there are strict registration rules of guests to be carried out by hotel operators. Identity cards and personal data are recorded. The hotels are connected to a government database in order to share statistical (and not personal data).

KYC in the banking and financial sector 

Unlike other sectors, where this requirement is part of good management (and is included in
membership contracts or other contracts), KYC is highly regulated in the banking and financial
sector, and its provisions are set out for the fight against money laundering and terrorist financing as well as due diligence obligations. However data protection authorities already had to step in in order to remind of the necessity of proportionality.

• For example, the Austrian authority has decided that for a change of 100 € no ID can be required.
• In Bulgaria, the Measures against money laundering Act allows banks, notaries, insurers, reinsurers and insurance intermediaries, lawyers, and accountants to ask a consumer for a copy of an ID card. ID cards can also be requested by other traders as Postal operators licensed to handle postal money orders, the currency exchange offices; persons providing by occupation intermediation in real estate transactions, and the traders in arms, oil, etc petroleum products. Persons offering a loan of money against the deposit of an item of property as security; the organizers of gambling games; persons that trade or act as intermediaries in the business in works of art and persons that provide exchange services between virtual currencies are also allowed to do so.
• In Germany unlike hotels and shops, banks and insurance companies are allowed to demand, make and keep an unredacted copy of an ID- but only for five years. This exception is intended to curb and fight organised crime. The number of companies affected by the Money Laundering Act is very high. An exact and exhaustive list of those obliged to comply with the Money Laundering Act can be found in Section 2 (1) of the Money Laundering Act. In addition to companies from the financial and insurance sectors, notaries, lawyers, tax advisors, auditors and casinos are also listed. The Money Laundering Act does not apply to those who are not explicitly listed. From the non-financial sector, the following industries in particular are affected by the Money Laundering Act: Insurance intermediaries (only for certain products; e.g. life insurance); auditors, certified public accountants, tax advisors and tax agents; trustees; real estate agents, organisers and intermediaries of games of chance, persons who trade commercially in goods. In the area of traders in goods, car dealers, jewellers and watchmakers, premium consumer electronics dealers, art and antique dealers and luxury goods dealers are primarily affected. Products with larger amounts of cash are more frequently purchased from these dealers, which is why they can easily be misused for the purpose of money laundering.

Is there any other reason for an online site to score its customers than to check their identity and solvency? Yes! To develop their business. KYC allows the merchant to tailor the customer experience, even to the point of adapting and customising the website interface.

Smart merchants also make targeted use of their customer knowledge for marketing actions or
special offers. Does a consumer regularly participate in customer surveys etc.? The e-merchant will assign a score based on all the data available. In addition to the data mentioned above, he will be able to use:

• Socio-demographic data: age, sex, family situation, profession.
• Psychological data: interests, opinions.
• Behavioural data: purchase history, date of last purchase, frequency of purchases, response rate to emailings, etc.

Depending on the scoring and buying behaviour a consumer could also be considered as an occasional customer, a regular buyer or even a VIP customer. The merchant will be able to adapt
his marketing offer according to the status: e-mail and dedicated offers, special offers, discounts, product previews etc. (see ECC-Net contribution on dark patterns).

But it also serves to monitor your buying and claiming behaviour. A systematic check will show whether a consumer often complaints to customer service; disputes payments or initiate chargebacks. It happens that merchants feel that a consumer has made too many returns and stops accepting orders or closes customer accounts? Even in France with a legislation banning refusal to sell, certain legitimate reasons are allowed, including “inappropriate behaviour by the consumer, bad faith”. However, it is rare that traders inform the consumer about the exact reason why they banned the particular user.

What about GDPR?

While it is understandable that the trader tries to limit the risk of fraud, also in the interest of his customers whose identity has been usurped, he must nevertheless respect at European level the protection granted to customers under the General Data Protection Regulation.

Thus the constitution of any customer list must be proportionate and justified. It must also be updated and corrected, or the data must be deleted after a certain time. Of course, consumers must be informed if their data is included in any lists!

The procedures for entering into a relationship, transmitting strictly necessary data, storing, updating identification data and deleting data once the relationship has ended must comply with the requirements of the GDPR.

The Berlin data protection authority issued a ruling in 2019 against a bank that kept the data of former (probably problematic) customers on a blacklist so that they could not open new accounts. The data protection commissioner did not see this as a legitimate interest to store this
data and imposed a fine. One reason why there cannot be a legitimate interest is that in the EU,
there is an obligation to contract with consumers for basic bank accounts.

For example, the sharing of customer information between different legal entities of the same group cannot be done without the customer being informed, expressing his consent, being able to object to it, accessing it and rectifying it, and being able to transfer his data to another banking institution for example (portability). However ECCs have heard about so called black lists of customers.

Presentation of information (online buying)

All consumers, when buying online, have experienced many times complex and difficult to understand Terms and Conditions as well as hidden information about their purchase that comes to their attention after the final payment. 

The better consumers are informed about their rights, the more trust they have in buying
products, online. The clearer information is provided upfront, the fewer misunderstandings
and disputes arise at a later stage. 

The EU law covering the mandatory information that a trader has to provide to the consumer for
the conclusion of an online contract is covered by the Consumer Rights Directive 2011/83/EU and the Unfair Commercial Practices Directive 2005/29/EC.

Is the above legislation sufficient and is it respected by traders in practice? What ECCs usually see as problematic:

• The font size and contrast colour picked are usually not properly selected, thus the consumer easily misses information. A lot of information is hidden by the use of very small font.
• Information provided is not translated into all targeted consumers language, especially the T&Cs.
• Complex and confusing language is usually observed in T&Cs.
• Shopify (or other template provider) pages usually have the same T&Cs, Privacy Notice and Code of Conduct which are not adapted to their specific services and/or goods.
• Email address and telephone number of the trader is missing (Omnibus Directive specifies that both contact means should be available).
• Total price (including all additional charges and taxes as well as shipping costs) not apparent and well explained in the product display page/ offer page.
• In subscription cases, recurring fees or any additional consumption bases charges are usually not indicated.
• Delivery information and from where the product is sent are usually missing.
• Product information, listing all the characteristics of the selected product are not always listed in the offer page.
• Consumers rights information in relation to 14-day Right of Withdrawal (cancellation) is not always available or often hidden in small letters.

In France, the information a trader must communicate to a consumer in case of distance selling is specified and reinforced, according to a decree dated March 25, 2022. This is the last element of the transposition in France of the European directive on the modernization of consumer protection, which comes into force on 28 May 2022.

In the case of distance selling, on the Internet or outside a store, the prior information that a consumer must receive from the seller is reinforced, according to a decree dated March 25, 2022.

The list includes 15 obligations to be respected, instead of 6 previously. Among the most important are:

• The identification of the seller: name or corporate name, address of the establishment, telephone number, email address, address and identity of the professional on whose behalf he acts.
• The means to ensure that the consumer is able to keep his written exchanges with the professional on a durable medium, including the date and time of these exchanges.
• The terms of payment, delivery and performance provided for in the contract.
• The terms and conditions for handling complaints.
• The legal guarantee of conformity, the guarantee against hidden defects and any other applicable legal guarantee.
• The commercial guarantee and after-sales service.
• The conditions of termination, for openended or tacitly renewed contracts, as well as the duration of the contracts.
• For digital content and services, the functionality of the goods concerned, their compatibility and interoperability, as well as the applicable technical protection measures.
• The contact details of the mediator or mediators to whom the consumer can turn.
• The cost of remote communication for the conclusion of the contract when this cost differs from the basic tariff.
• Any codes of conduct applicable to the contract and how to obtain a copy.
• The minimum duration of the consumer’s contractual obligations.
• The possible deposit and other financial guarantees due by the consumer.

On the other hand, the withdrawal form, which must be provided and whose model is strictly defined, must include the supplier’s e-mail address, which was not previously required. This decree is the last element of application of the ordinance n° 2021-1734 of December 22, 2021, transposing into French law the European directive of November 27, 2019, on the modernization of consumer protection. Its provisions came into force on 28 May 2022. They aim to strengthen consumer protection, particularly in cross-border transactions, which are increasingly numerous in Internet sales, by improving the prior information that must be communicated to the buyer and by increasing penalties in case of infringement.

Vulnerable consumer

The current framework of the Unfair Commercial Practice Directive describes ‘the vulnerable consumer’ and ‘the non-vulnerable consumer,’ as if consumers neatly fall into either of those categories. The idea of the ‘average consumer’ permeates large parts of European consumer law and has been pivotal in building a narrative of consumer empowerment and enabling consumers
to protect themselves through active and well-informed choices in the marketplace. This is contrasted by the ‘vulnerable consumer’ – a concept that singles out certain groups of consumers that are more susceptible to unfair commercial practices than others, and less able to protect themselves.

In digital marketplaces, most if not all consumers are potentially vulnerable. With the digitization of consumer markets, consumers as well as traders increasingly rely on algorithmic profiling, automated decision-making, and predictive analytics. These systems are largely data-driven, using data to recommend services, remind us of products that we might still like to buy, or provide us with personalized offers and promotions. The overall objective of these practices is to render consumers receptive to digital marketing strategies that use digital technologies to optimize commercial practices with the goal of selling products and services to consumers.

What protection can the concept of consumer vulnerability offer the digital consumer, is the distinction between the average and the digital consumer still fit for the digital age, and if not, do we need a new understanding of ‘digital vulnerability’?

In 2016 the European Commission communicated an updated and extended definition of the ‘vulnerable consumer’. “A consumer, who, as a result of sociodemographic characteristics, behavioural characteristics, personal situation, or market environment:

• Is at higher risk of experiencing negative outcomes in the market.
• Has limited ability to maximise his/her wellbeing.
• Has difficulty in obtaining or assimilating information.
• Is less able to buy, choose or access suitable products. 
• Is more susceptible to certain marketing
  practices.

This definition takes into account that consumer vulnerability is situational, meaning that a consumer can be vulnerable in one situation but not in others, and that some consumers may be
more vulnerable than others.” Essentially this means that consumers are not simply vulnerable, but that some market structures and configurations make them vulnerable, or exploit their vulnerabilities.

• In Finland, even though there is no specific definition of vulnerable consumers in the Finnish legislation, the concept of vulnerable consumer is included in the area of consumer protection. While “vulnerability” is not specifically mentioned, the concept is transposed through the wording “consumers who are particularly impressionable due to their age, disability or credulity” (Consumer Protection Act, chapter 2, section 3).
• In Portugal, there is legal definition. DL n.o 57/2008, art. 6.o a) mentions vulnerable consumers as being more likely to be deceived by the professional due to the consumer’s physical or mental illness, age or credulity, if the professional could have reasonably foreseen that their conduct was likely to cause a distortion.
• In Ireland, the definition of ‘vulnerable consumer’ tends to be defined sectorially. Therefore, there are vulnerable customer policies for various industries and companies. Generally, vulnerability tends to mainly mean someone with an intellectual disability. “In digital marketplaces, most if not all consumers are potentially vulnerable.” 

Example of ‘vulnerable customer’ in the financial sector: The Code currently defines a vulnerable consumer as follows: “A “vulnerable consumer” means a natural person who:

• Has the capacity to make his or her own decisions but who, because of individual circumstances, may require assistance to do so (for example, hearing impaired or visually impaired persons). 
• And/or has limited capacity to make his or her own decisions and who requires assistance to
  do so (for example, persons with intellectual disabilities or mental health difficulties).

In Austria, there has been a legal entitlement to a so-called “basic account” at the bank since 2016. This is a payment account with basic functions. This account must be offered by all banks and may not be dependent on the purchase of additional contracts. There are only 2 legally defined grounds for refusal (other account is existing already, committed crime). Particularly vulnerable consumers (e.g. who previously had no account or due to language difficulties (EU foreign countries)) must be supported by the bank free of charge. For socially and economically particularly vulnerable consumers, the account may cost a maximum of €41.73 (otherwise €83.45). 

Ticket scalping

Unauthorised reselling tickets websites offer to consumers event tickets which have been acquired through dubious practices. There are numerous websites reselling tickets to European consumers. The sellers on these sites are often professionals who list hundreds of tickets for inflated prices, which they acquire either by using a specialised, automatic software (bots) or with the use of multiple credit cards.

Problems related to the resale of event tickets:

• Non-delivery or delayed delivery – this is a particular problem when the consumer has purchased the ticket last minute and has arranged for delivery to the hotel or even the ticket office at the venue. There may be a delay in receiving the ticket you ordered, and then, close to the event, you’re told that the tickets you ordered are no longer available, but there are other tickets at a higher price.
• Wrong tickets – the ticket states a different event or category. If you buy the ticket from an individual seller or unauthorised source, they may be hard to trace if it turns out to be not what you ordered.
• Invalid or fake/forged tickets or tickets for non-existing events – essentially, fraud.
• Duplicated tickets – one turns up to the event only to find someone else sitting in their seat or they are denied access into the event.
• Tickets for certain major events are personalised (for example, name and security code) so if you buy from unofficial sources, you run the risk of being denied entry.
• The company has gone into liquidation, or the website is suspended by the time the consumer expects physical delivery of the tickets.
• If the event is cancelled or postponed and you have problems getting a refund.
• Restrictions placed on resold tickets – In a bid to tackle ticket touting and the selling of over- priced tickets, some artists, promotors, and organisations are placing quite a lot of restrictions on event tickets recently. Some of these include a requirement to present the purchasing credit card and ID to reflect the family name on the ticket.

For example, of the complaints received by ECC Ireland over the past five years in ticket sales, 65% of complaints related to sales on the secondary ticket market. All these complaints related to major musical and sporting events which can be characterisedby high demand and inflated prices. Aside from complaints as to pricing, a significant portion (over 60%) of these complaints related to non-performance i.e. the purchaser failed to receive the event tickets in time or at all, or where the consumer failed to gain admittance to the event with the tickets provided. Of recent concern is the number of consumers reporting to have been unaware they were purchasing on a secondary marketplace at a premium cost, after having been redirected there by the official ticket agent.

EU Rules covering the resale of tickets 

There are specific rules in several countries which prohibit or restrict the resale of tickets in one way or another. For example, the reselling of tickets at more than face value (e.g. in Denmark or Belgium) is banned. Under the French Criminal Code, it is stated that it is forbidden to resell tickets for sporting, cultural or commercial events without the authorisation of the organiser. Ticket resale is punishable by a fine of 15 000€ (30 000€ for repeated offenses). Additionally in France, on 28/5/22 the new UCP rules came into force, following the transposition of Omnibus Directive and commercial practices are deemed to be misleading within the meaning of Articles L. 121-2 and L. 121-3, if their purpose is:

“26° To resell tickets for events to consumers where the trader has acquired them by using an automated means enabling him to circumvent any limit imposed on the number of tickets a person may purchase or any prohibition applicable to the purchase of tickets”.

• In Germany, there is no legislation with regard to ticket resale but there is a judgement by the BGH (Federal Court of Justice) stating that a prohibition in the general terms and conditions to resell tickets is perfectly permissible if the tickets are not purchased for private use. However, according to the BGH, organisers cannot in principle prohibit the sale of tickets purchased by private individuals. A ban on resale agreed in the general terms and conditions of the organisers does not apply to private buyers. If the buyer sells his ticket, for example because he cannot or does not want to attend the event, he is not in breach of contract. Even if it is expressly stated on the ticket that a sale via internet auction houses and/or with a price surcharge is prohibited, this does not bind the private buyer and reseller. The purchase also has no legal consequences for the purchaser. None of this applies if the ticket is personalised, as is the case, for example, at all major football events (World Cup, European Championship, etc.). Personalised tickets may not and cannot be effectively resold.
• In Poland and Ireland, it is illegal to sell tickets for live events, matches, and concerts for more than face-value. But, in most countries, there are no specific rules in place. 
• In the Netherlands and Finland, secondary selling is permitted but with all its possibly associated risks.