The Digital Markets, Competition and Consumers Act 2024 (DMCC Act) came into force on 6 April 2025, overhauling the UK’s consumer protection regime.  The CMA has heralded this as a “step-change in more direct, impactful consumer protection” as, for the first time, the CMA now has powers directly to impose fines of up to 10% of a company’s global turnover for breaches of UK consumer protection rules.

In this briefing, we discuss the CMA’s new powers as well as the key points of interest arising from the Approach Document and the roster of final guidance published by the CMA over recent days and weeks.  We also examine where the CMA might turn its attention first.

The new administrative enforcement model

As discussed in detail in our briefing last July, the DMCC Act radically alters the shape of consumer protection enforcement in the UK by introducing an administrative enforcement model - bringing the regime more closely into line with the CMA’s existing antitrust enforcement regime.^[1]  Whereas previously the CMA had no powers to sanction businesses in its own right for breaches of UK consumer protection laws, but rather had to seek enforcement via the courts in contested cases (in what was often a protracted process), the CMA can now directly impose fines based on the offending company’s global turnover, as well as additional daily fines for continued non-compliance:

Further detail on the methodology for calculating fines

The CMA’s final guidance on the exercise of these new direct enforcement powers (Final Direct Enforcement Guidance) sets out in detail how the CMA will calculate the appropriate penalty.  For breaches of consumer protection laws, the CMA will follow a “stepped approach” which begins by calculating the “starting point having regard to the seriousness of the infringement and the relevant turnover”.^[2]  Building on the draft guidance issued last summer and covered in this briefing, the final guidance explains that the CMA will first assess whether the level of harm should be categorised as ‘major’, ‘significant’, ‘moderate’ or ‘other’ (Categories 1 to 4) by considering the total estimated economic and non-economic harm caused to consumers, with non-economic harm encompassing distress, delay and lack of privacy.  Escalating factors, including (amongst others) whether the infringement has particularly impacted vulnerable consumers, might then push an infringement into a higher Category.  Finally, the CMA will determine whether the level of culpability is high, medium or low by considering the extent to which the infringement was the result of deliberate action or a genuine mistake, so that at the end of the process the infringement will be given a “starting point code” ranging from “High A” to “Low D”.  This code in turn corresponds to fining bands (e.g. a band of £225,000 or 22.5% (whichever is higher) up to £300,000 or 30% (whichever is higher) for Starting Point A).  This is just the first step in calculating the overall fine, however: this starting point would then be adjusted for deterrence, aggravating or mitigating factors and proportionality (including considering the duration of the infringement), and where applicable a settlement discount applied: