DMCC Act ecommerce compliance: what your store's code needs to change

What is DMCC Act ecommerce compliance, in practical terms?

DMCC Act ecommerce compliance is making sure the parts of your online shop that customers see, the prices, fees, reviews, urgency messages and subscription terms, meet the consumer rules in the Digital Markets, Competition and Consumers Act 2024. For store owners, the big change is enforcement: the Competition and Markets Authority can now decide a breach itself and fine directly.

The Act received Royal Assent in May 2024. Its consumer protection provisions came into force in April 2025, and the CMA's announcement at the time said it can fine businesses up to 10% of their global turnover for breaches of consumer law. Before this, consumer enforcement usually meant going through the courts.

Most of the rules on unfair commercial practices are similar to what came before, under the old Consumer Protection from Unfair Trading Regulations. What is new for ecommerce is the explicit list of banned practices (including fake reviews and drip pricing), the direct fines, and a subscription contracts regime that the government expects to begin in spring 2027.

Every one of those rules ends up in code. A mandatory fee is added by a theme function or an app. A review badge is controlled by a plugin setting. A countdown timer is a script. That is why DMCC Act ecommerce compliance is as much a developer's job as a lawyer's: the solicitor says what must be true, and someone has to make the store behave that way on every page.

Does DMCC Act ecommerce compliance apply to my online shop?

If you sell to consumers in the UK, the consumer protection parts of the Act are relevant to you, whatever your size. There is no small-business exemption from the ban on fake reviews or hidden mandatory fees.

The rules focus on business-to-consumer dealings. A purely trade wholesaler selling only to other businesses is in a different position, though many B2B wholesale sites also take orders from sole traders or the public, and the line is worth confirming with your solicitor.

The CMA's approach also matters. Its November 2025 announcement described reviewing over 400 businesses across 19 sectors, sending 100 advisory letters and opening cases into eight businesses over online pricing practices. The sectors named ranged from holidays and live events to homeware, fashion, food delivery and gyms. Ordinary online retail is clearly in view, not just ticketing giants.

If you sell through marketplaces as well as your own site, remember that your listings there are also your commercial practices. Price your marketplace listings on the same all-in basis as your store so customers do not see different headline figures for the same product.

What is drip pricing, and is it illegal in the UK now?

Drip pricing is showing a lower headline price and adding unavoidable charges later in the buying process. The DMCC Act regime bans it, and the CMA's chief executive put the principle simply when announcing its first fine: if a fee is mandatory, it must be included in the price from the very start, not added at checkout.

That first financial penalty under the new powers, announced in April 2026, involved two driving schools that showed a mandatory booking fee only at checkout. The CMA ordered refunds to more than 80,000 customers and a fine of £4.2 million. The fee per customer was small; the principle was not.

For an online shop, the risk usually hides in three places. A “service”, “handling”, “admin” or “platform” fee added to every order by an app or a theme function. A card surcharge or small-order fee that every customer in practice has to pay. And a price shown ex-VAT on a consumer store when the customer cannot avoid VAT.

Optional extras are a different matter. Gift wrap, express delivery upgrades, extended warranties and insurance that a customer can decline are not mandatory fees, though they should still be presented clearly and never pre-selected. Delivery charges have their own treatment in the CMA's price transparency guidance, which depends on whether the charge can be calculated in advance; ask your solicitor how it applies to your shipping model before we change the display.

Which fees must be in the headline price on a UK store?

Any charge that every customer must pay to buy the product belongs in the first price they see. The CMA's price transparency guidance, finalised in November 2025, is written for exactly this question and is the document your solicitor will work from.

Once the list is agreed, the development work is about consistency. The all-in price must appear on category grids, product pages, search results, quick-view pop-ups, abandoned-basket emails, Google Merchant Center feeds and paid-social catalogues, and the checkout total must match it. A single place still showing the old price undoes the rest.

Fixing drip pricing on Shopify, WooCommerce and custom stores

The fix is to move the mandatory charge into the product price, or to calculate an all-in price for display everywhere, and remove the late-added fee. How you do that depends on where the fee comes from today.

On Shopify, fees are commonly added by apps that insert a fee product or line into the cart, or by checkout customisations. We identify every such app, decide with you whether to fold the fee into product prices or display an all-in figure, and remove the late addition. Then we check the theme's price snippets, the product JSON used by quick-view, and the feed apps, because each renders price separately.

On WooCommerce, mandatory fees often come from the cart fees hook in the theme's functions file or from a plugin. We move that logic into pricing, or into a display layer that shows the inclusive price on archive and product templates, and confirm that tax settings show VAT-inclusive prices to consumers. We check block-based checkout and classic checkout separately, since they render totals differently. Our WooCommerce developer page covers the platform in more depth.

On a custom store, the cleanest fix is a single pricing function that every template, email and feed calls. Many older builds calculate prices in several places, which is how inconsistencies creep in. Refactoring to one source of truth is the durable fix and makes future DMCC Act ecommerce compliance checks much quicker.

What does the DMCC Act ban on fake reviews mean for shops?

The Act introduced banned practices on reviews. The CMA's short guide for businesses publishing consumer reviews describes three kinds of banned content: fake reviews that claim to be genuine, reviews that conceal that they were incentivised, and false or misleading consumer review information, such as ratings built from fake reviews or reviews presented in a misleading way.

If you publish reviews, the CMA's guidance says you must take reasonable and proportionate steps to prevent and remove that banned content. It describes what that involves: clear policies that prohibit fake reviews and explain your stance on incentivised reviews, regular assessment of the risk of banned content appearing, and processes to detect, investigate and act on it. The guide also makes the point that you remain responsible even when a third party helps you monitor reviews.

For store owners, the usual risks are very ordinary. Staff or friends posting early five-star reviews. A discount code offered for a review without the review being labelled. Importing reviews from a supplier's site for the same product. A review app set to publish only four- and five-star reviews automatically while holding back lower ones. Or a star rating that counts reviews from a different product.

The CMA ran a web sweep of over 100 businesses on reviews three months after the rules began, according to a 2026 speech by its consumer protection lead, and said further action on fake reviews would follow. This is an active enforcement area.

Reviews and DMCC Act ecommerce compliance: building a system that holds up

Collect reviews only from verified buyers where you can, label anything incentivised, publish negative reviews on the same terms as positive ones, keep a moderation log, and publish a short review policy. Those five changes cover most of what a small store needs.

• Invite reviews from real orders only, with the verified-purchase flag stored against the order
• If you offer any incentive, apply it to all reviewers regardless of rating and label those reviews clearly
• Publish all genuine reviews that meet a stated content policy, whatever the star rating
• Moderate against a written policy (abuse, personal data, off-topic), not against sentiment
• Log every rejection with the reason, so you can show your process if asked
• Calculate ratings only from reviews of that product, and show the number of reviews
• Do not import or syndicate reviews from other sellers or different products
• Give customers a way to report a suspicious review, and act on reports
• Publish a review policy page linked from every review widget

Most review apps can be configured this way; some cannot. During the audit we test the app's actual behaviour, such as whether low ratings are held for approval by default, and replace it if needed. For stores that also collect Google reviews, the same principles apply to how you invite them.

Are countdown timers and low-stock badges banned in the UK?

Misleading ones are. When launching its online pricing drive in November 2025, the CMA named misleading countdown timers as banned under the new regime. A timer that resets for every visitor, or a sale “ending tonight” that runs all month, is the kind of thing that creates risk.

Genuine urgency is fine. A sale that really ends on Sunday can show a timer counting to Sunday. A stock badge that reads the real inventory level can say “3 left”. The problem is fabricated pressure: evergreen timers, invented stock counts, and pop-ups claiming “12 people are viewing this” generated at random.

Developers see this clearly because these features are usually small scripts or apps. We check each one's source: is the end date stored centrally and the same for everyone, is the stock figure read from inventory, is the “viewing now” number real or random. Anything that cannot be tied to true data we suggest removing. It rarely costs much conversion, and it removes a practice the regulator has named.

Other pressure patterns worth reviewing at the same time: pre-ticked add-ons in the basket, confirm-shaming wording on opt-outs (“No thanks, I don't like saving money”), and exit pop-ups that make closing difficult. None of these helps long-term trust.

What are the DMCC Act subscription rules, and when do they start?

The Act creates a subscription contracts regime that the government's April 2026 consultation response says it anticipates will commence in spring 2027. If you sell subscription boxes, memberships, replenishment orders or paid trials, this is the part of DMCC Act ecommerce compliance to plan for now.

According to that government response, traders will need to give clear pre-contract information before sign-up, and send written reminder notices on a durable medium before certain renewals, particularly before a free or discounted trial rolls into a paid period and before contracts of 12 months or more renew.

There are two cooling-off windows: an initial 14-day period, and a renewal cooling-off period after certain auto-renewals. Refund rules differ between goods, services and digital content. And ending the contract must be straightforward: where someone signed up online, they must be able to cancel online, and terms that make leaving disproportionately difficult are to be prevented.

The detailed secondary legislation and guidance will settle the exact wording, timings and edge cases, so treat any build now as preparation rather than final compliance. The engineering, though, is predictable enough to plan: data about when each subscription started and renews, a reminder pipeline, a cancellation path in the customer account, and records of what was sent.

Preparing your subscription checkout and account area now

Start with an honest cancellation route and clear sign-up information, because those help customers today and will be needed under the new regime. Reminder automation can follow once the rules are final.

On Shopify, subscriptions run through subscription apps built on its selling-plan features. On WooCommerce, a subscriptions plugin handles renewals. In both, we check what information the product page and checkout show before sign-up (price after any trial, frequency, how to cancel), whether customers can cancel from their account without contacting support, and whether renewal emails exist and what they say.

For custom or high-volume subscriptions, we can build the reminder logic as a scheduled job: find subscriptions renewing or leaving a trial within a set window, send a written notice by email, and log the send. The window and wording stay configurable so they can match the final rules. That kind of automation usually sits in our AI and automation plan from US$600; a full custom subscription platform starts at US$900.

Cancellation deserves special care in testing. We walk the path as a customer on mobile: how many steps, is there a retention offer that can be skipped, does the confirmation arrive, does the next charge actually stop. The booking system development page covers similar account-area work for memberships and bookings.

What are the penalties if DMCC Act ecommerce compliance fails?

The CMA can impose fines of up to 10% of a business's global turnover for consumer law breaches, without first going to court, and can order steps such as refunds to affected customers. That is a sharp change from the old regime.

The CMA said when the regime began that fines for breaches in the first 12 months would be lower, reflecting the limits on retrospectivity, and that it would focus on proportionality. Its first fine, in April 2026, was reduced from a higher figure because the business settled early, according to the CMA's announcement. Refunds were ordered on top.

Its stated priorities are practical: fees hidden until late in the buying process, aggressive sales practices aimed at consumers in vulnerable positions, fake reviews, and unfair contract terms. A 2026 speech by the CMA's consumer protection lead said businesses could expect further action on fake reviews, unfair contract terms and drip pricing.

For a small shop, the more likely first contact is an advisory letter, a customer complaint or a marketplace or payment partner raising a concern. The best position to be in is having already audited your store, fixed what your solicitor advised, and kept a record of what changed and when.

How a DMCC Act ecommerce compliance audit of your store works

We walk through your store the way a customer and a regulator would, capture evidence at every step, and trace each finding to the code, app or setting responsible. The output is a fix list your solicitor can review and we can implement.

• Price journey: headline price on listing, product page, basket, checkout and confirmation email for several products and delivery postcodes
• Fees: every line added between product page and payment, and which app, plugin or function adds it
• Feeds and ads: Merchant Center and social catalogue prices compared with the site
• Reviews: collection flow, incentives, moderation settings, rating calculation, published policy
• Urgency: timers, stock badges, viewing counters and sale end dates checked against real data
• Add-ons: any pre-selected options in basket or checkout
• Subscriptions: sign-up information, renewal emails, cancellation path and confirmation
• Records: screenshots and recordings stored with dates, for your file

The audit does not replace legal advice. Where a finding depends on interpretation, such as how delivery charges should be shown for your model, we mark it for your solicitor and wait for their view before changing anything.

How much does DMCC Act ecommerce compliance work cost?

It depends on how your store adds fees, shows prices and handles reviews today, so we quote after an audit. Quotes in the UK market vary widely, from quick theme tweaks to full legal-and-technical programmes, and the difference usually comes down to scope and evidence.

The factors that move our development quote are easy to name. How many places display price (templates, quick-view, search, emails, feeds, marketplaces). Whether fees come from apps you can reconfigure, custom code, or checkout extensions. Whether your review app can be configured properly or must be replaced, and whether historic reviews need cleaning. The number of urgency features. And whether subscription reminders and a cancellation path need building.

When the store is old and heavily patched, a rebuild can cost less than repairing it. New ecommerce stores with us start from US$750 and include all-in price display, a review setup that follows the CMA's guidance, and no fabricated urgency features. Custom commerce and subscription systems start from US$900.

Legal advice, any review platform subscription, and app fees are separate and billed by those providers. After our changes go live, two months of fixes are free, and the care plan from US$120/mo can include re-checking new apps and campaigns so drip pricing does not creep back in through a new plugin.

Other UK rules to fix at the same time as the DMCC Act

DMCC Act ecommerce compliance is one layer. While we are in your templates and checkout, it is efficient to check the neighbouring obligations too, each with its own regulator and guidance.

The Consumer Contracts Regulations still govern pre-contract information and cancellation rights for most online sales, so your terms, returns page and order confirmation emails should be consistent with the changes. Cookie consent is regulated separately under PECR and UK GDPR; our cookie banner setup page explains that work. Accessibility of the checkout matters under the Equality Act, and an inaccessible fee breakdown or review widget is a problem on two fronts; see the website accessibility audit page.

Payments are the other common neighbour. Changing how fees and totals work often means touching the payment step, surcharge logic, or how refunds are recorded. The payment gateway integration guide covers strong customer authentication, wallets and reconciliation for UK stores.

Doing these together means one round of testing and one set of evidence, rather than four separate projects each disturbing the same templates.

Working with a remote team in India on DMCC Act ecommerce compliance

Store audits and fixes happen entirely online: staff access to Shopify or a WordPress admin account, a staging copy for changes, and calls when a decision is needed. We overlap with the UK working day from late morning, so a lunchtime call in Manchester is mid-afternoon for us.

The first fortnight usually runs like this. In the first two days, you grant staff access with limited permissions and share any letters or complaints that prompted the work. By the end of the first week, you receive the audit with evidence and a draft fix list. Your solicitor reviews the items that need interpretation. In the second week, once you approve the itemised quote, fixes go into staging for your review before publishing.

We communicate in English by WhatsApp and email, and can talk directly to your solicitor or marketing contractor if that shortens the loop. Staff access is removed when you say so; every change is in your theme history or repository, so you can see exactly what moved.

Quotes and invoices are in USD from India. UK clients usually pay from a GBP account via Wise, bank wire or PayPal, in milestones set by the written quote. Nothing is billed before you approve it. We do not give legal advice, and we do not claim any certification; we implement and document the changes your adviser agrees.

Worked example: DMCC Act ecommerce compliance for a Manchester homeware store

Imagine a homeware shop in Manchester on WooCommerce. It adds a flat “order processing fee” to every basket, runs a sitewide timer promising the sale ends at midnight, and offers 10% off the next order for leaving a review. This is a hypothetical example, not a client.

The audit finds the fee added by a snippet in the theme's functions file, the timer resetting on every new session, and a review plugin configured to auto-publish four- and five-star reviews while holding lower ratings indefinitely. The Merchant Center feed shows prices without the fee.

With the owner's solicitor agreeing the approach, the fix sprint folds the processing fee into product prices, removes the snippet, and updates the feed so it matches. The timer is replaced by one reading a real sale end date set in the admin, shown only while a sale is actually running. The review plugin is set to publish all reviews that pass a written content policy, the discount is labelled on incentivised reviews, and a review policy page goes live.

The outcome is a store where the first price is the price, the timer tells the truth and the star rating means something. Conversion effects are for the owner to measure; the evidence file of before and after screenshots is ready if anyone asks.

DMCC Act ecommerce compliance checklist for UK shops

Use this as a starting point for a conversation with your solicitor and developer. Each line is something a customer can see and a developer can test.

• The first price shown includes every fee that all customers must pay
• Checkout total matches the headline price plus only optional choices and any separately agreed delivery charge
• Listings, product pages, search, quick-view, emails and product feeds show the same price
• No add-ons, insurance or donations pre-selected
• Reviews collected from real customers, with any incentive disclosed and not tied to rating
• All genuine reviews published under a written policy; rejections logged
• Review policy page published and linked from review widgets
• Countdown timers use a real, shared end date; stock badges read real inventory
• No randomised “viewing now” or “just bought” pop-ups
• Subscription sign-up shows price, frequency, trial terms and how to cancel
• Customers who signed up online can cancel online
• Before-and-after evidence saved with dates