Landmark UK Digital Markets, Competition and Consumers Act Becomes Law

Following introduction into the UK Parliament in 2023, the long-awaited Digital Markets, Competition and Consumers Act (DMCC) received Royal Assent on 24 May 2024. The legislation passed as part of the parliamentary ‘wash-up’ period triggered by a surprise announcement of a general election in the UK.

Representing a major shift in UK digital, competition and consumer protection regulation, the DMCC has three pillars:

1. Introducing a new regulatory regime for large digital firms.
2. Significantly widening the enforcement remit of the Competition and Markets Authority (CMA) in consumer protection, particularly in relation to online activities.
3. Giving the CMA broader powers to review mergers and in relation to conduct investigations.

The most significant elements are expected to come into force in autumn 2024, after consultation on CMA guidance.

In short, the DMCC materially strengthens the CMA’s regulatory toolbox by significantly enhancing its powers to intervene and enforce across its consumer, competition, and digital remits. In practice, this will mean that companies operating in the UK that are consumer-facing entities or have a digital presence will not be able to consider their competition law or consumer law compliance obligations in a silo; rather, it will be necessary to review commercial activities and manage risk by taking a holistic assessment of competition, consumer, and digital obligations.

Below, in the first of three updates on the DMCC, we summarise the key digital markets elements of the DMCC, the implications for businesses in the digital space, enforcement risks and next steps.

New regulatory regime for large digital firms

Under the DMCC, the CMA has the power to designate companies engaged in the provision of internet services and digital content with a significant market position in the UK as having strategic market status (SMS). Only those companies designated as having SMS will be subject to the digital markets regime, meaning additional regulation and new legal obligations, which will restrict their commercial freedom in UK markets.

SMS designations will be determined by the CMA’s Digital Markets Unit (DMU) according to whether a company:

• Engages in digital activity as a result of providing services by means of the internet or digital content.
• Is linked to the UK as a result of its digital activity having a significant number of UK users, being conducted in the UK or likely to have an effect on trade in the UK.
• Has a turnover exceeding 25 billion pounds globally or 1 billion pounds in the UK.
• Has substantial and entrenched market power in the relevant market and is forecast to have this over a period of at least five years.
• Has a position of strategic significance in the market as a result of its size or scale, or use by a significant number of other undertakings, or its position would allow it to extend its market power to other activities or allow it to influence the ways in which other undertakings conduct themselves.

As part of the regime, the CMA is required to conduct a formal evaluation process to determine which digital companies should be designated as having SMS. The CMA has stated that it will open its first designation investigations before the end of 2024, with a view toward designating the first companies in mid-2025.

The CMA has indicated that it expects to initiate three to four SMS investigations in the first year of the regime. The targets of these investigations are likely to be large digital firms which the CMA identified in previous market studies as potentially having market power in areas such as digital advertising, mobile operating systems and devices, and app distribution. Investigations into additional companies, including one or more of those designated as ‘gatekeepers’ under the European Union’s similar legislation – the Digital Markets Act (DMA) – are likely to begin in 2025.

Bespoke code of conduct for SMS firms

Each designated SMS firm will be subject to its own bespoke set of conduct requirements (CRs) in relation to the digital activity for which it has been designated. CRs are intended to guide the behaviour of SMS firms to prevent them using their market power in a way that would either exploit consumers or undermine fair competition. As such, CRs will reflect competition and consumer law requirements with new prescriptive or ex ante rules, allowing the CMA to regulate digital firms across both policy areas. The form and content of CRs is therefore likely to vary across firms and activities, and the CMA can only impose CRs where it is proportionate to achieving at least one of the three core legislative objectives:

1. Fair dealing.
2. Open choices.
3. Trust and transparency.

A CR also must be of a ‘permitted’ type listed under the DMCC. However, the permitted CRs are expressed in very broad terms and afford the CMA a significant degree of discretion in determining what kinds of obligations to impose on each SMS firm. They may be outcome-focussed or action-focussed obligations, and they could include measures such as:

• Preventing SMS firms from preferencing their own products and services over those of competitors.
• Requiring SMS firms to allow the products and services of other firms to work with their own.
• Making SMS firms provide competitors with greater access to data and functionality.
• Mandating that SMS firms trade on fairer terms.
• Obliging SMS firms to give clear and accurate information about the digital activity to (potential) users (e.g., increasing transparency with respect to aspects of the firm’s algorithms).

We expect that the CMA will look to the obligations imposed on ‘gatekeepers’ by the European Commission under the DMA, although it may use its ability to impose bespoke codes of conduct to tailor requirements more specifically for each firm. In contrast, under the DMA, designated ‘gatekeepers’ are subject to a common set of obligations – for instance, allowing third parties to interoperate with the gatekeeper’s own services and prohibiting gatekeepers from self-preferencing their own services and products over those offered by third parties on the gatekeeper’s platform. This difference in the design of the regulation could require regulated businesses to contend with different obligations and compliance requirements between the UK and EU.

The CMA already has undertaken much of the groundwork for the implementation of the DMCC over the past few years while the enabling legislation has been developed. This has included conducting market studies into online platforms, digital advertising and mobile ecosystems. The CMA has been awaiting the coming into force of the DMCC to implement many of the recommendations in the reports to these studies and it is anticipated that the interventions identified in the reports will be covered by the initial codes of conduct. The list is lengthy but includes measures to address:

• The power balance between publishers and platforms.
• Self-preferencing in adtech and specialised search.
• Transparency in digital advertising.
• Use of choice architecture to nudge users.

The approach of using bespoke codes of conduct is a key point of distinction between the DMCC and the EU’s DMA. Whilst the CRs for each SMS firm may have in mind similar objectives, we expect that the code applicable to each SMS firm will be quite different – and will reflect the relevant market and third parties with whom each SMS is dealing. In practical terms, as well as complicated compliance for companies across both jurisdictions, the divergence of approach inevitably will provide additional opportunities for third parties to challenge the behaviour of SMS firms in Europe.

‘Pro-competitive interventions’

The CMA also will have the power to make ‘pro-competitive interventions’ (PCIs) in relation to SMS firms, designed to address any factors that the CMA identifies, after an investigation, as having an adverse effect on competition. The scope of the PCIs’ power is broad and can include orders mandating businesses to do certain things or, at the extreme, to break up businesses. The use of PCIs therefore is likely to be highly contentious.

The CMA has stated that PCIs may include giving people the power to easily transfer their data from one provider to another or requiring different products and services to work with each other. They will be designed to tackle the factors that are the source of a firm’s market power in a digital activity for which it is designated with SMS.

To make PCIs, the CMA will have to undertake an investigation within a nine-month deadline to determine whether there are any factors relating to an SMS firm’s designated digital activity that are having an adverse effect on competition.

Recent market studies show that CMA is considering PCIs in advertising, for example, to increase consumer control over data, require interoperability and mandate third-party access to data.

Enforcement, appeals and litigation risk

The new legislation includes enforcement and appeal provisions. In particular:

• The CMA will be able to impose fines of up to 10% of global turnover for breaches of the CRs or PCIs, along with daily fines of up to 5% of global turnover for continued breaches, and decisions to impose fines will be subject to a full merits review on appeal.
• Parties affected by the regulatory changes will be able to appeal designation, imposed codes of conduct and PCIs, but the right of challenge is limited to judicial review grounds only – an administrative law review which focuses on the lawfulness of the decision (and its reasonableness) – rather than a full review on the merits.

Whilst the CMA has been publicly emphasising the collaborative and iterative nature of the new regime, experience with the DMA shows that designated firms may be willing to litigate ‘red lines’. Moreover, with uncertainty surrounding the design of CRs, differences of interpretation could remain. In light of this, the limitation on challenges to judicial review grounds is unlikely to stop SMS designees challenging CMA decisions.

In addition, the DMCC provides for private enforcement rights by persons affected by breaches of CRs or PCIs. This will provide further scope for third parties to challenge the commercial actions of designated companies, as well as claim damages for losses caused by breaches.

Key implications for business with digital activities in the UK

The CMA has been waiting for some significant time for the DMCC to come into law. As a result, the CMA has been busy preparing for the new digital regime. The DMU is already up and running and well staffed, detailed draft guidance documents were issued for consultation the same day the DMCC received Royal Assent, and we anticipate that much of the preparatory work vis-à-vis SMS designations and codes of conduct has already been undertaken. In practice, this means that once the DMCC comes into force (which is expected in autumn 2024), the CMA is likely to move to a rapid implementation of the new regime.

The key focus of the new digital markets powers are those large digital firms that will be designated as having SMS. However, even nondesignated firms not directly regulated may be affected by the regulatory regime as a result of the CRs and PCIs. In regulating the conduct of certain firms, the adoption of these requirements will, for some, open up opportunities, whilst for other nondesignated albeit large market players, there may be an expectation by third parties that they too should adopt similar commercial practices allowing, for example, greater interoperability.

The CMA will want to avoid the pitfalls of the early implementation efforts of the DMA in which there have been numerous challenges launched and various accusations of circumvention not long after its operation commenced. The CMA has repeatedly stressed that it will seek to implement the regime in a ‘targeted, evidence-based and proportionate’ way. However, that does not detract from the wide-ranging powers that the CMA has been given.

In addition, the DMCC gives CMA the choice of a wider range of tools – competition and consumer law as well as the digital regulatory powers – to use in the digital space when taking forward enforcement action. This inevitably will result in greater regulatory activity in the UK. However, the choice is not necessarily binary – it is likely that the CMA could potentially enforce a mix of its competition, consumer and digital regulatory powers at the same time.

Next steps

The CMA is commencing its consultations on draft guidance on various aspects of implementation, including consumer law investigations, the SMS regime and merger thresholds. Interested parties also will have the chance to comment throughout the designation process, and the CMA has encouraged an open dialogue. This presents opportunities for businesses to engage in dialogue with the CMA on critical aspects of digital regulation.

Most substantive parts of the DMCC, including the SMS regime, will come into force once the UK government passes commencement regulations. This is expected to be autumn 2024, but it is unclear to what extent timings may be impacted by the outcome of the upcoming UK election. Publication of the CMA’s final guidance is anticipated to coincide with commencement.

If you would like assistance in assessing the impact of the DMCC on your business, please contact a member of the Cooley team below.

Cooley trainee Mo Swart also contributed to this alert.

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.