1. What is Digital Choice Architecture?

EU Fitness Check (Oct 2024) defines it as: "unfair commercial practices deployed through structure, design or functionalities of digital interfaces that influence consumers to take decisions they would not have taken otherwise"

Commonly called dark patterns:

• Making certain choices more prominent (Accept all vs Reject)
• Visual interference - hiding reject button
• Roach motel - easy subscribe, hard unsubscribe
• Confirmshaming, subscription traps, drip pricing

2. Legal Framework Applicable in Spain

A. Primary Law - DSA Article 25 - Directly Applicable Since 17 Feb 2024
Article 25 DSA: "Providers of online platforms shall not design, organise or operate their online interfaces in a way that deceives or manipulates recipients or materially distorts their ability to make free and informed decisions."

Recital 67 defines dark patterns as practices that materially distort autonomous decision.

Penalty: Up to 6% of global annual turnover.

Who enforces in Spain:

• CNMC - Comisión Nacional de los Mercados y la Competencia = National Digital Services Coordinator (DSC) under DSA. Responsible for supervision, complaints, penalty regime.
• AEPD - Agencia Española de Protección de Datos = collaborates with CNMC for matters relating to minors, advertising, and GDPR consent dark patterns.

Spain's national DSA law is still in institutional consolidation in 2026 - framework exists but penalty procedures being allocated resources.

B. GDPR + ePrivacy - Consent Dark Patterns
Spanish AEPD has fined multiple sites where Reject button requires 3 clicks vs Accept in 1 click. Consent obtained through dark pattern is NOT freely given under GDPR Art 4(11) - invalid.

C. Unfair Commercial Practices Directive (UCPD) - Transposed in Spanish General Law for Defence of Consumers (LGDCU)
Art 5 UCPD prohibits misleading and aggressive practices. Spanish consumer law allows class actions.

D. DMA - Digital Markets Act - For Gatekeepers
DMA Art 13(6) prohibits gatekeepers (Meta, Google, Amazon, Booking) from using dark patterns to prevent users exercising choices.

E. Upcoming - EU Digital Fairness Act (DFA) - Expected Proposal 2026
European Commission Fitness Check Oct 2024 concluded existing law insufficient for collective effects. DFA will specifically target:

• Addictive design, infinite scroll
• Subscription traps - easy cancellation mandatory
• Influencer dark patterns
• Personalised choice architecture

Spanish firm LetsLaw noted: businesses may face coordinated litigation strategies under DFA.

3. Case Laws & Enforcement - Spain & EU Relevant to Spain

1. EU Commission vs X (Twitter) - July 2024 - First DSA Dark Patterns Case
Commission sent preliminary findings: X's blue checkmark design is deceptive (anyone can pay, implies verified), advertising transparency repository incomplete, dark patterns in ad disclosure. This is first use of Article 25. Directly affects Spanish users.

2. EU Commission vs TikTok & Meta - 2024-2025 - Addictive Design
Commission opened proceedings against TikTok Lite for addictive reward programme that encourages compulsive use, and against Meta for addictive infinite scroll. AEPD stated it will collaborate with CNMC on these cases, focusing on physical and psychological integrity of children.

3. Spain - Meta Ordered to Pay €479 Million to Press (2024) - Unfair Competition & Data Dark Patterns
Spanish court ordered Meta to pay Spanish press for unfair competition. Court accepted CNMC's study on online advertising competition, finding Meta earned €5.28B in Spain between May 2018 - Aug 2023 without valid legal basis for data processing for segmentation. Court found lack of transparent consent architecture = unfair competition.

4. Spain - CNMC vs Booking.com - July 2024 - €413 Million Fine
CNMC fined Booking.com €413M for abuse of dominant position including dark patterns: self-preferencing, making its own offers more prominent, obstructing choice architecture for hotels. Largest CNMC fine ever. Upheld under DMA principles.

5. Spain - AGL vs Meta / Emma Shapiro Case - 2024-2025 - DSA Complaint Before CNMC
Avant-Garde Lawyers filed complaint with CNMC on behalf of artist Emma Shapiro after Meta deleted her Instagram account Exposure Therapy. Complaint asserts Meta failed DSA obligations Art 17 (statement of reasons), Art 20 (internal complaint), Art 21 (out-of-court). Case tests whether termination of entire account + loss of archive/audience violates fair choice architecture. Pending before CNMC as of 2025.

6. AEPD Fines - Cookie Wall Cases Spain - 2022-2024
AEPD fined Google €10M, and multiple Spanish e-commerce sites for cookie banner dark patterns: Accept all in bright color, Reject hidden in second layer. Established in Spain that equal prominence required.

7. EU - Amazon Buy Box Case & Italian AGCM vs Amazon
Italian authority fined Amazon for dark pattern in Buy Box selection algorithm - obscuring choice. Used as precedent by CNMC.

4. Spanish Compliance Checklist for Choice Architecture

If you operate app/website targeting Spanish users:

1. DSA Art 25 Audit: No pre-ticked boxes, reject = same clicks/color as accept, no visual interference
2. Subscription: Cancel button must be as easy as subscribe - one-click unsubscribe mandated under upcoming DFA, already required by Spanish draft law
3. CNMC Reporting: Must have internal complaint mechanism under DSA Art 20, in Spanish
4. AEPD Consent: Consent must be granular, not bundled
5. Minors: No addictive patterns for under-18 - AEPD active enforcement

Penalty in Spain currently: CNMC can impose up to 6% global turnover under DSA + LGDCU fines up to €1M or 4% turnover for consumer law breaches.

Spain is pushing domestic measures alongside DFA - Osborne Clarke advisory Oct 2025 notes Spanish regulators advise businesses to start auditing UX for dark patterns now.