UK eCommerce Development 2026: What the DMCC Act Means for Your Checkout, Reviews and Subscriptions

In March 2026 the Competition and Markets Authority opened five investigations into fake and misleading reviews, across funerals, food delivery and car sales.

That is the detail worth registering. The DMCC Act's consumer provisions came into force on 6 April 2025, and for the first year most commentary treated them as a compliance exercise for legal teams. Five live investigations make it something else: an active enforcement priority with real subjects.

The CMA can now enforce consumer law directly, without going to court, and impose fines of up to 10 percent of global annual turnover or £300,000, whichever is higher.

Here is the part that concerns engineering. When the CMA investigates, it does not primarily read your policies. Enforcement activity involves test purchases — mystery shopping through checkout and subscription journeys — requests for internal evidence including pricing logic, A/B test records and consumer journey designs, and audits of review systems covering moderation logs, fraud detection and incentive programme design.

That is a list of engineering artefacts. Your pricing service, your experiment platform, your review moderation pipeline. Compliance here is a property of your systems, not a document your legal team files.

This guide covers what is in force, what is coming and when, and what each obligation means in code.

This is an engineering guide, not legal advice. Confirm every position with qualified counsel before it drives a build or a commercial decision.

What is in force, and what is delayed

The subscription timeline has moved twice. The Department for Business and Trade previously indicated "not before spring 2026" while it consulted on the secondary legislation and accompanying guidance. It has since confirmed to consultation respondents that implementation will not commence until autumn 2026 at the earliest, with the practical effect for many businesses landing in 2027.

Do not read the delay as permission to wait. Redesigning sign-up flows, cancellation journeys and renewal communications takes months, and the businesses most exposed are precisely those relying on hard-to-cancel subscriptions — which is what the regime exists to end. A business that starts when the commencement date is confirmed will be rebuilding its highest-converting flows under time pressure.

The DMCC Act also updates and replaces the Consumer Protection from Unfair Trading Regulations 2008, retaining much of their scope and existing legal tests. It is not a wholly new framework, but it is materially more prescriptive and considerably better enforced.

What the CMA actually audits

Worth restating because it changes what you build.

Test purchases. Mystery shopping through your checkout and subscription journeys. Whatever a real user experiences is what gets assessed — not what your specification says they experience. If a fee appears at step four for users in a particular experiment variant, that is what will be found.

Pricing logic and A/B test records. Requests for internal evidence covering how prices are calculated and displayed, and what you tested. This is a genuine surprise to most engineering teams: your experimentation platform is now a compliance surface. An A/B test that varied when delivery cost appeared is a documented record of you testing a practice.

Review system audits. Moderation logs, fraud detection, and incentive programme design. Not your review policy — your moderation pipeline and what it caught.

Consumer journey designs. How the flow was constructed and why.

Note the CMA's stated posture: it is not targeting businesses that are taking steps toward compliance and not quite getting it right. It is targeting those making minimal effort or with a history of non-compliance. That distinction rewards demonstrable effort — which again is an engineering artefact rather than an intention.

Drip pricing is a pricing service problem

The obligation: traders must clearly set out the total price of the product, including any fees, taxes, delivery charges or other payments the consumer will incur, upfront in adverts and online product listings.

What this means to build:

A single price calculation, used everywhere. The most common architectural cause of drip pricing is not intent — it is a listing page that renders a base price from the catalogue service while the true total is only assembled by the basket service at checkout. Two services, two answers, and the gap is the violation. Consolidate to one pricing service that returns a displayable total, and have every surface call it.

Mandatory charges resolved at listing time. Anything the consumer will unavoidably incur must be in the displayed price. Where delivery genuinely varies by destination, the engineering answer is usually a resolved default with a clear basis, not an omission with a footnote.

Marketplace and third-party seller pricing. If sellers set their own fees, your platform is displaying the price. Validation belongs at the point sellers configure pricing, not at the point a regulator asks.

Currency, tax and locale. Multi-currency stores and cross-border VAT handling multiply the surfaces where a total can diverge. One calculation, many renderings.

A pricing audit trail. What was displayed, to whom, when, and under which experiment variant. Covered further below, because it applies across all three obligations.

This is one of the reasons we structure eCommerce development engagements around the pricing and integration layer rather than the storefront. Storefronts are rarely where commerce projects fail. Pricing, inventory synchronisation, tax logic and payment reconciliation are — and they are now also where the regulatory exposure sits.

Fake reviews and the duty to take steps

Three distinct obligations, frequently collapsed into one.

A prohibition on commissioning or submitting fake reviews. Straightforward, and unlikely to be your problem if you are running a legitimate business.

Mandatory disclosure of incentivised reviews. If a customer received an incentive for writing or submitting a review, that must be clearly disclosed. This is a data model question: does your review record store whether an incentive was given, and does the display layer surface it?

A positive duty to take reasonable and proportionate steps. This is the one that requires building. Traders must take reasonable and proportionate steps to prevent consumers encountering fake reviews on their platforms, and to prevent the presentation of other information that is determined or influenced by false reviews. The regulations go further still, requiring traders to take steps to verify whether published reviews are genuine.

What this means to build:

A moderation pipeline with retained logs. Automated detection plus human review, with a record of what was flagged, what was actioned, and what was allowed through. The log is the evidence that you took steps. A pipeline without retained logs demonstrates nothing.

Verification signals. Verified-purchase linkage, account age, submission velocity, device and network signals, textual similarity clustering. None of these is individually conclusive; together they constitute reasonable steps.

Derived-data awareness. The obligation extends to information influenced by false reviews. Your aggregate star rating, your "top rated" sort, your recommendation model — if a fake review fed those, the derived output is in scope. Practically: when you remove a review, does everything computed from it recompute? Most systems do not, and that is a real gap.

Incentive disclosure in the data model. Store the incentive flag at submission, not as an afterthought.

Proportionality is genuine. A small retailer is not expected to run the moderation stack of a large marketplace. "Reasonable and proportionate" scales to your size and risk. But it does not scale to zero, and the CMA's five March 2026 investigations indicate it is being tested.

Subscriptions: delayed, build anyway

The regime is expected to require clearer pre-contract information, easier informed consent, reminders before auto-renewal, and straightforward cancellation — online where the contract was entered into online, without unreasonable steps.

Detail will come through secondary legislation, so specifics may shift. But the direction is settled, and the engineering work is knowable now.

What to build ahead of commencement:

A cancellation path that mirrors the sign-up path. If a user subscribed in four clicks online, they should be able to cancel comparably. Retention flows that add friction — mandatory phone calls, multi-step confirmations, offers that must be declined individually — are exactly the target.

Renewal notification as a scheduled system event. Fired from the subscription record, logged, with delivery confirmation. Not a marketing email campaign that someone maintains.

Pre-contract information rendered from the subscription terms themselves. Price, frequency, minimum term, renewal behaviour, cancellation route — generated from the same data that governs billing, so the two cannot diverge.

Consent captured with what was shown. The record needs to include the terms presented at the moment of consent, not merely a timestamp and a boolean.

Why build now: the flows involved are usually a business's most conversion-optimised, and rebuilding them is a commercial decision as much as a technical one. Doing that deliberately over two quarters is materially cheaper than doing it against a commencement deadline.

Evidence architecture

The pattern running through all three obligations, and the same pattern we keep finding across UK regulation.

Every obligation here reduces to: can you demonstrate, later, what a specific consumer actually saw and why?

The components:

Immutable display logging. What price, what reviews, what terms — rendered to which user, when, under which experiment variant and which configuration.

Experiment records tied to display state. Your A/B platform needs to be queryable against a specific user's specific session. "Which variant was this user in on 3 March, and what did that variant display?" must be answerable.

Configuration versioning. Pricing rules, moderation thresholds, subscription terms — versioned with effective dates, so a decision can be assessed against the rules that were live at the time rather than today's.

Retention aligned to enforcement horizons. Investigations look backwards. Logs rotated at 30 days are logs you do not have when it matters, weighed against data minimisation obligations under UK data protection law — which itself changed materially in 2026, as we cover in our UK data protection guide.

This is the same architecture UK financial services regulation now demands, for the same reason. We cover the parallel in our London fintech development guide. UK regulators across sectors have converged on requiring demonstrable outcomes rather than documented intentions, and systems built for evidence satisfy several regimes at once.

Platform implications

The recurring finding across audits: plugins and apps are where compliance breaks. A store built compliantly and then extended with six apps over two years is frequently non-compliant in ways nobody chose. Inventory your extensions and check what each one does to price display and review handling.

Where UK eCommerce engineering talent sits

Relevant to how you resource this.

Manchester is the deepest UK market for commerce engineering at scale outside London. The city's large online retail employers built teams that operated at genuine volume — peak trading, inventory synchronisation, payment reconciliation, warehouse integration — and a period of contraction among those employers has made that experience unusually available. Median developer rates there run around £464 against London medians tracked near £775.

For a business that needs engineers who have actually handled Black Friday traffic and multi-warehouse inventory rather than built brochure stores, that is the strongest value-to-experience ratio in the UK right now. We cover the regional picture in our Manchester software development guide, and rates across the country in our UK developer day rate index.

Cost, timeline and team shape

The retrofit band is the one most UK retailers need, and the one most likely to be underestimated — because the work is rarely visible in the storefront and therefore rarely prioritised.

Team additions specific to this work:

The last row again. Someone must translate between counsel and engineers continuously — it is the role most often cut and most reliably regretted.

Six ways eCommerce builds get this wrong

1. Two sources of price truth. Catalogue service and basket service disagree. The single most common cause of drip pricing, and almost never intentional.

2. Review moderation without logs. Detection running, nothing retained. You took steps and cannot demonstrate it, which for evidentiary purposes is close to not taking them.

3. Derived data not recomputed on removal. Fake review deleted, aggregate rating unchanged, "top rated" sort still influenced. The obligation covers information influenced by false reviews.

4. Plugin drift. A compliant store extended into non-compliance over eighteen months, one app at a time.

5. Waiting for the subscription commencement date. The flows involved are your most conversion-critical. Rebuilding them under deadline pressure is the expensive way.

6. Treating this as a legal deliverable. The CMA asks for pricing logic, A/B test records and moderation logs. Those are produced by systems, not by policies. A business with excellent documentation and no evidence architecture is in a worse position than the reverse.

Frequently asked questions

What does the DMCC Act require for eCommerce pricing? Traders must clearly set out the total price of a product upfront in adverts and online product listings, including any fees, taxes, delivery charges or other payments the consumer will unavoidably incur. This prohibition on drip pricing has been in force since 6 April 2025.

When do the DMCC subscription contract rules come into force? Later than originally indicated. The Department for Business and Trade has confirmed implementation will not commence until autumn 2026 at the earliest, having previously signalled "not before spring 2026", with practical effect for many businesses in 2027. Detail is being settled through secondary legislation.

What are the penalties for breaching the DMCC Act? The CMA can enforce consumer law directly without going to court and impose fines of up to 10 percent of global annual turnover or £300,000, whichever is higher, with additional penalties for non-compliance with enforcement measures.

What do the fake review rules require online retailers to do? Three things: not to commission or submit fake reviews, to clearly disclose where a review was incentivised, and to take reasonable and proportionate steps to prevent consumers encountering fake reviews — including steps to verify whether published reviews are genuine. The obligation extends to information influenced by false reviews, such as aggregate ratings and rankings.

Is the CMA actually enforcing this? Yes. In March 2026 the CMA opened five investigations into fake and misleading reviews across the funerals, food delivery and car sales sectors. The CMA has indicated it is targeting businesses making minimal compliance effort or with a history of non-compliance, rather than those taking genuine steps and getting details wrong.

What evidence will the CMA ask for? Enforcement activity can involve test purchases through checkout and subscription journeys, requests for internal evidence including pricing logic, A/B test records and consumer journey designs, and audits of review systems covering moderation logs, fraud detection and incentive programme design.

Does this apply to small online retailers? Yes. The consumer protection rules apply to any business selling goods, services or digital content to consumers regardless of size. The "reasonable and proportionate" standard for review verification scales with business size and risk, but it does not reduce to no action at all.

How much does DMCC compliance work cost? A compliance retrofit on an existing store typically runs £25k to £80k over six to twelve weeks. Pricing service consolidation runs £50k to £150k. A review moderation and verification pipeline runs £40k to £120k. Costs depend heavily on how many sources of pricing truth the existing system has.

Which eCommerce platform is easiest to make compliant? Managed platforms like Shopify control more of the price display path, but third-party apps can reintroduce drip pricing, so the app stack needs auditing. Custom and headless builds are best positioned if a single pricing service was designed in, and worst if not. Marketplace models carry the highest exposure because you display third-party pricing and host third-party reviews.

The short version

The DMCC Act's consumer provisions have been live since April 2025 and are now being actively enforced. The subscription regime is delayed to autumn 2026 at the earliest, which is time to use rather than time to wait.

Three things worth doing this quarter.

Audit for multiple sources of price truth. If your listing page and your basket calculate independently, fix that before anything else.

Check that your review moderation retains logs, and that removing a review recomputes everything derived from it. Most systems fail the second test.

Start the subscription flow work now. Those are your most conversion-optimised journeys, and rebuilding them deliberately costs far less than rebuilding them against a deadline.

The structural point: the CMA asks for pricing logic, experiment records and moderation logs. Compliance here is something your systems either demonstrate or do not.

For More Refer -

GOV.UK — Digital Markets, Competition and Consumers Act

About Akoode Technologies

Akoode Technologies is an AI and software development company headquartered in Gurugram, India, with a US office in Oklahoma, working with clients across the UK, USA and India. We build eCommerce platforms, custom software, AI and machine learning systems and mobile applications for startups, SMEs and enterprises across 15+ industries, with 180+ projects delivered globally and clients across the UK, including London and Manchester.

Verified ratings: 4.9 out of 5 on Google across 110 client reviews, and 5.0 out of 5 on GoodFirms.

If you want an honest read on where your store sits against the DMCC provisions, book a call. The pricing audit is usually a short piece of work and it is the one that matters most.

This article is an engineering guide, not legal advice. Regulatory positions reflect published guidance and legal commentary as of August 2026. The subscription contracts regime remains subject to secondary legislation and its commencement date may change. Confirm all positions with qualified counsel before they drive build or commercial decisions. Cost bands are indicative planning figures, not quotations.