It's been about a year since new rules came into force that changed what's legally acceptable on a UK business website. They cover two things: fake reviews and something called online choice architecture. Plenty of SME owners still haven't heard of either - or haven't had a chance to check whether their site is compliant.
This is a good moment to do that. The enforcement grace period is long gone, and the regulator has been actively reviewing sites since mid-2025.
A quick recap: what changed and when?
The Digital Markets, Competition and Consumers Act 2024 (DMCC Act) brought in a raft of new consumer protections, most of which came into force on 6 April 2025. The body enforcing them is the Competition and Markets Authority (CMA), which for the first time can issue fines directly without going to court. We're talking up to 10% of global annual turnover for serious breaches. That's not a small number.
The CMA gave businesses a few months' leeway to get their houses in order. That window closed in July 2025. Since then, it has been reviewing websites and contacting businesses it believes aren't compliant. A year in, there's no real excuse for not having looked at this.
The two areas most likely to catch SMEs out are fake reviews and what the CMA calls "online choice architecture" - a formal way of describing how your website is designed to guide people's decisions.
The fake reviews rules
This one's broader than most people realise. It's not just about dodgy businesses buying five-star reviews on Fiverr. The rules catch a wider range of behaviour, including things that feel fairly routine.
Under the new law, it's now illegal to:
- Post or pay someone to post a fake review
- Offer a freebie or discount in exchange for a review without disclosing it
- Selectively display only positive reviews while hiding negative ones
- Use a third-party review platform that does any of the above - even if you didn't set it up yourself
That last point is important. If you've embedded a reviews widget on your site and it's quietly filtering out the low scores, you're responsible for that. "We just use a plugin" isn't a defence.
The practical fix is straightforward. Have a clear, written policy about how you handle reviews. Don't suppress negatives. If you ever offer an incentive for a review - even a small one - disclose it clearly.
Online choice architecture - and why it matters to you
Online choice architecture (OCA) is just a fancy name for how your website is designed to influence decisions. Every button placement, default tick box, and pop-up is a form of it. Most of it is perfectly fine. Some of it isn't.
The term "dark patterns" gets used a lot in this area. These are design choices that push users into doing things they didn't actually intend to do. You'll have seen them everywhere, probably without noticing.
Here are some real examples:
- Drip pricing - showing a low price early in the process, then adding fees at checkout. Two ticketing sites are currently under CMA investigation for exactly this.
- Fake urgency - countdown timers or "only 2 left!" messages that aren't accurate. Deals site Wowcher had to make formal commitments to the CMA to stop using timers that reset when they ran out.
- Pre-ticked boxes - optional extras added to a basket or form by default, relying on people not noticing.
- Confusing cookie banners - where "Accept All" is a big green button and "Reject" requires three more clicks and a scroll.
- Confirm-shaming - those opt-out buttons written to make you feel a bit stupid for clicking them. "No thanks, I don't want to save money" - that sort of thing.
Some of these will have come with a plugin or theme you installed years ago and never thought about since. That doesn't make them compliant.
What should you actually do?
You don't need to overhaul your whole site. Start with these checks:
- Walk through your checkout or enquiry process end to end. Look for fees that appear late, anything pre-ticked, and any urgency messaging.
- Check that any countdown timers or scarcity claims are genuine and accurate.
- If you display reviews, make sure you're showing a fair picture - not just the good ones.
- Write a short policy on how you handle reviews and where users can see it.
- Check your cookie consent banner. Rejecting cookies should be as easy as accepting them.
If you're not sure where to start, ask your web developer to do a quick audit. Most of these issues are easy to fix once you know they're there.
Where things stand now
A year in, the CMA has moved from education mode to active enforcement. It's been reviewing websites, contacting non-compliant businesses, and has already launched investigations into several companies over drip pricing and pressure tactics. The "we didn't know" defence gets thinner by the month.
The thing is, beyond the legal side, honest design just works better. A website that's straightforward and transparent tends to convert better and hold on to customers longer. Trust is hard to build and easy to lose. Tricks might nudge a few extra conversions in the short term, but they're not a strategy.
If you'd like a fresh pair of eyes on your site to check for any of this, we're happy to take a look. Just get in touch.