In March 2026, the CMA opened five new consumer protection investigations into fake and misleading online reviews, targeting businesses across sectors (see our summary and analysis here). The CMA indicated at the time that it would provide an update on all five cases in September 2026, and today it has done so (you can read the press releases Autotrader, Dignity, Feefo, Just Eat and Pasta Evangelists).
So, where do things stand, and what lessons can be drawn from six months of enforcement activity under the DMCCA?
What has changed since March?
The investigations themselves remain at the evidence-gathering stage — no Provisional Infringement Notices have been issued and no settlements announced. But the CMA has not been idle since March. Its enforcement activity in parallel cases gives a much clearer picture of how the DMCCA regime operates in practice — and what respondents in the reviews cases can expect.
Lessons from Parallel Enforcement
- The penalty methodology is now visible — and escalating. The Marks Electrical and StubHub UK cases in June 2026 (see our summary and analysis here) gave the first real picture of how the CMA calculates penalties under the DMCCA. Both cases moved from investigation to Final Infringement Notice in approximately seven months — a pace that should focus minds. What matters most for new and future cases is the forward trajectory: penalties in this relatively early period are necessarily lower because infringement durations can only be counted from 6 April 2025. As the regime matures and those windows widen, the proportionality reductions that brought Marks Electrical’s headline figure down by 94% should not be expected at anything like the same scale.
- The regime’s first-year scorecard is striking. The CMA’s “one year on” blog post in April 2026 recorded 14 businesses under investigation, two settlements concluded, £4.7 million in fines imposed, £760,000 in consumer refunds ordered, 157 advisory and warning letters issued, and 46 information notices sent — all within the first 12 months. These activities and numbers confirm that the DMCCA’s direct enforcement regime is far from a theoretical power — it is being deployed at speed and at scale.
- Consumer redress is a recurring theme. As with Marks Electrical and StubHub, any settlement or infringement finding in the reviews cases is likely to include mandatory consumer refunds — a point that businesses under investigation should be factoring into their contingency planning now.
- Year-two priorities have been articulated. In its year-one review of the new enforcement regime, the CMA identified fake reviews as a continuing priority alongside drip pricing, unfair contract terms (particularly exit fees), subscription contracts (with new rules expected in January 2027 — see our DMCCA Tracker), and AI — including the responsible use of agentic AI. The overall picture is one of a regulator with a clear and expanding set of priorities, and the resources and willingness to act on them.
Fresh takeaways for businesses
With the benefit of six further months of enforcement activity, there are additional observations that we can draw.
- The procurement and supply chain issue. Autotrader and Feefo are both under investigation for the same conduct — the suppression of 1-star reviews on Autotrader’s platform, moderated by Feefo — suggesting that the CMA considers the publisher and the moderator each independently liable. For any organisation that procures review aggregation, moderation or display services from a third party, the practical implications are clear. Contracts with review intermediaries should expressly allocate compliance responsibilities, require adherence to the CMA’s published guidance, and include audit, reporting and indemnity mechanisms. Procurement teams should not assume that outsourcing review management means outsourcing regulatory risk. More broadly, supplier and vendor claims based on review scores or star ratings should be treated with greater scepticism in due diligence and tender evaluations — particularly in sectors where the CMA’s enforcement activity is concentrated.
- Culpability and management involvement. The Marks Electrical case showed that the CMA will place businesses in the “high culpability” category where senior management was involved in decisions about the infringing practice. Businesses should not expect ignorance of the law to provide mitigation, especially where the CMA has published relevant guidance — as it has, extensively, on all of the issues indicated as its enforcement priorities (save only in the case of the incoming subscription rules, guidance on which is still awaited).
- The settlement incentive is real. Both Marks Electrical and StubHub received a 40% settlement discount. With the CMA’s turnover-based starting points generating significant headline figures — even before proportionality adjustments — early engagement and settlement will be a key strategy for respondents. The seven-month timeline from case opening to Final Infringement Notice in those cases suggests that the window for settlement discussions is relatively compressed.
Looking ahead
The key question for this batch of investigations remains whether the CMA will move to issue Provisional Infringement Notices — the formal step that sets out the CMA’s concerns and gives businesses the opportunity to respond — or whether any cases will be closed. Given the pace demonstrated in earlier cases, it is not inconceivable that some of the reviews cases could reach a similar stage before the end of 2026.
In the meantime, the message for businesses is the same as it was in March, only louder: review practices against the CMA’s published guidance, ensure contracts with review intermediaries allocate compliance risk appropriately, and prepare for a regime that is delivering real consequences at real speed.
If you would like to discuss any of these developments or review your compliance position, please contact Claire Livingstone.