Imagine you're comparing mortgages online. You click through a slick calculator, find a monthly payment that looks reasonable, and before you know it you've ticked a box for an advisory appointment you never wanted. Or you've opened a savings account and weeks later discover that cancelling is surprisingly complicated. The cancel button is there — but it's small, grey, and buried at the bottom of the page.
Sound familiar? These are dark patterns — and the EU has had enough.
TL;DR The dark patterns ban takes effect on June 19, 2026, along with a mandatory cancel button for all websites offering financial services online. This concerns EU Directive 2023/2673, also known as the Distance Marketing of Consumer Financial Services Directive. It affects everyone who sells or brokers financial products online: from large banks to comparison platforms. Consumers gain more rights, more protection, and more clarity. For businesses, it means: adapt or risk enforcement action.
What is Directive 2023/2673 and why is it coming now?
On 22 November 2023, the European Parliament adopted a new directive: Directive (EU) 2023/2673, also known as the Distance Marketing of Consumer Financial Services Directive.¹
The directive replaces an old law from 2002. That law was designed for an internet era that looks very different today. In 2002, concepts like buying a television on your smartphone using buy now, pay later were unimaginable. Article 10 of the old directive even referenced a consumer's consent to use a fax for distance communication.²
Yes, a fax. From 2002. Which was still in force.
Given the rapid growth of financial services concluded at a distance — online or by phone — the new directive adds an entirely new chapter of rules for such contracts.³
The new directive introduces three major changes. I'll walk through each one.
1. The dark patterns ban: misleading websites will be prohibited
Dark patterns are the invisible manipulations in website design. They're not necessarily illegal in the sense of appearing on a blacklist, but they subtly steer you toward choices you never really wanted to make.
Think of a button "Yes, I want the insurance" displayed large and blue, while "No, thanks" appears small and grey. Or a countdown clock that artificially creates urgency. Or a pre-ticked checkbox for an additional service you don't need at all.
A joint investigation by European consumer authorities — including the Dutch ACM — across 399 commercial websites found that 148 sites used at least one dark pattern. 42 sites had fake countdown timers, and 54 steered consumers toward more expensive products.⁴
These aren't shady fringe players. These are ordinary webshops and platforms that form part of everyday digital life.
The new directive requires member states to introduce measures that limit the use of dark-pattern sales techniques: interfaces that nudge users into doing something they didn't intend, in order to influence consumer choices.⁵
Concretely, this means that financial services websites can no longer design their interface in a misleading way. A trader may not configure their online interface — such as a website or app — in a deceptive manner.⁶
What exactly qualifies as deceptive will be further specified in national implementation. But the direction is clear: you must help consumers make an informed choice, not circumvent it.
2. The cancel button becomes mandatory: click to cancel from 2026
This is the provision that popular culture has dubbed "click to cancel." Traders are required to place a digital cancellation function on their website. This must ensure that consumers can cancel a contract as easily as they entered into it.⁷
The idea is simple: if you can sign up for something online in three clicks, it should not be possible for cancellation to involve a twenty-minute phone odyssey with three transfers and an agent asking whether you're really sure.
The directive stipulates that a trader must offer consumers the ability to use a cancellation function to exercise their right of withdrawal, when the contract was concluded via an online interface such as a website or application.⁸
And this obligation extends beyond financial services alone. The withdrawal function is designed to make consumers more aware of their right and to simplify how they can exercise it. It applies not only to distance contracts for financial services, but to all distance contracts.⁹
If you can enter a contract through a website, you must be able to exit it through that same website. Full stop.
3. Better consumer rights: more transparency and the right to a human
The directive also includes updated information requirements. Before you sign anything, you must be given sufficient time and information to understand what you're agreeing to. Not a 47-page PDF in small print, but clear, timely information.
The new directive also grants consumers the right to request human intervention on websites that use automated information tools.¹⁰
This matters in a world where chatbots are increasingly the first point of contact. If you're taking out a loan or considering a pension insurance policy and a chatbot is guiding you through the process, you have the right to say: I want to speak to a human being. And that option must actually be available.
The standard right of withdrawal is 14 calendar days. For individual pension products, an extended period of 30 days applies.¹¹
Who do the new rules for distance financial services apply to?
The directive targets everyone who offers financial services at a distance to consumers. That means banks, insurers, credit providers, mortgage lenders, and platforms that broker financial products.
Financial products exempt from the Financial Supervision Act (Wft) — including short-term credit like BNPL — must still comply with the distance-selling rules through a catch-all provision.¹²
That last point is significant. Buy Now Pay Later providers believed they were outside the scope of financial supervision. That may still be technically correct, but they can no longer sidestep consumer protection. The safety net covers them too.
What about online comparison sites? They are certainly in scope. If a financial product can be concluded through the interface of a comparison platform, the directive applies. The cancellation function, the ban on dark patterns, the information requirements: all of it applies.
Does this apply to every business, including SMEs?
A frequently asked question: does this only apply to large players, or also to the small entrepreneur offering a financial product online?
The answer is clear. There is no minimum threshold in terms of revenue or headcount. The directive applies to every business that concludes distance contracts with consumers — including online or by phone.
The directive offers traders legal certainty and transparency, with micro, small, and medium-sized enterprises explicitly included. They are not exempt.¹³
Under the Dutch implementation, the new rules fall under general consumer law. An estimated 99,990 regular traders and over 6,100 financial service providers and investment firms are bound by the rules.¹⁴
Small businesses are given some flexibility. The European legislator encourages member states to take into account the specific needs and capacities of SMEs when enforcing the rules. But they are not exempted.
Do these rules also apply to crypto influencers on TikTok and Instagram?
An increasingly relevant question: do crypto influencers on TikTok, Instagram, or YouTube fall under these rules?
Yes. The European legislator explicitly acknowledges the trend of financial services being marketed on social media by influencers. And the rules apply there too.
The key issue is misleading omission. Anyone who promotes a financial product without pointing out the risks is acting in violation of the Unfair Commercial Practices Directive (2005/29/EC).¹⁵ For volatile crypto investments, this is particularly relevant. Omitting risk information is not a grey area — it is prohibited.
For crypto, the catch-all provision of the new directive also applies. Even when a specific crypto product falls outside the scope of sector-specific European legislation like MiCA, Directive 2023/2673 ensures that the fundamental consumer rights in online distance sales remain fully applicable.
One important exception for consumers to be aware of: the 14-day right of withdrawal generally does not apply to crypto assets. The law states that the cancellation function does not apply to financial products whose price depends on fluctuations in financial markets over which the trader has no control.¹⁶ If you buy crypto and see the price drop, you cannot reverse that purchase within 14 days at no cost.
When does it take effect? The deadline is June 19, 2026
The directive must be applied from June 19, 2026.¹⁷ That is less than three months away. Member states had until December 19, 2025 to have their national legislation in place, but in the Netherlands the implementation is proceeding through a separate bill that was still before the House of Representatives at the start of 2026.¹⁸
This means the exact national implementation details are not yet fully settled. But the European directive itself is binding, and the direction is clear.
What does the dark patterns ban mean in practice?
For consumers, this is good news. You gain more rights, better protection against deceptive design, and cancelling becomes considerably easier.
For businesses and platforms, it is a wake-up call. Anyone who has built their interface on the assumption that a complicated cancellation process keeps customers from leaving needs to rethink that model. And anyone using dark patterns as part of their conversion strategy is playing with fire. The Dutch Authority for Consumers and Markets (ACM) has announced stricter enforcement, and Dutch webshops are under a magnifying glass.¹⁹
I find this an interesting development, beyond the strict legal text. The directive is an acknowledgement of something everyone already knew but rarely said out loud: many digital interfaces are not built to help you, but to steer you. That is the real change happening here. Not the legal technicalities, but the recognition that trust must be earned digitally too.
Marc Diks writes weekly on AI, strategy, and digital transformation.
Footnotes
¹ Directive (EU) 2023/2673 of the European Parliament and of the Council of 22 November 2023. Full text: eur-lex.europa.eu (opent in nieuw venster)
² Directive 2002/65/EC, Article 10. Analysis: finnius.com (opent in nieuw venster)
³ EUR-Lex summary Directive (EU) 2023/2673: eur-lex.europa.eu (opent in nieuw venster)
⁴ ACM, "EU consumer authorities see widespread manipulation on websites", 2023: acm.nl (opent in nieuw venster)
⁵ EUR-Lex summary Directive (EU) 2023/2673, dark patterns section: eur-lex.europa.eu (opent in nieuw venster)
⁶ Implementation decision, Dutch Legislative Calendar: wetgevingskalender.overheid.nl (opent in nieuw venster)
⁷ Parliamentary document 36860, no. 3 — Explanatory Memorandum: officielebekendmakingen.nl (opent in nieuw venster)
⁸ House of Representatives, bill 36860: tweedekamer.nl (opent in nieuw venster)
⁹ Directive (EU) 2023/2673, recital on cancellation function: eur-lex.europa.eu (opent in nieuw venster)
¹⁰ Centre of Expertise on European Law, Ministry of Foreign Affairs: ecer.minbuza.nl (opent in nieuw venster)
¹¹ Projective Group Regulatory Update Q3 2025: banken.nl (opent in nieuw venster)
¹² Finnius Advocaten, catch-all provision for BNPL: finnius.com (opent in nieuw venster)
¹³ Directive (EU) 2023/2673, recital on SMEs: eur-lex.europa.eu (opent in nieuw venster)
¹⁴ Parliamentary document 36860, no. 3 — Explanatory Memorandum, business estimates: officielebekendmakingen.nl (opent in nieuw venster)
¹⁵ Directive 2005/29/EC of the European Parliament and of the Council of 11 May 2005 concerning unfair business-to-consumer commercial practices.
¹⁶ Directive (EU) 2023/2673, exceptions to the right of withdrawal: eur-lex.europa.eu (opent in nieuw venster)
¹⁷ EUR-Lex, application date June 19, 2026: eur-lex.europa.eu (opent in nieuw venster)
¹⁸ Senate, bill 36860: eerstekamer.nl (opent in nieuw venster)
¹⁹ ACM, announcement of stricter enforcement on dark patterns: acm.nl (opent in nieuw venster)