Addictive Design and Digital Platforms: When Engaging Users Crosses a Regulatory Line
Article written by the Spanish Data Protection Authority (AEPD) and the Spanish National Commission on Markets and Competition (CNMC).
Infinite scrolling? A constant stream of notifications? Uncannily persistent “Recommended for You” content? These features have become familiar to most users of digital platforms, which can encourage compulsive patterns of behaviour. This article explains what addictive design is and how European legislation is intended to protect your rights online.
Digital platforms are no longer simply designed to be useful or user-friendly. Many have become exceptionally effective at capturing and holding our attention, often by exploiting well-known psychological vulnerabilities.
The real concern is not that platforms are engaging; it is when engagement becomes the objective. Where design choices are intended to keep users scrolling, clicking or watching, rather than providing the best possible service, behavioural manipulation risks becoming a core element of the business model.
Photo by Christy Joseph Jacob on Unsplash.
The European Commission’s Initial Findings on Addictive Design
Against this backdrop, the European Commission has marked an important turning point by reaching the preliminary view that three Very Large Online Platforms ("VLOPs") rely on addictive design and have therefore infringed the Digital Services Act ("DSA").
The Commission's preliminary findings can be accessed here and here.
These investigations concern some of the world's largest social media platforms, particularly those that are especially popular among minors. According to the Commission, certain design features built into these services encourage compulsive patterns of use, make it more difficult for users to disengage, and reduce their ability to consciously manage the amount of time they spend on the platform.
In Spain, the National Commission on Markets and Competition (“CNMC”) acts as the national Digital Services Coordinator (“DSC”). Together with the Spanish Data Protection Agency (“AEPD”), which is responsible for matters relating to the protection of minors and advertising on online platforms, it oversees the proper application of the DSA in Spain.
Key Concepts
Addictive design describes a range of features, functionalities and design practices that are intended to encourage users to engage with a digital service for longer, more frequently or more intensively than they might otherwise choose under less persuasive conditions.
Such practices are often intended to maximise engagement metrics, increase the time users spend on a platform, facilitate data collection, support behavioural monetisation strategies or encourage user spending. In many cases, they rely on the exploitation of predictable behavioural biases.
Addictive design is a product of the modern “attention economy”, where user attention has become a valuable commercial asset. Platform features are increasingly designed not only to facilitate interaction, but also to sustain it, generating additional engagement, content creation and data flows. For that reason, the issue is not merely one of functionality or user experience. Design itself can become a means of influencing behaviour.
Importantly, the fact that a service is engaging does not give rise to concern. Digital services can legitimately seek to improve usability and user experience without raising regulatory issues. The position changes, however, where design choices begin to undermine users' ability to make independent and informed decisions, exploit particular vulnerabilities or hurdle natural exit points of the service.
Common examples include patterns such as pull-to-refresh, endless scrolling, autoplay, countdown timers, periodic rewards, information renewability and limited-time messages, push notifications and algorithmic recommendations. None of these techniques is necessarily unlawful alone. However, when combined, they can transform the digital experience into a dynamic that is geared more towards retaining the user than towards serving their interests or well-being.
Consequences for Users and Society
The implications are not limited to individual users; they also have broader social and economic consequences.
Addictive design can undermine users' ability to make autonomous decisions; increase the time they spend on a platform and encourage compulsive forms of consumption. It has also been associated with a range of risks, including sleep deprivation, anxiety, stress, difficulties with concentration, pressure to remain constantly connected, and adverse effects on both mental and physical health. These concerns are particularly acute in the case of children and teenagers.
From a market perspective, addictive design also raises questions of competition and fairness.
If capturing and retaining attention becomes the defining factor behind the success of the dominant business model, companies that adopt responsible approaches trying to respect users’ rigths may find themselves at a competitive disadvantage compared with businesses that aggressively optimise user retention and the monetisation of behaviour.
For that reason, the debate extends well beyond digital wellbeing. It also touches on consumer protection, transparency and the maintenance of fair competitive conditions within the platform economy.
Tackling Addictive Design under EU Law
From a data protection perspective, the incorporation of operations that implement addictive design patterns into personal data processing activities can have several implications. Under the General Data Protection Regulation ("GDPR"), addictive design may breach its foundational principles and requirements, including the lawfulness of processing — particularly where questions arise regarding the validity of consent or the processing of special categories of personal data — as well as fairness and transparency, purpose limitation, data minimisation, data protection by design and by default, and, more broadly, compliance with the accountability principle.
The Digital Markets Act ("DMA") is also relevant in this context. It imposes obligations on designated gatekeepers in relation to behavioural techniques, interface design practices and the combination or cross-use of personal data, all of which frequently underpin addictive design patterns.
The Artificial Intelligence Act ("AI Act") goes a step further by expressly prohibiting certain uses of AI systems with manipulative capabilities. In particular, it prohibits AI systems that deploy subliminal, manipulative or deceptive techniques capable of materially distorting the behaviour of an individual or group of individuals, impairing their ability to make informed decisions and leading them to take decisions that they would not otherwise have taken, where this may result in significant harm.
The AI Act also prohibits AI systems that exploit vulnerabilities linked to age, disability or a particular social or economic situation where such exploitation is capable of materially distorting the behaviour of an individual or vulnerable group and causing significant harm.
Taken together, these prohibitions prevent AI systems from being used to implement addictive design patterns in a real-time, automated and highly personalised manner.
Looking ahead, future legislative initiatives such as the proposed Digital Fairness Act ("DFA"), which remains at a preparatory stage, are expected to strengthen consumer protection against manipulative practices in digital environments. The initiative is expected to address addictive design, vulnerability-based personalisation and so-called dark patterns expressly, from the perspective of fairness in consumer relationships.
But let us return to the role of the DSA in addressing the risks arising from the design and operation of large online platforms. It is within this new regulatory framework that the European Commission has, in two decisions, provisionally concluded that certain features of the services provided by three major platforms, or VLOPs, could breach the DSA due to their addictive design. According to the Commission, functionalities such as endless scrolling, autoplay, push notifications and highly personalised recommender systems may encourage compulsive use, reduce users' capacity for self-control and steer them towards an almost automatic form of content consumption.
The Commission has also noted that the platforms under investigation had failed to adequately assess how these features might affect the physical and mental wellbeing of their users, including children and vulnerable adults. In particular, they had underestimated relevant indicators of compulsive use, such as time spent by children on the app at night, frequency with which the service is opened, or other potentially problematic usage patterns.
Furthermore, the Commission considers that existing mitigation measures, such as screen-time management tools and parental controls, appear insufficient. The former would be easily dismissed and would result in limited friction; the latter would require parents to devote additional time and expertise to configure them effectively.
Nor does the Commission consider the information published by two of the platforms to raise awareness of the negative effects of intensive use to be adequate. A separate page offering advice and links to mental health resources does not constitute an effective mitigation measure to counter the impacts of addictive design.
The Commission’s preliminary findings are crucial as they shift the focus from the individual user’s responsibility to the design of the service. This is not a matter of requiring users simply to self-regulate or protect themselves more effectively, but of ensuring that platforms do not design environments that structurally hinder such self-regulation.
What is Next?
The Commission's preliminary findings do not prejudge the outcome of the formal proceedings. The platforms under investigation may exercise their rights of defence, which allow them to access the case file and to submit observations in response to the Commission's preliminary findings.
From that point onward, the procedure may take various courses. The Commission may accept commitments if it considers that the proposed measures adequately address the risks identified. In that case, they would turn into binding commitments. In contrast, if the allegations or proposed measures are deemed insufficient, the Commission may adopt a formal infringement decision, impose a fine and require an action plan.
Fines may reach up to 6% of a company's worldwide annual turnover under the DSA. In practice, however, the most significant consequence may lie elsewhere. Beyond any financial sanction, the real impact may be the requirement to modify the service’s design— a possibility already hinted in both sets of preliminary findings. This could involve disabling or restricting certain functionalities, introducing meaningful screen-time interruptions, modifying recommender systems or strengthening safeguards for minors.
Therefore, the Commission’s action marks a milestone in the oversight of digital platform design. The message is clear: in Europe, the architecture of digital services is not beyond the reach of the law. When a platform’s design affects users’ autonomy, children’s welfare or public health, it ceases to be a mere business decision and becomes a regulatory issue of utmost importance.