What happened
The UK Competition and Markets Authority has fined three businesses a combined £6 million for misleading sales tactics, and ordered refunds of around £440,000 to customers. The penalties were announced on 14 October under consumer protection powers from the Digital Markets, Competition and Consumers Act.
Wayfair took the largest penalty at £4.8 million. Its website promoted products through Daily Deals and 24 hour Flash Deals, with countdown timers and messages such as Here Today, Gone Tomorrow, all implying a shopper had to act quickly. The CMA found many of those products stayed available at the same price or lower after the deadline. The offer was not real, and the pressure it applied was.
Appliances Direct was fined £1.2 million and ordered to refund around £432,000, an average of £25 per customer. Customers were automatically opted into paid extras, removal and recycling of the old appliance and installation on delivery, through pre-ticked boxes. Consumer law requires express agreement before charging for optional extras, so pre-ticked boxes are not permitted. The retailer also ran pop-up banners claiming discounts of £10 to £25 for a limited time, though the same codes appeared repeatedly over many days.
Gold's Gym was fined £45,000 and must refund £9,220 to 726 customers. Its failure was plainer: the mandatory joining fee was left out of the total membership price, or shown in a way that was easy to miss.
All three admitted breaking the law and settled early, which cut their fines by 40 percent. The CMA says it has imposed more than £12 million in fines and secured nearly £2.4 million in refunds in the last 18 months, using powers that allow penalties of up to 10 percent of global turnover.
Why this is a GRC story
None of this was a legal drafting failure. Every failure lived in a checkout flow, a product page or a price display, which means product teams shipped it and nobody with compliance knowledge reviewed it before launch. That is a change management gap, detectable by a test case as easily as by a lawyer.
Consent by default is a design decision. A pre-ticked box is chosen by someone building a form, usually to lift conversion. Turning it into an explicit choice is a two line change nobody made. If your review does not ask what the user agreed to, it is not reviewing the thing that gets fined.
The exposure is now material. Ten percent of global turnover gives a countdown timer the same weight as a serious data incident. Marketing claims belong in the risk register, owned by someone who can say no to a campaign.
Prevention is worth 40 percent. Early admission cut these fines substantially. An internal testing function that finds a fake deadline before the regulator does is cheaper than the discount it earns, and it avoids the refunds entirely.
What to watch
The CMA has investigations open across ticketing, gyms, homeware, online reviews and air travel, so this is a sweep rather than a one off. Expect more of the same arithmetic.
For anyone running a compliance programme, the takeaway is unglamorous. Pull your marketing claim templates, countdown components and default checkboxes, and ask three questions of each. Is it true, is it clear, did the customer agree. The regulator is asking exactly that, with a calculator.
Attribution: Analysis based on Competition and Markets Authority and related public reporting. This article is original commentary, not a repost of the source material.