The dynamic development of the computer games market has led to a significant change in the monetization models used by game producers and publishers. The traditional sales model, based on a one-time purchase of a product by the consumer, has been largely replaced by solutions based on long-term user engagement and generating revenue through micropayments (microtransactions). Mechanisms known as loot boxes, consisting in the paid purchase of virtual packages with random content.

Although initially perceived as a means of enhancing gameplay, this mechanism is currently the subject of intense legal, economic, and social debate. It is increasingly being pointed out that the design of loot boxes utilizes psychological mechanisms similar to those that have been present in traditional gambling games for many years. The random nature of the reward, the uncertainty of the outcome, the “near miss” effect, the limited availability of certain items, and the use of dynamic animations intended to enhance the user’s emotional engagement all contribute to the blurring of the line between entertainment and gambling mechanisms.

Additional controversy stems from the fact that the vast majority of modern games using loot boxes are also aimed at minors. Unlike traditional gambling games, participation in these mechanisms does not require a specific age or meeting specific formal requirements. In practice, this means that random monetization mechanisms are also used by children and adolescents, who, due to their stage of psychological development, are particularly susceptible to the influence of behavioral design techniques and so-called dark patterns).

In recent years, the issue of loot boxes has ceased to be analyzed solely through the prism of gambling law. Regulations concerning consumer protection, digital services, and child safety in the online environment are gaining increasing importance. Discussions at the European Union level indicate that the future legal framework may be based not only on classic definitions of games of chance but also on instruments to combat manipulative practices and ensure a high level of protection for consumers using digital services.

At the national level, the problem remains equally relevant. Polish lawmakers have not yet decided to introduce a separate definition of loot boxes into the Gambling Act of 19 November 2009. This does not mean, however, that these mechanisms remain entirely outside the scope of existing regulations. In practice, administrative bodies assess each specific business model on a case-by-case basis, analyzing whether its design meets the statutory definition of gambling. At the same time, the development of the secondary market for trading in virtual items, particularly so-called skin gambling , is creating new interpretative challenges that the legislature did not anticipate when enacting the current regulations.

The changes introduced by the PEGI rating system in 2026 provided an additional impetus for reassessing the current regulations. The revised rules for classifying games with paid random mechanisms confirm the growing awareness of the risks associated with the use of loot boxes, especially for underage users. Although the PEGI rating is not a source of generally applicable law, its practical importance for the European market remains significant and may influence both the distribution of games and the future direction of legislative changes.

The purpose of this article is to analyze the current legal status of loot boxes under Polish and European Union law, taking into account recent regulatory changes, the practices of administrative bodies, and the experiences of selected European countries. Particular attention will be paid to whether the current regulations effectively protect consumers from mechanisms based on randomness and whether the current regulatory model meets the challenges of the modern digital economy.

The essence of loot boxes and their functioning models

The concept of a lootbox has not yet been defined in either Polish or European Union law. However, in the literature and by public institutions, it is generally accepted that a lootbox is a mechanism whereby the user obtains, for a fee or free of charge, a virtual package containing items whose contents remain unknown until opened. A characteristic element of this solution is randomness – the user has no influence on the item they receive, and the probability of obtaining individual rewards is determined by the game developer or platform operator.

At the definitional level, however, it should be emphasized that the term “lootbox” encompasses a wide variety of business models, the legal assessment of which cannot be uniform. Public debate often equates all mechanisms based on randomness with gambling, while from a legal perspective, individual solutions differ in both their economic structure and the degree of risk to the consumer. It is precisely this diversity that means that assessing the compliance of lootboxes with applicable regulations requires an analysis of the specific operational model, not just the presence of a random element.

The most classic model occurs in games where lootbox content is limited solely to cosmetic items, such as skins , animations, character outfits, or visual effects. These items do not affect gameplay or increase the player’s chances of success. They are intended solely for aesthetic purposes, allowing the user to personalize the appearance of their character or equipment. Such solutions were long considered relatively safe from a consumer protection perspective, but the development of secondary markets for trading virtual items has significantly changed their economic significance.

A good example is the Counter-Strike series, where weapon skins initially served only a visual purpose. Over time, however, a robust secondary market developed around these items, allowing them to be sold for real money. Consequently, the value of some virtual items began to reach several thousand, or even several dozen thousand, and in exceptional cases, several hundred thousand euros. In practice, this means that a randomly acquired item can have a tangible financial value, even though the game developer itself does not officially allow for its sale. The existence of an external market is one of the main arguments raised in the discussion on the classification of such mechanisms as potentially akin to gambling.

Loot boxes used in sports games, such as EA SPORTS FC Ultimate Team, are of a different nature. In this model, users purchase virtual packs containing player cards, coaches, or other team items. Unlike skins in games like Counter-Strike, acquired items directly impact gameplay. Acquiring rare players can increase a team’s competitiveness and improve player performance. Although the developer publishes information regarding the probability of receiving rewards in a given category, the user still doesn’t know the contents of a specific pack at the time of purchase, and the decision to purchase is based on a random mechanism.

Yet another model is found in so-called gacha games, extremely popular, especially in Asian markets and in the mobile gaming segment. This mechanism is based on randomization of characters, equipment, or other items necessary for further progression in the game. A characteristic feature of gacha systems is their close connection to long-term user monetization. Players are encouraged to repeatedly make micropayments to obtain exceptionally rare characters or items, the probability of obtaining which can be extremely low. The literature indicates that these solutions most fully utilize the mechanisms of behavioral economics and the psychology of addiction.

However, the most controversial are third-party platforms that enable the trading of virtual items and participation in games of chance that use items from video games as a form of currency. These services operate independently of game developers, leveraging the existing market for skins or other digital goods to organize mechanisms reminiscent of classic casino games. Users deposit funds or use their virtual items to participate in lotteries, roulette, duels, or other games based on chance. Unlike traditional loot boxes offered by game producers, the participant’s goal is not only to obtain a specific item but often to achieve a tangible economic benefit resulting from the possibility of reselling it.

From a legal perspective, the differences between the presented models are crucial. Not every mechanism employing an element of randomness automatically leads to its classification as gambling. Factors that should be assessed include, first and foremost, the potential for financial gain, the existence of a secondary market, the method of financing participation, the possibility of withdrawing funds, and the actual impact of randomness on achieving a specific outcome. In practice, this means a case-by-case analysis of the specific business model, rather than adopting a uniform classification for all types of loot boxes .

This approach is also reflected in the practice of many European countries. Both administrative bodies and courts are increasingly moving away from abstract assessments of the lootbox mechanism itself, focusing instead on analyzing their actual operation and impact on consumer interests. Consequently, the current legal debate no longer revolves around the question of whether lootboxes as a category should be considered gambling, but rather which monetization models justify their inclusion in a specific regulatory regime.

Loot boxes and the definition of gambling in Polish law

Assessing the compliance of lootbox mechanisms with Polish law requires, above all, an analysis of the provisions of the Gambling Act of 19 November 2009. Although the legislature has not yet decided to introduce a separate definition of lootboxes, this does not mean that these mechanisms remain outside the scope of applicable regulations. On the contrary, in practice, their legal classification depends on whether the specific operating model meets the criteria for one of the games specified in the Act.

The basic premise of the Gambling Act is to subject activities in which the outcome depends on chance to a specific regime, and the participant gains the opportunity to obtain a specific financial or material benefit. The Act does not use the term “lootbox” because it was enacted at a time when modern computer game monetization models were practically nonexistent. This necessitates a functional interpretation, taking into account the economic nature of the mechanism in question, not just its name or the technical solutions adopted by the game developer.

A key element of most loot boxes is undoubtedly randomness. The user making the purchase neither knows the contents of the package nor has the ability to influence the outcome of the drawing. However, the mere presence of a random element is not sufficient to classify a given mechanism as gambling. In practice, the nature of the prize received by the participant and the ability to assign it a real economic value are equally important.

This is where a fundamental difference between classic loot boxes offered by game developers and the mechanisms used by third-party platforms for trading virtual items becomes apparent. If the item obtained through a draw has a purely aesthetic function and cannot be legally exchanged for cash or used outside of the game environment, the arguments for classifying such a mechanism as gambling are significantly weaker. The situation is different when the item is de facto a property that can be freely traded on the secondary market, yielding a real financial benefit.

In practice, the greatest controversy surrounds so-called skin gambling. In this model, users use items obtained in-game as a means of participating in subsequent games of chance organized by third parties. Skins, which were originally purely cosmetic, are beginning to function as a kind of digital currency with measurable economic value. This mechanism leads to a situation in which participants risk losing items of real-world value in exchange for the opportunity to win an even more valuable reward. This structure bears a much greater resemblance to classic gambling games than the traditional micropayment systems used by game developers.

At the same time, caution should be exercised before drawing too far-reaching conclusions. The mere existence of a secondary market does not automatically mean that every loot box should be classified as gambling. From a legal perspective, a case-by-case analysis of the entire business model is necessary, including, among other things, the method of acquiring virtual items, the possibility of their resale, the role of the game producer, the scope of control over the trade in digital assets, and the actual economic significance of the rewards. Consequently, two mechanisms utilizing an identical element of randomness may be subject to entirely different legal assessments.

This position is also reflected in the practice of Polish administrative bodies. To date, there has been no established practice of automatically classifying all loot boxes as gambling. Authorities focus instead on analyzing specific business models and assessing whether they meet the requirements of applicable regulations. This approach reflects the nature of the Gambling Act, which uses functional definitions, leaving authorities considerable scope for assessing individual factual circumstances.

In this context, the practice of entering certain online platforms into the Register of Domains Used to Offer Gambling Games in Contravention of the Act has become particularly significant. However, such an entry does not mean that all platforms utilizing the element of randomness conduct illegal activities. Each decision is preceded by an assessment of the specific operational model of the given service. Consequently, it cannot be assumed that the lootbox mechanism itself has been deemed illegal in Poland. It is not the abstract technical structure that is being assessed, but rather its practical application.

Under current law, it seems more appropriate to ask not whether loot boxes per se constitute gambling, but which of their numerous operating models demonstrate characteristics that justify the application of the provisions of the Gambling Act. This approach avoids oversimplification and better reflects the reality of the digital market, where solutions with widely varying levels of risk to consumers coexist.

At the same time, it should be noted that even if a given mechanism does not meet the criteria for gambling within the meaning of the Act, this does not mean there is a lack of legal oversight. Modern regulations increasingly refer to consumer protection instruments, counteracting manipulative practices, and ensuring the safety of children using digital services. Therefore, analysis of loot boxes cannot be limited solely to gambling law. Regulations regarding consumer protection, digital services, and designing interfaces in accordance with fair trading principles are gaining increasing importance, and in many cases, they may prove to be a more effective tool for protecting users than traditional gambling law instruments.

Loot boxes as a challenge to consumer protection law and the regulation of digital services

Although the debate surrounding loot boxes has for many years focused primarily on gambling law, a shift in regulatory direction is now becoming increasingly apparent, both at the national and European Union levels. Contemporary challenges related to random mechanisms in computer games concern not only the classification of specific models as gambling, but also the compliance of the practices employed with the principles of consumer protection, the protection of minors, and the fair design of digital services.

This change is primarily due to the development of the digital economy. The mechanisms used by game producers are increasingly based not on traditional product sales, but on long-term user engagement and gradual increase in spending through appropriately designed psychological solutions. This phenomenon is referred to in the literature as behavioral monetization, or monetization that leverages knowledge from cognitive psychology and behavioral economics. The goal of such mechanisms is not simply to facilitate a purchase, but to create an environment that encourages users to make subsequent purchasing decisions impulsively or emotionally.

Of particular importance in this regard are so-called dark patterns, referred to in Polish literature as manipulative or deceptive design patterns. These design solutions exploit the workings of human perception and decision-making processes to induce behaviors that are beneficial to the entrepreneur, but not necessarily aligned with the consumer’s true interests. In the case of loot boxes, these can take a variety of forms – from counters counting down the time until the end of a promotion, through messages about the limited availability of specific rewards, to elaborate animations that enhance the emotional experience of opening the packages.

These mechanisms are not coincidental. Psychological research indicates that a reward system based on a variable ratio reinforcement schedule is one of the most effective ways to maintain long-term user engagement. This same mechanism has been used for many years in classic gambling games, where the unpredictability of rewards maintains a high level of motivation for subsequent attempts. In the case of loot boxes, this mechanism is transferred to the computer gaming environment and combined with an attractive audiovisual setting and the ability to immediately make another purchase.

From the perspective of consumer protection law, a crucial question is whether the use of such solutions could lead to a violation of traders’ obligations arising from provisions on fair market practices. It should be noted that contemporary EU regulations increasingly place greater emphasis not only on the content of information provided to consumers, but also on the design of digital interfaces. Therefore, the subject of assessment is increasingly not the product or service itself, but rather the architecture of the purchasing process and the impact of the interface on the user’s freedom of decision-making.

Underage users are particularly important here. Both the European Commission and the European Parliament have repeatedly stated that children using digital services require a higher level of protection than the average consumer. This stems from their limited ability to assess economic risk and their greater susceptibility to persuasive techniques used by businesses. In practice, this means that solutions acceptable to adult users may be deemed disproportionate or unfair if they are primarily targeted at children and adolescents.

The importance of this issue has increased following the entry into force of Regulation (EU) 2022/2065 on the Digital Single Market (Digital Services Act – DSA). Although this act does not explicitly regulate lootbox mechanisms, it establishes a number of obligations regarding the design of digital services and the protection of users from practices that may negatively impact their decision-making autonomy. In particular, the DSA emphasizes the need to ensure a high level of protection for minors and limit the use of solutions that exploit the vulnerabilities of specific user groups. This trend indicates that future assessments of the legality of lootboxes will increasingly be conducted not only through the lens of gambling law but also taking into account consumer protection standards applicable in the digital environment.

In parallel, the European Commission is working on a legislative package known as Digital Fairness, which aims to adapt EU consumer protection regulations to the realities of the digital economy. Issues under review include manipulative design patterns, interface design that exploits user vulnerability, and mechanisms that exert excessive psychological pressure during purchasing decisions. Although the legislative work has not yet been completed, the direction of the proposed changes clearly indicates that future regulations may also cover monetization mechanisms used in video games.

The European Parliament also highlighted the need to enhance the protection of minors in its resolution of 26 November 2025 on the protection of children online. The document indicated that mechanisms such as loot boxes, in-game currencies, and other systems based on chance should be subject to special scrutiny from the perspective of protecting children from addictive and manipulative digital practices. While the resolution is non-binding, it provides an important political signal indicating the direction of future legislative action at the European Union level.

A separate but crucial element of the modern user protection system is the PEGI age rating. Starting in 2026, this system will adopt a more stringent approach to games featuring paid random mechanisms, recognizing them as solutions requiring a higher age rating. While the PEGI rating is not a source of law and does not in itself determine the legality of specific monetization models, it reflects a growing consensus on the need to provide greater protection for minors from mechanisms that utilize randomness and behavioral design techniques.

The above circumstances lead to the conclusion that the future of loot box regulation will likely be shaped primarily by regulations concerning consumer protection and digital services, rather than solely by traditional gambling law instruments. While the Gambling Act focuses on the qualification of specific business models, contemporary EU regulations increasingly assess the design of digital services and their impact on the autonomy of user decisions. Consequently, assessing the legality of loot boxes in the future will require comprehensive consideration of both gambling law and regulations concerning consumer protection, digital services, and children’s rights.

Approach of selected European countries to regulating loot boxes – a comparative analysis

The lack of a uniform definition of loot boxes in European Union law has led individual member states to develop different models for regulating this phenomenon. These differences concern not only the legal classification of random-based mechanisms but, above all, the assessment of the risks loot boxes pose to consumers, especially minors. As a result, the European Union currently boasts both countries adopting a very restrictive approach and jurisdictions that prefer to analyze individual business models rather than create separate statutory regulations.

Belgium has taken the most stringent stance for many years. The Belgian Gaming Commission has determined that certain lootbox mechanisms meet the criteria for gambling if the participant pays a fee, the outcome depends on chance, and the reward represents a specific economic value. Consequently, some game producers have decided to remove paid lootboxes from the Belgian market or significantly limit their functionality. This solution was primarily preventative in nature and aimed at limiting children and adolescents’ exposure to mechanisms that utilize randomness as a monetization tool .

The Dutch experience was different. For many years, the Dutch supervisory authority took a similar stance to the Belgian one, deeming certain lootbox models to be in violation of gambling regulations. The dispute concerned one of the most popular monetization models used by Electronic Arts became the subject of years of administrative and court proceedings. However, the final rulings demonstrated that the classification of loot boxes cannot be based solely on the presence of an element of randomness, but requires consideration of the overall economic structure of the game, the method of trading virtual goods, and the actual potential for financial gain for the user. The Dutch experience thus highlighted the difficulties associated with applying traditional definitions of gambling law to new business models operating in the digital economy.

At the opposite extreme is the approach adopted in Poland. To date, Polish lawmakers have not decided to create separate regulations regarding loot boxes or introduce a statutory definition. This means that the assessment of individual models is based on applicable gambling regulations and an analysis of the specific factual circumstances. This approach provides administrative bodies with significant interpretative flexibility, but also limits predictability for businesses operating in the digital market.

The practice of Polish authorities indicates that a functional assessment of the specific business model is crucial. In the case of platforms enabling the use of virtual items as a means of participating in games of chance, authorities may apply the instruments provided for in the Gambling Act, including entry into the Register of Domains Used to Offer Gambling Games Contrary to the Act. However, this does not automatically mean that all loot boxes used in computer games are illegal. The Polish model is therefore based on an analysis of the economic impact of a given solution, not on an abstract assessment of the randomness mechanism itself.

An analysis of the solutions adopted in individual countries leads to the conclusion that what is becoming increasingly important is not simply classifying loot boxes as gambling, but rather protecting consumers from the psychological mechanisms that lead to excessive spending or compulsive behavior. Therefore, many countries are beginning to perceive the loot box problem as an issue that goes beyond traditional gambling law and requires the use of instruments appropriate to consumer law and digital market regulation.

This approach also aligns with actions undertaken at the European Union level. The European Commission and the European Parliament increasingly point out that the fragmentation of national regulatory models can lead to uneven levels of user protection in the digital single market. The global nature of game producers’ operations means that businesses operate simultaneously in multiple markets, adapting their business models to the most stringent requirements in force in individual countries. In practice, this means that future legal solutions will likely aim for greater harmonization of consumer protection standards at the EU level.

However, this doesn’t mean a complete ban on loot boxes is necessary. A much more likely approach would be to introduce requirements regarding the transparency of random mechanisms, the publication of actual reward probabilities, more effective age verification of users, and restrictions on the use of solutions that exploit the vulnerability of children and adolescents to persuasive techniques. Such a regulatory model would preserve the possibility of using micropayments as a legal method of financing computer games while simultaneously strengthening consumer protection.

From the perspective of Polish law, the experiences of other European countries have significant interpretative significance. They demonstrate that mechanisms operating at the intersection of gambling and digital services cannot be assessed solely through the lens of classic legal constructs developed for traditional casinos or lotteries. The development of the digital economy requires a more comprehensive approach, taking into account both the economic significance of virtual goods and the impact of interface design on consumer decisions. Consequently, the future model for regulating loot boxes will likely be based on a combination of instruments from gambling law, consumer protection law, and regulations governing digital services, rather than the exclusive application of one of these legal regimes.

Conclusions de lege lata and postulates de lege ferenda

The analysis leads to the conclusion that current Polish law does not allow for a uniform legal classification of all lootbox mechanisms. Despite the growing number of voices calling for the recognition of lootboxes as a form of gambling, the current legal status does not provide a basis for automatically subjecting this entire product category to the provisions of the Gambling Act of 19 November 2009. Each assessment requires consideration of the actual operation of the specific business model, the nature of the prize, the potential for further turnover, and the economic impact of user participation in the random mechanism.

This doesn’t mean, however, that the current regulations remain entirely insufficient. With respect to some models operating on the market – particularly platforms that use virtual items as a means of participating in games of chance or enabling their exchange for cash – current regulations may be applicable. The practice of administrative bodies to date demonstrates that the Gambling Act remains an instrument that helps counteract the riskiest forms of activity, especially when virtual goods begin to function as an equivalent of money or property.

At the same time, it’s important to note that the vast majority of modern loot boxes don’t pose a classic gambling law problem. Their primary purpose isn’t to organize games of chance in the traditional sense, but to create a monetization model that leverages psychological mechanisms that increase user propensity to make subsequent purchases. For this reason, the current regulatory debate is increasingly shifting from gambling law toward consumer protection law and the regulation of digital services.

It seems that this is precisely the direction that Polish lawmakers should also adopt. Attempting to classify all loot boxes as gambling would oversimplify the extremely diverse digital market. A much more rational solution seems to be creating separate regulatory obligations for mechanisms that utilize randomness, without the need for automatic application of the entire gambling law regime.

First and foremost, it seems reasonable to introduce full transparency into random mechanisms. Before making a purchase, users should be able to familiarize themselves with the actual probability of winning individual prizes, how the randomization algorithm works, and whether this probability remains constant for all participants. Such solutions already exist in some computer games, but currently they are primarily driven by voluntary decisions by businesses or requirements in specific foreign markets.

The second direction of change should be to strengthen the protection of underage users. In light of current psychological knowledge and the positions of EU institutions, there is little doubt that children are particularly susceptible to the influence of mechanisms based on a variable reward system. Therefore, it seems reasonable to consider limiting the ability of people under a certain age to purchase paid loot boxes or introducing mandatory parental control mechanisms to effectively manage minors’ expenses.

Regardless of the above, legislators should consider introducing more detailed regulations regarding third-party platforms enabling the trading of virtual items. It is this market segment that currently raises the greatest concerns from the perspective of consumer protection and compliance with the Gambling Act. In particular, situations in which items obtained in-game become a means of participation in subsequent games of chance or can be directly converted into cash require analysis. In such cases, the line between a digital service and gambling activity becomes significantly blurred, justifying the application of more restrictive oversight measures.

Obligations regarding marketing activities should also be a crucial element of future regulations. In practice, loot boxes are primarily promoted through influencers and online creators, whose audiences often include minors. While advertising collaborations in and of themselves cannot be deemed unacceptable, situations in which marketing messages exclusively emphasize the possibility of winning exceptionally valuable prizes, disregarding the actual probability of winning them, or employing techniques that could create unreasonable expectations among recipients regarding potential benefits, require special consideration. In this regard, both consumer protection regulations and regulations regarding the integrity of advertising messages may apply.

The issues presented demonstrate that the issue of loot boxes is not limited to gambling law. In fact, it exemplifies a much broader phenomenon involving the use of advanced digital design techniques to influence users’ economic decisions. Technological advancements increasingly render traditional private and public law frameworks inadequate for assessing new business models based on user behavior analysis and interface design that maximizes consumer engagement and spending.

Consequently, the future of loot box regulation will likely depend less on further expansion of the definition of gambling than on the development of European consumer protection standards in the digital environment. Regulations on the transparency of digital services, countering manipulative design patterns, and ensuring a high level of protection for children using the internet are becoming increasingly important . These instruments may become the primary tool for mitigating the risks associated with loot box operations in the coming years.

It should therefore be assumed that effective regulation of this phenomenon requires a multifaceted approach, combining instruments of gambling law, consumer protection law, and digital market regulation. Only such a comprehensive solution will achieve the right balance between the freedom of game producers to conduct business and the need to ensure a high level of protection for users, particularly children and adolescents, who remain most vulnerable to the negative effects of random-based mechanisms.

Artykuł Lootboxes in Computer Games – Between Gambling Law and Consumer Protection. Regulatory Analysis Against the Background of Polish and European Union Law. pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

You see a video, a product catches your eye, and an “add to cart” button is already blinking in the corner of the screen. A few seconds later the order is placed, paid for, and on its way — all without leaving the app. That’s how TikTok Shop works: a closed-loop model in which the path from watching a piece of content to completing a purchase has been cut to the bare minimum. That very immediacy is its greatest strength and, at the same time, the source of its most serious concerns.

A platform that in 2017 drew around 72 million monthly users now attracts more than 1.5 billion — and between 11 and 15 million in Poland alone. TikTok has stopped being merely a place for entertainment and has turned into a powerful advertising and sales engine, combining influencer marketing, algorithmic personalization, and the emotional purchasing impulse. For businesses, it is a new and remarkably effective retail space. For consumers, it is an environment in which it grows ever harder to tell an authentic recommendation from an ad, or a fleeting enthusiasm from a considered decision.

That is precisely why TikTok Shop has landed at the center of lawmakers’ attention. While its model is not unlawful, the platform’s operation intersects with an entire web of regulation: from consumer law and the ban on “dark patterns,” through the EU’s DSA and DMA, data protection and safeguards for minors, all the way to advertising, media, and electronic communications law. This article shows where the convenience of one-tap shopping ends and the protection of the buyer’s free will begins.

What makes the TikTok Shop platform innovative?

Today, an effective marketing strategy is becoming an increasingly important priority for sellers. In Poland, monopolies in sales are relatively rare. Many competing companies operate in most industries. When purchasing products, consumers must choose from hundreds, or even thousands, of options offered by different brands. The scale of this phenomenon is evidenced by the fact that in the fourth quarter of 2025, over 2.9 million active businesses operated in Poland alone, the largest group of which were those associated with the retail sector. Meanwhile, buyers generally do not want to spend much time thoroughly analyzing goods available on the market. They are often guided by the opinions of other users, brand recognition, or media coverage. Therefore, in an information society based on the dynamic development of social media, tailoring advertising to current consumer needs and behaviors becomes crucial for running a business. Authentic and credible recommendations from trusted creators are becoming more important, and for many buyers, they are more persuasive than formulaic television commercials.

Considering the above arguments, many companies are making changes to their advertising strategies, for example, opting for influencer marketing. Online creators typically publish aesthetically and thematically consistent content that captures the interest of users with similar preferences and tastes. A business partnering with an influencer who shares similar values gains the opportunity to reach a large group of potential consumers, made up of the influencer’s followers. TikTok has become the dominant platform enabling the implementation of the marketing model described above. In 2017, the application had approximately 72 million monthly active users, and according to data from 2026, this number has increased to approximately 1.54 billion. In Europe alone, TikTok has already reached over 200 million users, and in Poland, the number ranged from 11 to 15 million. The average time spent on the platform is 70 minutes per day, which translates to approximately 35 hours per month. These statistics also indicate the continued growth of TikTok’s popularity, confirming the future of using social media for advertising and promotional purposes.

The development of influencer marketing significantly changed existing marketing practices, and its increasing prevalence led to the transformation of the TikTok app from a social media platform into an advertising system. The effective and profitable collaboration between media and advertising prompted the platform to take the next step in its development, combining these two sectors. Users were offered the opportunity to completely simplify the purchasing process. Previously, consumers only saw product advertisements, which attracted their attention and prompted them to search for sales offers. However, this pattern left them time to consider whether a purchase was truly necessary or necessary. It was also likely that, despite their interest in the product, they would eventually forget about the advertised product, and therefore their desire to purchase it.

The solution to the marketing strategy described above turned out to be a new feature presented by TikTok: TikTok Shop. The innovative nature of this tool is based on a closed-loop model, meaning the purchasing process takes place within a single app. Users first encounter content promoting a specific item. They then have the option to immediately purchase it by adding the advertised item to their shopping cart in the bottom corner of the app. TikTok acts as an intermediary for payment, shipping, and the entire order process. In this way, the app has evolved not only into a profitable advertising system but also an online store, becoming a marketplace platform that mediates payment, logistics, and order fulfillment.

The origins of TikTok Shop

Initially, the online shopping phenomenon developed through e-commerce. Its popularity contributed to the diversification of online sales into several business models: B2C, B2B, and C2C. The former involves a relationship between a business and an individual customer (examples include online stores such as Zalando, Zara, and IKEA). B2B refers to transactions between businesses, while C2C refers to sales between individuals, such as on platforms like Vinted, OLX, and Allegro.

These e-commerce models typically control the sales process independently. Their profits largely come from consumers who shop by searching for specific products they need. Entrepreneurs compete with each other through marketing activities aimed at convincing consumers of the quality of their products and building brand recognition.

In the next stage, the development of social media, and consequently influencer marketing, contributed to the emergence of a completely new type of buyer, one driven by impulse. Online creators present a specific lifestyle on their profiles in a significantly idealized form, which attracts the attention of their followers and becomes a role model. The desire to emulate the creator they follow can manifest itself both in their behavior and in the possessions they possess. The influencer thus becomes a person who inspires and encourages the purchase of a given product. Even if, from a rational perspective, the buyer doesn’t need the product, they often decide to purchase it under the influence of influencer marketing.

Additionally, a new branch of e-commerce has emerged, known as discovery commerce . This model relies on the discovery and purchase of new items while actively browsing social media. Highly advanced algorithms select content for users that aligns with their tastes or interests, in order to evoke certain emotions that then transform into a strong purchasing impulse. Social media platforms, recognizing this profitable sector, have contributed to the development of social commerce, including TikTok Shop. This solution capitalizes on users’ fleeting enthusiasm and allows them to complete their order without leaving the app. The entire process, from advertising content to payment and shipping, is handled by TikTok, which can limit the time available for rational purchase consideration.

What exactly does the purchasing process look like on TikTok Shop?

TikTok Shop is not a separate app, but a new feature added to the TikTok platform. There’s no need to create a new account or install a new app. This solution provides access to a wide group of potential consumers, as every existing TikTok user over the age of 18 can familiarize themselves with the new feature. This solution gives businesses multiple ways to reach consumers. The platform offers a separate tab, “Shop,” where users can search for specific products using filters and categories, or browse recommended items based on their activity on the platform.

Products offered by sellers using the TikTok Shop service can also be viewed on the “For You Page” tab. This is the subpage most frequently visited by users. This option is especially useful when a company decides to use influencer marketing. A creator posts a video promoting a selected product, and buyers are immediately presented with a purchase button at the bottom of the page. Consumers can also directly access the profiles of brands and creators to find the products they offer or promote.

The latest feature, TikTok Live, is gaining popularity. Before the live stream begins, the seller or influencer adds products available in the TikTok Shop. During the live stream, the host can showcase products, communicate with users, and answer their questions via chat. This can increase the credibility of the product and the seller, as well as encourage consumers to make a purchase, which they can do without interrupting the stream.

The very process of posting ads on TikTok Shop helps build consumer trust. Becoming a seller requires thorough verification, which the TikTok platform conducts to protect users from unreliable and fictitious businesses.

The first step to becoming a seller is to log in to your TikTok Seller Center account using your email address, phone number, or existing TikTok account. You’ll also need to fill out an application form with information that proves your seller credentials, such as your company name, address, and contact information.

After successful verification, the seller completes their store profile, adding a description, name, logo, seller details, addresses, customer service information, and tax information. It’s also necessary to configure payment and delivery methods, including the shipping address, available delivery methods, order processing time, and return policy. Connecting the store dashboard to a regular TikTok account is also crucial. This allows for tagging offered products in live videos, etc. The seller then has the option to publish their product, including the title, description, price, available models, and inventory. The platform also allows businesses to add listings by importing a product catalog from another sales platform.

After a consumer makes a purchase, the seller receives a sale notification in the TikTok Seller Center. The seller is then responsible for packaging and shipping the item to the user, which can be done manually or using external order processing systems.

Distance selling and consumer rights

The TikTok Shop platform offers the option of concluding a sale via a distance contract. This does not require the parties to be physically present at the same time, but rather requires at least one means of distance communication (Act of 30 May 2014 on consumer rights, Article 2). Therefore, when making a purchase through the TikTok Shop, consumer rights are governed by national and European Union law.

In Poland, the primary legal act regulating these activities is the Act of May 30, 2014, on Consumer Rights. Article 12 requires businesses to clearly inform consumers in distance contracts, including the method and deadline for contract execution, the total price including taxes, the right to withdraw from the contract, the complaint procedure, and the seller’s identifying information. The TikTok Shop platform is therefore obligated to provide the required information to the user before finalizing the order via the app. An important regulation is also included in Article 17 of the aforementioned Act and concerns the requirement to design the interface in a way that confirms the consumer’s awareness of the obligation to pay. In the case of platforms that allow order completion via a “button,” it must be clearly marked, e.g., “I buy with an obligation to pay” or “I buy and pay.” Otherwise, the contract is not concluded. The requirements described above are referred to as ” button ” solution ” and are intended to protect consumers from accidentally concluding paid contracts. Alternative obligations also arise from the Directive of the European Parliament and of the Council of 25 October 2011 on consumer rights.

The Consumer Rights Act also implements the EU Commodity Directive (2019/771), introducing uniform standards for the conformity of goods with the contract. A trader is liable for any lack of conformity of goods with the contract upon delivery and for two years from the date the discrepancy is discovered. The Act also governs basic consumer claims in the event of non-conformity, including repair or replacement of the goods, and if this is not possible, a price reduction or withdrawal from the contract.

Given that the sales strategy on the TikTok Shop platform relies on recommendation algorithms and influencer marketing, the Omnibus Directive (EU) 2019/2161 of November 27, 2019, plays a significant role in consumer empowerment. Its regulations introduce the obligation to provide information about the lowest price, disclose whether reviews were published by verified consumers, and indicate whether the seller is a business or an individual. The Omnibus Directive therefore increases consumer awareness and allows consumers to make more rational and manipulation-free purchasing decisions.

Digital Services Act Regulation

Due to their global nature, online platforms reach hundreds of millions of users. Content published through them can reach a very wide audience, thus influencing social, political, and economic relations. Massive social networking sites, therefore, go beyond simply providing entertainment or communication services and digital space, and are beginning to shape the reality around us.

The strong influence of individual platforms on current international relations has initiated more stringent oversight, including through the provisions of Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on the single market for digital services and amending Directive 2000/31/EC (Digital Services Act – DSA). Based on this regulation, TikTok was recognized by the European Commission as a Very Large Online Platform (VLOP). This status is granted to portals with monthly active users exceeding 10% of the EU population. TikTok exceeded the threshold and was classified as a VLOP in 2023.

Platforms deemed globally influential are not solely responsible for removing illegal content. They are also required to counteract the negative consequences that may arise from their operation. Among the most important responsibilities of very large online platforms (VLOPs) is the identification and assessment of systemic risks and the potential implementation of proportionate mitigation measures. Impacts on fundamental rights, democratic processes, the protection of minors, public safety, and the dissemination of illegal content are particularly scrutinized. Once a specific risk is identified, measures are planned to counteract its escalation, such as modifying the user interface or changing certain advertising practices. In emergency situations, the European Commission has the authority to require VLOP providers to assess the platform’s impact on the development of the crisis, implement specific mitigation measures, and submit periodic reports on the effectiveness of these actions. Very large online platforms are also required to undergo an annual independent audit of compliance with the Digital Services Act (DSA) and regularly publish comprehensive reports on their activities. The aim of this action is to ensure transparency of the platform’s operation towards users and supervisory authorities.

The DSA also regulates advertising by introducing the requirement to maintain a public ad repository. This repository should include, among other things, the ad’s content, advertiser, funding entity, broadcast time, and the number of recipients. This solution is intended to ensure transparency in advertising messages and enable social and scientific analysis of platforms’ promotional activities. Restrictions have also been imposed on recommendation systems. This means that VLOPs are required to provide users with at least one way to display content that is not based on profiling, meaning it does not use user activity history or data. To monitor platforms’ compliance with the EU regulation, it is also possible to impose a requirement to share data on, for example, the performance of recommendation algorithms with the European Commission, national digital service coordinators, or verified researchers.

TikTok, however, is not subject only to the obligations of very large online platforms. It is subject to all regulations provided for in the Digital Services Act. According to Article 26, each advertisement must be clearly identified as promotional material and indicate the advertiser, the funding entity, and the mechanism by which it was tailored to the user. This restriction is particularly useful for the TikTok Shop platform, where sponsored content is commonly created in the manner of regular content published by creators. Limiting the phenomenon of so-called hidden advertising through the provisions described above aims to increase user awareness.

One of the DSA’s key goals is also the protection of minors. When designing their services, platforms are required to consider a high level of protection for minors and their privacy. It is prohibited to display advertisements based on the profiling of minors when the platform has knowledge of the user’s minor status. The goal is to limit the use of children’s data for marketing purposes and reduce the risk of addictive use of the app.

The European Commission has also become concerned about potential negative consumer behavior resulting from the increasing transformation of large social media platforms into e-commerce portals. Complex profiling algorithms, influencer marketing, and instant purchases can encourage users to make impulsive decisions or even become dependent on purchasing processes. Articles 25 and 27 of the Consumer Protection Act (DSA) mitigate this risk. Designing web interfaces that manipulate or complicate consumer decision-making – so-called dark patterns – is prohibited. Examples of unacceptable solutions include hiding options that are less favorable to the business, making it difficult to unsubscribe from services, or designing buttons that encourage a specific choice. Users should also be fully aware of how the recommendation system works; therefore, platforms are required to clearly present its main parameters and the possibility of changing the content suggestion method.

Tamper protection and dark patterns

A key premise of the TikTok Shop platform is the immediacy of purchases. While this solution is very beneficial for businesses and, typically, consumers, it can lead to abuse. Sales without leaving the app, a simplified order completion process, and algorithmic personalization of recommended products seem to provide greater convenience when shopping online. However, some activities can be classified as ” dark patterns”, manipulations used to mislead users and influence their decisions. Because the practices described above can lead to impulsive behavior and distort consumer will, they may be treated as unfair market practices and subject to criminal penalties.

The Act of 23 August 2007 on Counteracting Unfair Market Practices defines an unfair market practice as a sale that is contrary to good practice and significantly distorts or may distort the market behavior of the average consumer before, during or after the conclusion of a product agreement , in particular a misleading market practice and an aggressive market practice (Act of 23 August 2007 on Counteracting Unfair Market Practices, Article 4). The main grounds for considering a market practice misleading include the dissemination of false information or truthful information in a potentially misleading manner. Such misleading information typically concerns the existence of a product, its type or availability, price, the method of price calculation, or the existence of a special price advantage.

To encourage immediate purchases, sellers pressure buyers with messages suggesting limited availability or a limited-time promotion for a specific product. Examples of such messages include phrases like “100 people are viewing the product,” “offer ends in 2 hours,” or “only 4 items left.” This practice is not illegal and is one of the most common marketing mechanisms. Problems arise when the website or portal is programmed to continually extend promotions, the offer doesn’t actually expire after the specified date, or the counter restarts upon page refresh.

Misleading practices, such as suggesting the limited nature of a permanently available offer, and aggressive practices, such as exerting time pressure, may result in legal consequences. In addition to the aforementioned Act of 23 August 2007 on Combating Unfair Commercial Practices, this issue is also regulated by Directive 2005/29/EC concerning unfair business-to-consumer commercial practices in the internal market. This directive distinguishes between misleading commercial practices and aggressive commercial practices. Together, they constitute unfair commercial practices, which include, in particular, actions that are contrary to the requirements of professional diligence and that significantly distort or are likely to significantly distort the economic behavior of the average consumer who reaches or is targeted by the practice, or the average member of a group of consumers if the commercial practice is targeted at a specific group of consumers (Directive 2005/29/EC of the European Parliament and of the Council of 11 May 2005 concerning unfair business-to-consumer commercial practices in the internal market and amending Council Directive 84/450/EEC, Directives 97/7/EC, 98/27/EC and 2002/65/EC of the European Parliament and of the Council and Regulation (EC) No 2006/2004 of the European Parliament and of the Council (“Unfair Commercial Practices Directive”), Chapter 2, Article 5, paragraph 2).

Directive (EU) 2019/2161 of the European Parliament and of the Council of 27 November 2019 (Omnibus Directive) is also intended to combat various manifestations of the “dark patterns” phenomenon. It requires sellers to disclose the lowest price for a product within the last 30 days. This is intended to prevent the practice of artificially inflating prices and then announcing sales. The practice of fake reviews has also been curbed by introducing an obligation to disclose whether and how reviews posted on sales websites are verified. The Omnibus Directive also introduced the requirement to indicate on marketplace platforms whether the seller is a private individual or a professional entrepreneur, so that consumers are aware of who they are buying from.

The European Union has also introduced restrictions related to the design of digital services, contained in Regulation 2022/2065 on the Digital Single Market (DSA). As a result, online platform providers cannot design, organize, or operate their online interfaces in a way that misleads, manipulates, or otherwise interferes with or limits the ability of service users to make free and informed decisions. The regulation therefore directly addresses the fight against “dark patterns,” i.e., website design practices that deliberately use deceptive techniques, such as pre-selected consents or difficult unsubscribes.

The President of the Office of Competition and Consumer Protection (UOKiK) has broad authority to protect consumers from the unfair commercial practices mentioned above. Under the Act of 16 February 2007 on Competition and Consumer Protection, one of his powers is to protect the collective interests of consumers, including through provisions counteracting unfair market practices. If necessary, the UOKiK President may initiate proceedings against a business, ordering it to cease the unfair practice, or requiring the seller to remedy the effects of the violation. Should a business fail to comply with the guidelines, he may impose a fine of up to 10% of the business’s turnover in the previous year.

The number of legal acts, including EU documents, regulating unfair commercial practices reflects the considerable interest in this issue among both legislators and consumer protection authorities. TikTok Shop, as a social commerce model, is not illegal. It utilizes mechanisms combining influencer marketing, personalization, and emotional impact on the recipient, but the design of the user interface is crucial for this platform. The popularity of mass sales portals has contributed to the increasing use of “dark patterns” by businesses over the past few years. For this reason, the European Union and the Office of Competition and Consumer Protection (UOKiK) are increasingly rigorously monitoring sales tactics and issuing new legal acts to protect consumers and their free will when making purchases.

Influencer Marketing and Advertising Law

The effectiveness of influencer marketing stems from combining advertising with the ability to make an immediate purchase. Affiliate links, product tags, or direct purchase buttons, such as those on the TikTok Shop platform, are displayed beneath posts, videos, or other promotional materials. This purchasing model has proven effective by significantly simplifying the ordering process, thus reducing the time consumers spend considering the rationale behind the transaction.

The popularity of the marketing strategy described above stems from its perception by users, who perceive it as authentic and credible. Influencers present promoted products in a natural way, integrating them into their daily routine. However, if the material does not solely reflect the creator’s personal opinion but is created after receiving a benefit in return, it is considered commercial communication. This means it is subject to legal regulations on advertising and consumer protection. In Poland, influencers should clearly label advertising content in accordance with the Recommendations of the President of the Office of Competition and Consumer Protection. These regulations are intended to prevent misleading users.

Only content regarding a product that the influencer purchased independently and for which they did not receive remuneration or other benefits can be marked as a private opinion. Such material contains genuine feelings and opinions and therefore does not constitute advertising under the law and is not subject to advertising law. This is the most credible and reliable form of review for potential consumers, as it was created by a person not under any obligation to the manufacturer.

A manufacturer may enter into an agreement with an influencer to promote a product in exchange for a free product, financial benefit, or other form of remuneration. This creates legally regulated advertising. It may take the form of a post, report, or live broadcast in which the creator demonstrates how they use the product and its positive properties. Due to the natural presentation of the product as an everyday element, the recipient may have difficulty distinguishing a genuine recommendation from commercial content. The Act of August 23, 2007, on Counteracting Unfair Market Practices, classifies the act of concealing a promotional message as a misleading omission. Failure to clearly indicate the commercial nature of the material may hinder consumers’ proper assessment of the message and directly influence their purchasing decisions.

Another common advertising strategy is to feature a product integrated into published content without directly promoting it, for example, by placing it in the background of the material. This phenomenon is called product placement. Activities covered by advertising and consumer protection law also include, among others, affiliate and partner links, ambassador programs, and partner competitions. In Poland, these practices must contain clear, understandable to the average recipient, and visible advertising labels from the very beginning, such as “advertisement,” “paid collaboration,” or “sponsored content.” The Office of Competition and Consumer Protection (UOKiK) also recommends the use of two-level labeling, meaning that, in addition to the information contained in the content, the platform’s functionality must also be used to announce the paid collaboration. Detailed guidelines can be found in the Recommendations of the President of the UOKiK regarding the labeling of advertising content by influencers. Material is considered advertising content not only when the influencer receives monetary compensation in exchange for its creation. The same obligation applies when promoting your own business, receiving a free product or service, or obtaining a sales commission via an affiliate link or discount code (Recommendations of the President of the Office of Competition and Consumer Protection regarding the marking of advertising content by influencers).

In the event of non-compliance with the Recommendations of the President of the Office of Competition and Consumer Protection regarding the labeling of advertising content by influencers, pursuant to the Act of 16 February 2007 on Competition and Consumer Protection, the Office of Competition and Consumer Protection (UOKiK) conducts proceedings against entrepreneurs using practices that violate the collective interests of consumers. Actions may be taken against advertisers, influencers, and marketing agencies. Therefore, responsibility for incorrect labeling of advertising content rests not only with the creator publishing the material but also with all entities participating in organizing the promotional campaign. One of the sanctions that the President of the UOKiK has the right to impose is a financial penalty. Incorrectly labeled promotional material can also be considered surreptitious advertising. Due to the dynamic development of influencer marketing, the proper creation of marketing content is currently widely subject to UOKiK scrutiny. Therefore, it is worth clearly and understandably labeling sponsored publications, among other things, to avoid significant financial penalties.

Personal data protection

TikTok Shop, as a hybrid social network and e-commerce platform, processes a significant amount of data related to both user activity and purchasing processes. The app’s operation is based on audience profiling and matching the most relevant content. Therefore, the platform’s operations are subject to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

In addition to user data such as name, surname, contact details, shipping addresses, and payment information, media platforms also collect information that allows for behavioral analysis. Time spent browsing specific products, interactions with ads, and the history of items added to carts or wish lists allow the TikTok Shop platform to create a personalized recommendation system based on past activity. This phenomenon creates so-called behavioral advertising, a marketing strategy based on user profiling using advanced algorithms to predict future purchasing decisions. The concept of profiling refers to the automated processing of personal data, particularly for the purpose of predicting a user’s economic situation, personal preferences, interests, health, and location.

According to the GDPR, profiling is permissible, but it also comes with a number of obligations. Platforms are obligated to transparently inform users about, among other things, the purposes of profiling, the legal basis for data processing, the consequences of the actions taken, and their rights, including the right to object to profiling. Data of minors is particularly protected. Due to the growing popularity of the TikTok app among young users, it was necessary to subject it to special regulations in this regard. In the area of information society services, the processing of data of children over 16 years of age is lawful. An exception is made for situations in which a person with parental authority or guardianship provides prior consent. However, EU member states may introduce a lower age limit in their laws, but it must be at least 13 years old, as is the case in Poland, for example. To ensure that platforms enforce their obligations related to the protection of minors, they should use appropriate age verification mechanisms. In practice, however, this solution requires further improvement due to the common practice of users providing false data during registration.

The President of the Office of Competition and Consumer Protection (UOKiK) plays a crucial role in protecting users, especially the collective interests of consumers. He is authorized to take action against entrepreneurs who engage in unfair market practices, design manipulative interfaces, and so on. Personal data protection, however, falls primarily within the remit of the Office for Personal Data Protection (UODO), which oversees compliance with the GDPR and the secure processing of information by companies and institutions. Due to its global influence, TikTok has attracted increasing attention from EU authorities in recent years and is becoming the subject of more frequent inspections. Due to the platform’s European headquarters being located in Ireland, the relevant supervisory authority is the Irish Data Protection Commission (DPC). For example, in 2025, this institution imposed a fine of €530 million on ByteDance, the app’s owner. The fine was imposed on the transfer of user data from the European Economic Area to China in violation of the GDPR and the failure to demonstrate data protection at the level guaranteed in the EU.

The GDPR is supplemented by Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), which regulates, in addition to the processing of personal data, the confidentiality of electronic communications, also known as ePrivacy. Due to the scope of its regulations, the provisions of this directive have particular relevance to the TikTok Shop application. The platform uses numerous tracking technologies, such as cookies and mobile device advertising identifiers, to monitor user activity. Information may be stored on a user’s device or accessed only after obtaining prior consent. Exceptions are made only for technologies strictly necessary to provide the service requested by the user, such as remembering a shopping cart. An additional ePrivacy regulation was also envisaged, the purpose of which was to replace the current directive and harmonize the personal data protection rules applicable in all EU Member States. The changes were to include, among other things, simplifying the rules regarding cookies. However, the project encountered legislative difficulties and was not adopted by decision of the European Commission.

Abuse of Market Power and the Digital Markets Plan

The dynamic expansion of the largest digital platforms’ influence has led to the need to adapt competition law to the new situation, particularly in the digital market. To this end, the European Union adopted Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act – DMA). The Act introduces the concept of a gatekeeper. This term refers to an entrepreneur with an influential position in the internal market, through which business users reach end users. A gatekeeper provides a core platform service and maintains an established market position.

The dominant position of a gatekeeper is also associated with a number of obligations. Among other things, the practice of self-preferencing, which involves favoring one’s own products or services over the offers of other businesses using the platform, is prohibited. In the case of TikTok Shop, this could involve using recommendation algorithms to increase the visibility of products promoted by individual sellers, without applying objective and fair advertising criteria. This type of favoritism and limiting the reach of individual entities could lead to a distortion of fair competition between businesses using TikTok Shop for sales purposes.

By decision of the European Commission, BytaDance Ltd. was granted gatekeeper status solely for the operation of the TikTok application as a social media platform. The DMA regulations governing the gatekeeper position do not apply directly to TikTok Shop, but they may impact the rules for recommending products and using entrepreneurs’ data.

Media law and audiovisual regulations

Audiovisual materials are the primary tool for promoting and selling products on the TikTok Shop marketplace. Therefore, the app’s operations are also subject to scrutiny for compliance with media law and regulations governing audiovisual media services. The dominant role in this regard is played by Directive 2010/13/U of the European Parliament and of the Council of 10 March 2010 on the coordination of certain provisions laid down by law, regulation, or administrative action in Member States concerning the provision of audiovisual media services (Audiovisual Media Services Directive – AVMSD) and the Broadcasting Act of 29 December 1992, which implements it into Polish law. As a result of the amendment to the Act of 11 August 2021, the regulations have been extended to video-sharing platforms, including the TikTok app.

Video-sharing platforms are primarily obligated to implement appropriate measures to protect minors from harmful content that could negatively impact their moral, mental, or physical development. These provisions have been implemented into Polish law through Article 47e of the Broadcasting Act, which mandates, among other things, the marking of potentially inappropriate content with special graphics for young viewers. These regulations are particularly important for the TikTok Shop platform due to the constantly growing number of underage users. Posting content that spreads hatred and discrimination is also prohibited.

TikTok Shop, a hybrid social media platform and e-commerce platform, is often used to publish so-called audiovisual commercial communications—images used to directly or indirectly promote goods, services, or individuals (Directive 2010/13/U of the European Parliament and of the Council of 10 March 2010 on the coordination of certain provisions laid down by law, regulation or administrative action in Member States concerning the provision of audiovisual media services, Article 1). Article 9 of the AVMSD requires member states to ensure that such communications are easily recognizable, thus prohibiting hidden audiovisual commercial communications. The use of subliminal techniques or the inclusion of discriminatory content would also be illegal. The National Broadcasting Council (KRRiT) is responsible for ensuring compliance with audiovisual law. Its remit includes, among other things, overseeing the activities of video-sharing platform providers.

The sales method used by TikTok Shop may seem analogous to teleshopping, offerings directly to consumers to deliver goods or services in exchange for payment. This modern form of interactive audiovisual commerce (live shopping) bears numerous similarities to traditional teleshopping. The mechanisms of both aforementioned sales methods involve presenting the product, its specific features, available options, and generally encouraging the recipient to purchase. However, teleshopping is targeted at a general, anonymous audience who may only be interested in the recommended product. Meanwhile, TikTok Shop relies on advanced algorithms that target promotional content to users who, based on their previous activity, have shown interest in similar content.

Platform liability under e-commerce regulations

The original act regulating the legal liability of online platforms in the European Union was Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce). Its foundation was the so-called safe harbor principle, i.e., the principle of limited liability of online intermediaries. According to this principle, hosting service providers and online platforms were not liable for content or goods published by users, provided they had no actual knowledge of the illegal nature of the content or goods or services or, upon obtaining such knowledge, promptly removed any infringements. Furthermore, the directive did not impose a general obligation on platforms to monitor content published by users.

However, the ongoing development of digital platforms has made it necessary to amend the current liability model. Regulation (EU) 2022/2065 – Digital Services Act (DSA) – came into effect on February 17, 2024. This regulation does not eliminate the principle of limited liability but significantly expands monitoring obligations, especially for very large online platforms (VLOPs). One of the key obligations introduced under the new regulations is the Know Your Business Customer (KYBC) principle. This regulation aims to increase the safety of consumers shopping online by limiting sales conducted by dishonest or anonymous traders. Before enabling sales through its platform, an online platform must collect and verify basic data identifying the seller. The required information includes, among others, the trader’s name, registered office address, contact details, registration number in the relevant register of traders, and the trader’s payment account details. In the event of refusal to provide the specified data or providing it falsely, the platform should prevent the trader from conducting sales until the situation is resolved.

A problematic issue related to the TikTok Shop app is defining the platform’s responsibility for transactions conducted by sellers using it. Although TikTok Shop formally acts as an online intermediary, it can be argued that its operating mechanism goes beyond passive hosting. A recommendation system using algorithms, promoting offers, and providing marketing and analytical tools to sellers are the mechanisms TikTok Shop uses to shape consumer behavior and purchasing decisions. The platform’s influence on the visibility of offers and the order fulfillment process may support assigning it broader responsibilities in overseeing the online sales process.

Regulations on electronic communications, including the European Electronic Communications Code and the Polish Electronic Communications Law

The TikTok Shop platform does not constitute an electronic communications service under European Union law, but its operations provide for various forms of electronic communication. TikTok Shop’s use of push notifications, in-app messages, and marketing communications requires the platform to comply with regulations governing electronic marketing and the protection of user privacy in electronic communications. The primary legal acts regulating these aspects are Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (EECC) and the Act of 12 July 2024 – Electronic Communications Law.

The primary function of TikTok Shop is to enable entities to sell goods through the social media platform. Article 2 of the European Electronic Communications Code defines an electronic communications service as the transmission of signal transmissions or the provision of interpersonal communications services. The mere ability to exchange messages between users or with sellers does not automatically qualify the TikTok Shop platform as a provider of electronic communications services, as this is not its core competency and does not constitute its core business. However, because electronic communications are primarily used for marketing purposes, it is obligated to comply with regulations governing direct marketing and the protection of user privacy.

Push notifications, messages sent directly to users’ mobile devices, are an increasingly popular marketing solution. TikTok Shop uses them to provide information about order status, discounts, time-limited campaigns, or the launch of live shopping. Transactional notifications regarding order fulfillment, shipping, or payment status are typically part of the contract and do not require marketing consent. However, notifications encouraging potential consumers to make a purchase are classified as direct marketing and, in accordance with electronic communications law, require prior user consent.

The practice of using automated calling systems and electronic means of communication for advertising purposes without the user’s prior consent is also prohibited. Users should be clearly informed about the purpose of receiving marketing communications, the data controller, and the possibility of withdrawing consent, which should not result in any negative consequences. With respect to the TikTok Shop platform, the above position means that it is unlawful to send promotional content to users solely based on the fact that they have an account on the app.

TikTok Shop is the clearest example of how thin the line between entertainment, advertising, and commerce has become – a one-tap purchase woven into a stream of content is now as effortless as liking a video. Yet that convenience comes at a price: the closed-loop model and algorithmic personalization shrink the time left for rational reflection, while responsibility for protecting the consumer shifts increasingly away from the buyer and onto the platform and the legislator. EU and national regulations – from consumer law, through the DSA and DMA, data protection and safeguards for minors, all the way to media and electronic communications law – form a web meant to counterbalance the platform’s power and restore the buyer’s awareness of their own choices. TikTok Shop thus remains a dual phenomenon: on one hand a groundbreaking innovation in digital commerce, on the other a test of whether the law can keep pace with a technology that sells faster than we can think.

Artykuł A Store in Your Pocket, the Law in the Background: TikTok Shop Under the Regulators’ Lens pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

We are pleased to share that Kiełtyka Gładkowski KG Legal has published an expert contribution in Infor, one of Poland’s leading legal and financial publications, devoted to one of the most intriguing regulatory phenomena of the digital economy: loot boxes in video games.

“Loot boxes in video games: between gambling law and consumer protection – a regulatory analysis under Polish and European Union law”

The article goes far beyond the classic “are loot boxes gambling?” debate. By analysing the actual monetisation models used in modern games — particularly microtransactions involving paid acquisition of virtual packages with randomised content — we examine how these mechanisms interact with:

• Polish gambling law and the statutory definition of a game of chance,
• EU consumer protection rules,
• digital services regulation,
• taxation and compliance considerations,
• and emerging concerns related to behavioural design and dark patterns.

One of the key conclusions is that the regulatory importance of loot boxes stems not only from their possible resemblance to gambling mechanisms, but also from the fact that such systems are frequently used by inexperienced consumers, including minors, who may be especially susceptible to manipulative design techniques aimed at increasing engagement and spending.

This is precisely the type of cross-sector regulatory issue in which our team has extensive experience — combining expertise in technology law, highly regulated industries, digital services, compliance, consumer protection and EU regulatory frameworks. We are proud that this experience is reflected in publications appearing in professional journals such as Infor.

Read the article here: Infor – Loot boxes in video games: between gambling law and consumer protection

Artykuł Kiełtyka Gładkowski KG Legal has published an expert contribution in Infor, devoted to loot boxes in video games pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

Analysis of key changes for business managers

We have analyzed the proposed changes to criminal procedure, which introduce a new structure for conducting proceedings, moving away from the current, restrictive model. The foundation of the amendment is the liberalization of regulations and the strengthening of procedural guarantees for suspects, which is a direct response to the need to implement EU directives and restore the adversarial standard.

Compared to the current state of affairs, the draft law shifts away from the inquisitorial model and instead provides real legal protection for economic participants. These changes are crucial for individuals serving on corporate boards, effectively increasing their legal security in the area of risks inherent in running a business.

Recent years in Polish criminal procedure have been characterized by the primacy of procedural efficiency over individual rights, leading to a systematic tightening of discipline. This has manifested itself, among other things, in the facilitation of the use of preventive measures and the admission of evidence obtained illegally. Project 1600 makes a systemic shift towards strengthening citizen guarantees, restoring the principle of full equality of the parties and fair litigation. For the business sector, this means a real opportunity to actively shape their defenses at the pre-trial stage, instead of adopting a solely reactive approach.

A key element of this reform is to address years of neglect related to the implementation of the so-called EU defense directives (Directive 2013/48/EU of the European Parliament and of the Council of 22 October 2013 on the right of access to a lawyer in criminal proceedings and in European arrest warrant proceedings, and on the right to have a third party informed upon deprivation of liberty and to communicate with third persons and with consular authorities while deprived of liberty (OJ L 294, 2013, p. 1)). The existing regulations failed to meet European standards, which became the basis for the European Commission to initiate proceedings for Poland’s violation of its treaty obligations. The most important change in this regard is Article 245 § 1 of the Code of Criminal Procedure, which requires that a detained person be immediately allowed to contact a defense attorney and have a direct conversation. As the bill’s justification indicates, detention is a criminal act aimed at prosecuting, and therefore a lawyer or legal advisor providing assistance at this stage has full defense status. Furthermore, the introduction of mandatory on-call duty for lawyers and legal advisors, as defined in Article 245 § 2 of the Code of Criminal Procedure, guarantees effective legal assistance from the very first minute of the proceedings.

This solution is important for management bodies, as the isolation of an organization’s leader creates the risk of paralyzing the entity’s decision-making. The guarantee of immediate legal assistance enables the implementation of crisis management procedures and significantly reduces the risk of submitting flawed procedural declarations with a high degree of economic complexity.

Project 1600 introduces systemic mechanisms to limit the arbitrariness of imposing preventive measures in isolation. A significant change is the increase in the threshold for a severe sentence from 8 to 10 years (Article 258 § 2 of the Code of Criminal Procedure) and the requirement to demonstrate a real risk of perversion in each case. This eliminates the automatic nature of detention in commercial cases, obliging the court to assess whether the severity of the impending sanction actually poses a threat to the course of proceedings in the specific factual circumstances.

The new wording of Article 248 §§ 2 and 3 of the Code of Criminal Procedure serves to discipline law enforcement agencies. It introduces an absolute obligation to release a detainee if, within twenty-four hours (reduced from the current forty-eight) of being brought to the attention of the court, they are not served with a detention order and justification. The legislature establishes an absolute prohibition on re-arrest based on the same facts and evidence. This solution curbs the practice of circumventing procedural deadlines by repeatedly detaining an individual under the same circumstances. For governing bodies, this regulation guarantees the stability of their procedural status and protects personal freedom through repeated isolation.

The reform is complemented by the expansion of evidence disclosure. The amendment to Article 156 § 5a of the Code of Criminal Procedure removes the previous restriction on the exclusion of witness statements from accessible files. The current wording requires the authority to immediately provide the suspect and defense attorney with evidence attached to the arrest request. Restoring full equality of arms allows the defense to substantively refute the prosecution’s entire case, rather than select fragments. For management, implementing these rigors provides fundamental protection against the use of isolation as a pressure tool, directly protecting the reputation and operational stability of the company.

The planned amendment introduces a fundamental change to the Polish criminal process, restoring the primacy of procedural fairness to establishing the material truth at all costs. A key element of the reform is the definitive rejection of the admissibility of so-called “fruits of the poisonous tree,” which directly implements the fair trial standard. Under the current legal framework, shaped by the controversial wording of Article 168a of the Code of Criminal Procedure, evidence cannot be deemed inadmissible solely on the basis that it was obtained in violation of procedural rules or through a prohibited act. Therefore, previous case law permitted the procedural validation of evidence from unlawful sources, provided it was not obtained as a result of the most serious crimes (such as murder or deprivation of liberty). The amendment replaces this model with an absolute prohibition on using materials obtained as a result of a prohibited act. This excludes the possibility of subsequently deeming evidence obtained in violation of the law admissible and prevents law enforcement agencies from remedying procedural deficiencies by invoking an overriding public interest.

In the area of operational control, the reform introduces adequacy rules, which significantly modifies the current procedure for handling incidental evidence. The previous regime of Article 168b of the Code of Criminal Procedure allowed for almost unlimited use of wiretapping materials in cases involving any crime, even if they did not fall within the list of acts justifying the use of operational control. This led to a phenomenon referred to in the doctrine as fishing expeditions, where surveillance ordered in high-stakes cases became a gateway to seeking marginal violations, such as fiscal violations, which would not, in themselves, legitimize such a profound interference with civil liberties. The amendment thus compels the prosecutor to exercise a higher level of investigative diligence, shifting the defense’s focus from substantive analysis of evidence to reviewing the legality of its acquisition.

For the business sector, the implementation of these solutions brings enormous guarantee benefits, primarily in the form of protecting the integrity of business communications and eliminating uncertainty as to the procedural status of managers.

The analysis is based on the standards developed by the European Court of Human Rights in the context of Article 6 of the ECHR, as well as the constitutional principle of proportionality and the right to privacy. The new wording reflects the desire to civilize criminal procedure, where the reliability of state authorities becomes paramount over the ad hoc effectiveness of the public prosecutor, which is the foundation of economic security in a state governed by the rule of law.

The overall proposed changes to criminal procedure should be viewed as a significant strengthening of the legal position of entrepreneurs and management. The shift from an inquisitorial model to a fully adversarial and transparent judicial process significantly minimizes the risk of procedural abuses, which could previously be used as a tool for extraneous pressure in commercial disputes. The reinstatement of strict evidentiary prohibitions and the shortening of procedural deadlines for deprivation of liberty compel law enforcement agencies to adhere to a higher standard of diligence, which directly translates into the operational stability of businesses. Under the new legal framework, the most crucial element of a defense strategy is not only the substantive refutation of allegations but, above all, rigorous oversight of the legality of the state’s operational actions.

Sources:

Directive 2010/64/EU of the European Parliament and of the Council of 20 October 2010 on the right to interpretation and translation in criminal proceedings (OJ L 280, 26.10.2010, p. 1);

Directive 2012/13/EU of the European Parliament and of the Council of 22 May 2012 on the right to information in criminal proceedings (OJ L 142, 1.6.2012, p. 1);

Directive 2014/41/EU of the European Parliament and of the Council of 3 April 2014 regarding the European Investigation Order in criminal matters (OJ EU L 130, 1.5.2014, p. 1, OJ EU L 201, 30.7.2019, p. 47, OJ EU L 39, 21.02.2022, p. 1 and OJ EU L 2023/2843, 27.12.2023);

Directive (EU) 2016/343 of the European Parliament and of the Council of 9 March 2016 on the strengthening of certain aspects of the presumption of innocence and of the right to be present at the trial in criminal proceedings (OJ L 65, 11.03.2016, p. 1);

Artykuł Criminal Procedure Reform (Project 1600) – Polish Standards of Protection in Commercial Matters pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

Biostimulants in aesthetic medicine – current regulatory challenges for manufacturers, distributors and clinics

The aesthetic medicine market is currently one of the fastest-growing healthcare segments in Europe. Particularly dynamic growth is observed in so-called tissue biostimulants, preparations used to stimulate the body’s natural regenerative processes. While traditional fillers dominated just a few years ago, today both manufacturers and physicians are increasingly turning to preparations containing poly-L-lactic acid (PLLA), calcium hydroxyapatite, polynucleotides, and collagen preparations, whose mechanism of action is based on the stimulation of tissue regeneration processes rather than solely on mechanical effects.

The growing popularity of these products, however, raises a number of legal questions. These concern not only their qualification as medical devices, but primarily the manner of communicating their properties and permissible forms of promotion. In practice, manufacturers, importers, distributors, and aesthetic medicine clinics increasingly face the dilemma of drawing the line between providing reliable product information and advertising, which is subject to stringent legal restrictions.

This issue has become particularly important following the entry into force of the Act of April 7, 2022, on Medical Devices and the issuance of the Regulation of the Minister of Health on the Advertising of Medical Devices. Polish legislators have decided to introduce some of the most detailed regulations regarding the advertising of medical devices in Europe. These restrictions directly impact the activities of manufacturers, distributors, importers, healthcare providers, and marketing agencies serving the aesthetic medicine industry.

At the same time, it’s important to remember that advertising medical devices does not operate in isolation from other legal regulations. Businesses must consider not only the provisions of Regulation (EU) 2017/745 on medical devices (MDR) and the Medical Devices Act, but also regulations on consumer protection, combating unfair market practices, combating unfair competition, personal data protection, and sometimes regulations governing the practice of medical professions and healthcare activities. Consequently, a single marketing campaign may be subject to simultaneous assessment under several different legal regimes.

Particular difficulties arise with products used exclusively by individuals with appropriate professional qualifications. In practice, most biostimulants are administered via injection by a physician or other qualified medical professional. This raises the question of whether products intended exclusively for professional use can be advertised at all, and if not, how can businesses legally present information about their offerings on websites, social media, or at industry conferences.

The purpose of this study is to present practical aspects of applying regulations regarding the advertising of medical devices, using tissue biostimulants as an example. Particular attention will be paid to the boundary between advertising and information, the obligations of manufacturers and distributors, the most common marketing errors, and compliance solutions that can reduce the risk of violating applicable regulations.

Biostimulants – why do they raise so much legal controversy?

From a legal perspective, biostimulants constitute one of the most interesting categories of medical devices. Their specificity lies in the fact that, although formally subject to regulations specific to medical devices, their method of use, risk profile, and patient perception often resemble medicinal products more than traditional medical devices.

In market practice, patients often fail to recognize the difference between a medicinal product and a biostimulant. Both types of products are administered in a doctor’s office, require medical qualifications, involve intervention in the body, and may cause adverse reactions. Therefore, for the average consumer, the difference between a medicinal product and a medical device remains almost invisible.

From the perspective of EU law, however, what matters most is not the method of administration or the site of use, but the mechanism by which the principal intended action is achieved. The MDR is based on a fundamental distinction between medicinal products and medical devices. If the principal action is achieved by pharmacological, immunological, or metabolic means, the product will generally be classified as a medicinal product. However, if the mechanism of action is based on other properties – for example, physical or mechanical – the product may be classified as a medical device, even if its use leads to long-term biological effects.

This very boundary has been the subject of numerous interpretational disputes for years. In the case of biostimulants, the preparation does not replace natural processes occurring in the body nor does it produce a therapeutic effect through a pharmacological mechanism. Its purpose is to create conditions enabling the activation of natural regenerative processes, such as stimulating fibroblasts to produce collagen or rebuilding the extracellular matrix. It is this mechanism that causes most currently available biostimulants to be classified as medical devices.

This does not mean, however, that all products marketed as “biostimulants” automatically fall into the same regulatory category. Legal classification is determined by a case-by-case analysis of the specific product, its intended use, and the mechanism of action specified by the manufacturer. In practice, there are also products that, despite similar aesthetic applications, may be subject to different legal regimes, including regulations concerning medicinal products, cosmetics, and medical devices.

This is fundamental for subsequent marketing communications. Already at the product qualification stage, the manufacturer should consider the target audience, the information that can be conveyed to recipients, and the advertising restrictions that will apply. Mistakes made at this stage often result in the need to redesign the entire marketing strategy after the product has been launched.

Can biostimulants be advertised? Limitations under the Medical Devices Act and the MDR Regulation

One of the most frequently asked questions by manufacturers, importers, and healthcare providers is whether biostimulants can be advertised to a broad audience. The answer to this question is ambiguous and requires consideration of both the provisions of the EU MDR Regulation, the Polish Medical Devices Act, and implementing regulations governing advertising.

In practice, a certain pattern can be observed. Many entrepreneurs equate the fact that a product has been legally introduced to the market with the ability to freely promote it. However, this assumption is incorrect. Approval of a medical device for marketing does not automatically mean that the manufacturer or distributor can use any marketing tools. On the contrary, the more specialized the product and the greater the risk associated with its use, the greater the restrictions on its communication.

In the case of biostimulants, it is particularly important that the vast majority of these products are intended for use only by individuals with appropriate professional qualifications. Treatments using them require medical qualification, maintaining appropriate aseptic conditions, and injections performed in accordance with medical knowledge. Therefore, the recipient of the product is not the patient, but a medical professional who then uses the product while providing healthcare services or aesthetic medicine treatments.

This circumstance is of fundamental importance from the perspective of advertising law.

Advertising of medical devices is not advertising of consumer products.

The Medical Devices Act adopts different assumptions than the regulations governing the advertising of ordinary consumer goods. The legislator’s goal was not to create freedom in marketing activities, but to ensure that decisions regarding the use of medical devices are made primarily based on medical knowledge, not advertising messages.

For this reason, the legislator decided to introduce numerous restrictions on both the content of advertising and its target audience. In practice, this means that, already at the design stage of a marketing campaign, entrepreneurs should answer three fundamental questions:

• who is the actual user of the product,
• to whom the message is addressed,
• whether the information provided is of a promotional nature or purely informational.

Only a combined analysis of these elements allows us to assess the compliance of the planned communication with applicable regulations.

The intended use of the product is crucial.

In practice, there’s a common misconception that advertising opportunities are determined solely by how a product is sold. This isn’t the correct approach.

The manufacturer’s intended use of the product and the user group specified in the technical documentation and instructions for use are of much greater importance. If the manufacturer has specified that the product should only be used by professionals, this also influences the assessment of the admissibility of directing marketing messages to individuals without medical qualifications.

This is precisely the situation with most biostimulants. These products are intended for procedures requiring appropriate professional training, knowledge of anatomy, aseptic techniques, and the ability to recognize contraindications. From a regulatory perspective, it would be difficult to justify extensive advertising campaigns aimed at the general public when the product itself cannot be used independently by the average consumer.

This doesn’t mean, however, that businesses cannot provide any information regarding such products. On the contrary, the law permits the provision of information about medical devices, but the line between information and advertising requires individual assessment.

Advertising and information – why is the distinction so important?

In practice, the vast majority of disputes concerning medical device advertising do not focus on obvious promotional campaigns. Much more often, the problem arises with materials that businesses define as “informational,” while from the perspective of regulatory authorities, they may be considered advertising.

Importantly, neither the MDR nor the Medical Devices Act provide a legal definition of medical device advertising. However, the lack of a statutory definition does not imply any freedom of interpretation. Case law and doctrine assume that the nature of a message is primarily determined by its actual purpose, not the name given to it by the trader.

If the primary purpose of the message is to increase interest in the product, build a positive image of the product or encourage its purchase or use, there is a high probability that the message will be classified as advertising, regardless of whether it contains a direct call to purchase.

In practice, this means that even seemingly neutral materials may be considered advertising if they are prepared in a way that highlights only the advantages of the product, ignores its limitations or uses characteristic marketing techniques.

Is the manufacturer’s website itself an advertisement?

This is one of the most frequently asked questions in the practice of law firms advising manufacturers of medical devices.

There is no single universal answer to this question.

The mere presence of product information on a website does not constitute advertising. A website can function as a product catalog, a database of technical documentation, or a platform for communicating with medical professionals. However, if the product’s presentation goes beyond providing objective information and begins to utilize typical marketing mechanisms, the risk of such communication being classified as advertising significantly increases.

For example, posting instructions for use, declarations of conformity, technical data, or information on how to use a product on a website will generally be informative. However, a situation in which the same website includes slogans such as “revolutionary rejuvenation method,” “the most effective biostimulator available on the market,” “instant lifting effect,” or “spectacular results guaranteed” should be assessed differently. In such cases, the message goes beyond neutral information and begins to serve a promotional purpose.

Therefore, designing websites for medical device manufacturers requires close collaboration between marketing departments and legal and regulatory affairs departments . In practice, even seemingly minor changes in product presentation can result in a different legal classification for the entire message.

The boundary between advertising and information – practical problems of producers and aesthetic medicine clinics

While the distinction between advertising and information seems intuitive, in practice it is one of the most problematic issues related to the functioning of the medical device market. This stems primarily from the fact that contemporary marketing communication rarely takes the form of classic television or print advertising. Businesses much more frequently utilize websites, social media, newsletters, podcasts, webinars , expert blogs, and educational materials. Each of these forms can—depending on how it is prepared—be considered both neutral information and advertising.

In practice, there is no single element that automatically determines the classification of a given message. Supervisory authorities and courts analyze all the circumstances, taking into account the content of the message, its form, presentation, audience, and the actual purpose of the publication. This means that even a message containing only truthful information may be considered advertising if its primary purpose is to encourage the purchase or use of a product.

For this reason, businesses should move away from the simple question: “Are we allowed to publish this information?” and instead ask themselves: “How will the average recipient perceive this message?” It is the recipient’s perspective, not the business’s intention, that will in many cases determine the legality of the message.

Website – an entrepreneur’s business card or an advertising tool?

The first place where doubts arise is almost always the manufacturer’s, distributor’s, or clinic’s website. For many businesses, it is their primary channel of communication with the market, yet it is also one of the most frequently scrutinized elements during inspections conducted by regulatory authorities.

The mere presence of information about a medical device on a website is not prohibited. Businesses have the right to present information about the products offered, their properties, methods of use, technical documentation, and instructions for use. However, problems arise when the presentation method goes beyond providing objective information.

A good example is comparing two descriptions of the same product.

The first one could be as follows:

“A preparation intended for the reconstruction of tissue volume in accordance with the instructions for use. The product is intended for use by qualified medical professionals.”

This description is for informational purposes only. It is limited to presenting the product’s intended use and user group.

The following message should be assessed differently:

“The most innovative biostimulator on the market. It instantly rejuvenates the skin and provides a spectacular lifting effect after just one treatment.”

Although both messages refer to the same product, the second employs typical marketing tactics. It uses evaluative terms (“the most innovative,” “spectacular effect”), promises of effectiveness, and suggests a competitive advantage. This type of message is difficult to consider as neutral technical information.

In practice, this means that entrepreneurs should analyze not only the content of the information, but also the way it is expressed. Often, it is individual marketing terms that determine the overall nature of the message.

Newsletters and mailings to customers

Another tool increasingly used by manufacturers and distributors is newsletters and emails directed to customers. Again, not every message can be considered advertising.

If a newsletter contains information about changes in regulations, new regulatory requirements, announcements from supervisory authorities, or changes to product instructions, it will generally serve an informative purpose. However, messages whose primary purpose is to increase sales of a specific product should be assessed differently.

For example, a message titled “Changes to MDR requirements for technical documentation” would be educational in nature. An email with the slogan “Discover the most effective biostimulant available on the market – order today” would undoubtedly serve an advertising function.

This does not, of course, prohibit commercial communication. However, entrepreneurs should remember that such communication is subject to all restrictions applicable to advertising medical devices.

Webinars and training – education or product promotion?

The significant increase in the popularity of webinars organized by medical device manufacturers has also led to this form of communication starting to attract the attention of supervisory authorities.

Organizing training for doctors and other medical professionals is nothing unusual. On the contrary, in many cases, proper user training is an essential element in ensuring the safe use of a device.

The problem arises, however, when a webinar described as a “scientific training” actually focuses almost exclusively on promoting one product, highlighting its advantages while omitting limitations, contraindications, and alternative methods of treatment.

In practice, it is worth adopting the principle that the more educational the material is, the greater the emphasis should be on presenting objective medical knowledge, and not only information beneficial to the manufacturer.

Scientific conferences

Similar problems apply to industry conferences. Sponsorship of scientific events by medical device manufacturers is common practice and raises no objections in itself. However, risks arise when the scientific component is subordinated to marketing objectives.

In practice, particular caution should be exercised when presenting research results for a specific product. Results should be presented honestly, taking into account methodological limitations and the full clinical context. Selectively presenting only favorable data may be viewed as misleading.

LinkedIn – professional communication can also be advertising

Many content creators assume that since LinkedIn is primarily a professional platform, the content published there is strictly business-related. However, this assumption is far-fetched.

If a LinkedIn entry is limited to information about participation in a conference, obtaining a certificate, a scientific publication or organizational changes in the company, it is generally difficult to attribute an advertising nature to it.

However, if a publication contains incentives to use a specific product, comparisons with competitive products, promises of specific clinical effects or highlights the advantages of a product in order to increase sales, it may be considered advertising, regardless of the fact that it was published on a professional website.

LinkedIn is increasingly being used as a marketing platform for the healthcare market. Therefore, communications conducted via this platform should also be subject to the company’s internal compliance procedures.

Social media – the biggest challenge for the biostimulant market

Social media has completely transformed the way patients make decisions. Just a dozen or so years ago, the primary source of information was a doctor’s consultation and manufacturer-provided materials. Today, many patients primarily seek information on Instagram, TikTok, Facebook, and YouTube, guided by the opinions of influencers , physicians with educational profiles, and other users’ testimonials.

For entrepreneurs, this represents a huge marketing opportunity, but also significant regulatory risk. Traditional regulations regarding medical device advertising were designed with press, radio, and television advertising in mind. Modern online communication is much more dynamic and often combines elements of education, personal branding, and product promotion. As a result, assessing the legality of a specific message requires a case-by-case analysis of its actual purpose and context.

Instagram – where does education end and advertising begin?

Instagram remains the most important communication channel used by aesthetic medicine clinics and physicians performing biostimulant treatments. This platform relies primarily on visual communication, which inherently has a stronger impact on audiences than traditional product descriptions.

From a legal perspective, however, it cannot be assumed that every post about a procedure constitutes advertising. Physicians have the right to conduct educational activities, explain the mechanisms of individual procedures, discuss indications and contraindications, and comment on scientific publications. Such activities contribute to increasing patient awareness and should not, in and of themselves, be equated with advertising.

The line is crossed when communication begins to focus on promoting a specific medical device or building its commercial appeal. This applies particularly to publications containing marketing slogans, incentives for procedures, information about price promotions, comparisons with competing products, or emphasizing the exceptional effectiveness of a specific product without providing the full medical context.

In practice, it is worth adopting the rule that the more a post resembles advertising material prepared by a marketing agency, the greater the risk of it being classified as an advertisement for a medical device.

TikTok – short form does not exempt from responsibility

Just a few years ago, few medical device manufacturers considered TikTok a business communication tool. Today, the situation is completely different. More and more clinics are publishing short videos demonstrating treatment procedures, patient reactions, and the aesthetic effects achieved after using specific products.

The specific nature of this platform, however, means that the message is necessarily simplified. A video lasting several dozen seconds rarely allows for the presentation of contraindications, possible side effects, or limitations of the product’s use. As a result, there is an increased risk of creating a one-sided image of the product, highlighting only its benefits.

From a compliance perspective , businesses should therefore exercise particular caution when preparing materials published on platforms based on short audiovisual forms. Merely shortening the message does not exempt them from ensuring its compliance with regulations on advertising medical devices.

Influencer Marketing – New Regulatory Risk

influencers remains one of the most dynamically developing areas of marketing. This phenomenon has also impacted the aesthetic medicine market. Increasingly, individuals with significant social media followings are publishing treatment reports, presenting their recovery processes, and describing their own experiences using specific products.

From a legal perspective, such collaboration requires special caution. Even if the influencer doesn’t mention a specific product, the way the treatment is presented can lead to increased interest in a specific technology or manufacturer. If the publication is created as part of a commercial collaboration, additional obligations arise under regulations regarding labeling advertising content and consumer protection.

In practice, the producer should remember that responsibility for the legality of the message is not always limited solely to the influencer. Depending on the cooperation model, the entrepreneur initiating the campaign may also be responsible for the manner in which marketing communications are conducted.

Doctor as a product ambassador

The use of physicians’ authority to promote medical products remains a particularly sensitive issue. Public trust in medical professionals means their statements have a much greater impact than traditional advertising messages.

This doesn’t mean, however, that doctors cannot publicly comment on the technologies they use. On the contrary, sharing medical knowledge, clinical experience, and research results is a crucial element in the development of medical science and practice. The problem arises only when a doctor’s statement ceases to be expert-based and begins to serve a marketing function.

The risk increases especially when a physician appears in manufacturer-produced materials, uses promotional language, or explicitly encourages consumers to choose a specific product. In such cases, the regulatory authority may determine that the use of the medical profession’s authority serves to increase the product’s commercial appeal, which requires assessment from the perspective of regulations governing the advertising of medical devices.

Before – after photos – an effective marketing tool or a source of risk?

One of the most distinctive elements of communication in aesthetic medicine is photographs depicting the patient’s appearance before and after the procedure. From a marketing perspective, this is an extremely effective tool for influencing potential clients. However, from a legal perspective, its use raises a number of concerns.

Firstly, such materials often lead the recipient to believe that the treatment will provide a guaranteed result. However, the results of medical procedures depend on numerous individual factors, such as the patient’s health, age, biological predispositions, and adherence to post-treatment recommendations . Presenting single, spectacular results can lead to unrealistic expectations.

Secondly, publishing patient photos requires compliance with regulations on personal data protection and the protection of personal rights. Consent to perform a procedure does not constitute consent to the dissemination of the image. The provider should obtain separate, informed, and voluntary consent covering the publication of photographs in specific communication channels.

Third, it’s important to remember that even properly obtained patient consent doesn’t eliminate the risk of a publication being considered an advertisement for a medical device. If a photo is used to promote a specific product or increase interest in a specific procedure, the entire message should be assessed in light of advertising regulations.

In practice, this means that the use of ” before – after ” photography requires simultaneous analysis from the perspective of medical device law, personal data protection, civil law, and consumer protection regulations. Failure to consider even one of these aspects can lead to significant legal risk.

Misleading advertising – why can a truthful message also violate the law?

One of the most common mistakes made by businesses operating in the medical device market is the belief that because all information contained in an advertisement is truthful, the message is automatically legal. However, this assumption is far-fetched and is not supported by either the EU MDR or national regulations regarding medical device advertising.

Assessing the legality of advertising is not limited to verifying the veracity of individual claims. Equally important are the manner in which they are presented, the context of the overall message, and the potential impact on the recipient’s decisions. Advertising can be misleading not only by providing false information, but also by selectively presenting facts, omitting important limitations, or emphasizing only the positive aspects of a product’s use.

This is why Article 7 of the MDR should be considered one of the key regulations governing the marketing communications of medical device manufacturers. This provision prohibits the use of texts, names, trademarks, images, symbols, or other markings that could mislead the user or patient regarding the intended purpose, safety, or performance of the device. This prohibition applies not only to labels and instructions for use but also to advertising materials and other forms of market communication.

In practice, this means that an entrepreneur should analyze each message not only in terms of compliance with the product’s technical documentation, but also from the perspective of how the average recipient might interpret the information presented.

Not only falsehood, but also silence

One of the most frequently underestimated aspects of advertising is the responsibility for omitting information that is important to the recipient. Businesses typically focus on avoiding false claims, much less on analyzing the consequences of omitting specific information.

Imagine an advertisement for a biostimulator in which the manufacturer presents excellent aesthetic results achieved after the treatment. All photographs are authentic, and the description of the effects reflects the actual experiences of selected patients. At the same time, the advertisement contains no information about the need for medical qualification, possible contraindications, the risk of side effects, or the body’s varied response to treatment.

Formally, none of the claims presented are false. Nevertheless, the recipient may be misled into thinking that achieving the presented effect is typical, predictable, and practically guaranteed. Consequently, the message may be considered misleading because it creates unrealistic expectations regarding the product’s performance.

A similar risk arises when using terms such as “safe,” “non-invasive,” “natural,” or “side-effect-free.” Even if a product has a high safety profile, using such phrases can imply an absence of risk, which is difficult to reconcile with clinical reality.

Can we use the terms “best”, “most effective” or “revolutionary”?

Marketing language often relies on the use of evaluative terms. Advertisements feature phrases such as “market leader,” “the most innovative product,” “the best rejuvenation technology,” or “a breakthrough in aesthetic medicine.” In the consumer goods sector, this type of communication is common. However, when it comes to medical devices, much greater caution is required.

First, an entrepreneur should have objective evidence to support any comparative or evaluative claim. Second, even the existence of scientific research does not always justify the use of terms suggesting absolute superiority over all competing solutions. In medical practice, the effectiveness of therapy depends on many factors, including the patient’s qualifications, the physician’s experience, and individual biological conditions.

From a compliance perspective, a much safer solution is to use a description based on clinical trial results and technical parameters of the product, instead of using general marketing slogans.

Practice of supervisory authorities – the growing importance of digital communication

Recent years have seen a significant increase in supervisory authorities’ interest in online communications. While previously, oversight activities focused primarily on traditional advertising materials, they now also analyze websites, social media profiles, newsletters, videos published on streaming platforms , and collaborations with influencers.

This trend is consistent with a broader trend observed at the EU level, where increasing emphasis is being placed on countering manipulative marketing practices and ensuring a high level of protection for consumers using healthcare services. Consequently, businesses should assume that online communications are subject to the same scrutiny as traditional forms of advertising.

The Polish Office of Competition and Consumer Protection and consumer protection – the second pillar of responsibility

Although the primary legislation regulating the advertising of medical devices remains the Medical Devices Act, businesses cannot limit their analysis solely to this legal regime. Consumer protection regulations also apply, in particular the Act on Combating Unfair Market Practices and the Act on Competition and Consumer Protection.

From the perspective of the President of the Office of Competition and Consumer Protection (UOKiK), the impact of a message on the average consumer is of particular importance. If a communication exploits emotions, raises unjustified expectations, or suggests characteristics that the recipient is unable to independently verify, it may be considered a practice that violates the collective interests of consumers.

In practice, this means that a single marketing campaign may be assessed simultaneously by different authorities under different legal frameworks. Manufacturers should therefore design their marketing activities to ensure compliance not only with medical device regulations but also with consumer protection and fair competition regulations.

Compliance instead of reaction after inspection

Experience in recent years shows that a significant number of violations are not the result of deliberate actions by businesses, but rather a lack of appropriate internal procedures. Marketing materials are often prepared by external advertising agencies that are intimately familiar with the mechanisms of selling consumer products but lack experience in the regulated sector.

compliance systems that encompass the entire marketing communications process is becoming increasingly important . Every piece of content – whether it’s an Instagram post, a product brochure, a webinar , or a YouTube video – should be reviewed not only by the marketing department but also by those responsible for regulatory and legal matters.

This approach allows for the identification of risks before the material is published, reducing the likelihood of initiating administrative proceedings, disputes with supervisory authorities and negative image consequences.

The most common mistakes of manufacturers, importers, distributors and clinics – what to avoid in practice?

Recent experience shows that most violations of regulations regarding medical device advertising do not result from deliberate disregard for applicable regulations. Quite the opposite – entrepreneurs operating in the aesthetic medicine market typically strive to conduct their business in compliance with the law, but they encounter difficulties resulting from ambiguous regulations and the dynamic development of modern communication channels. Marketing of medical products is increasingly conducted via social media, educational platforms, and industry events, whereas existing regulations were primarily designed with traditional forms of advertising in mind.

In practice, however, there are several recurring mistakes that occur regardless of the size of the company and which should be taken into account when designing a marketing strategy.

Mistake No. 1 – Equating commercial information with neutral information

One of the most common misconceptions is that material doesn’t constitute advertising solely because a business owner has designated it as “information.” This approach is unsupported by applicable law.

The nature of a message is assessed based on its actual function, not the name given by the author. If the material highlights the benefits of a specific product, builds its market appeal, or is intended to encourage the recipient to choose a specific product, there is a high probability that it will be classified as an advertisement, even if it does not contain a classic call to purchase.

An example would be an article published on the manufacturer’s website titled “Modern Skin Regeneration Possibilities.” If the majority of the text is devoted to a single product, highlights its advantages over the competition, and leads to a contact form allowing purchase of the product or registration for training, it’s difficult to consider such material solely educational.

In practice, entrepreneurs should remember that supervisory authorities analyze not only the content of the publication, but also its location, method of presentation and connection with the entrepreneur’s business activity.

Mistake #2 – Copying Cosmetic Product Marketing

The aesthetic medicine market is developing in parallel with the cosmetics market, resulting in many marketing activities being mutually inspired. However, from a regulatory perspective, this approach can lead to serious problems.

Cosmetics marketing relies primarily on building emotions, visual appeal, and creating a specific lifestyle. Meanwhile, communication regarding medical devices is subject to much more stringent requirements. Using identical marketing techniques for products covered by the MDR may lead to violations of advertising regulations, especially if the message ignores the limitations imposed by the product’s intended use or its method of use.

In practice, this means that the marketing department of a medical device manufacturer should not automatically use solutions used in cosmetic campaigns, even if they seem effective from a business point of view.

Mistake No. 3 – overexposing the effects of the treatment

Marketing materials for biostimulants often focus almost exclusively on aesthetic effects. Images depicting wrinkle smoothing, facial contour improvement, or increased skin firmness undoubtedly attract audiences and enhance the message’s appeal.

The problem, however, is that the results of aesthetic medicine treatments are individual. They depend on the patient’s age, health, skin condition, previous medical procedures, lifestyle, and the experience of the practitioner. Presenting individual, exceptionally positive results without proper context can lead to unrealistic expectations on the part of potential patients.

From a compliance perspective , it is much safer to present information about the mechanism of action of the product and its intended use than to focus all communication on spectacular visual effects.

Mistake No. 4 – Ignoring contraindications and limitations of use

Another common mistake is presenting a product solely through the lens of its benefits. Marketing materials often emphasize the product’s effectiveness, innovation, and safety, while failing to mention situations in which its use may be inadvisable.

Meanwhile, reliable communication regarding medical devices should also include information about contraindications, limitations of use, and the need for medical qualification. This doesn’t mean, of course, that every advertisement must include full instructions for use, but omitting all information regarding potential risks could lead to accusations of misleading consumers.

Mistake #5 – Lack of cooperation between marketing and legal departments

In many companies, marketing materials are prepared by external creative agencies or marketing departments that lack specialized knowledge of medical device regulations. Only then does the completed material reach the legal department, often just prior to publication.

affairs specialists and lawyers at the marketing campaign design stage. This avoids the need for later material withdrawal or costly modification.

Mistake #6 – Lack of social media procedures

Many companies have extensive procedures for approving product catalogs and printed materials, yet they don’t regulate the rules for publishing content on social media. Yet, it’s short posts on Instagram, Facebook, and LinkedIn that are currently published most frequently and have the greatest impact on a company’s image.

The lack of internal guidelines leads individual employees to publish content at their own discretion, often unaware of the legal consequences of using specific phrases or photographs. In practice, it’s worth developing separate policies for online communication, covering topics such as product presentation, use of photographic materials, publishing coverage of industry events, and collaborating with physicians and influencers.

Compliance practices – how to organize legal marketing communications?

Compliance system shouldn’t be limited to merely responding to emerging issues. Its primary goal is to prevent violations by establishing transparent rules for preparing and approving marketing materials.

In practice, a growing number of medical device manufacturers are implementing multi-stage approval procedures involving marketing departments, regulatory affairs specialists, quality control departments, and lawyers. This model allows for the assessment of a material not only in terms of its marketing appeal but also its compliance with the product’s technical documentation, instructions for use, and applicable regulations.

Maintaining documentation of the approval process is also particularly important. In the event of an audit, the company should be able to demonstrate that the materials were prepared in accordance with internal procedures and reviewed by appropriately qualified individuals. Archiving subsequent versions of materials, legal opinions, and publication decisions can be of significant evidentiary value.

In practice, a well-functioning compliance system shouldn’t be perceived as an obstacle to marketing activities. On the contrary, properly designed procedures enable legally secure communication, reducing the risk of administrative sanctions and disputes with supervisory authorities, while building trust with customers and business partners.

European perspective – why will the importance of compliance systematically grow?

Polish regulations on medical device advertising are currently among the most detailed in the European Union. However, this does not mean that businesses operating in the domestic market can limit themselves solely to knowledge of the provisions of the Medical Devices Act and the Regulation of the Minister of Health. The functioning of the medical devices market is increasingly determined by the practice of applying the MDR, the positions of EU bodies, and the actions of national regulatory authorities in individual member states.

The MDR does not contain comprehensive regulations on the advertising of medical devices. It focuses primarily on product safety, manufacturers’ obligations, conformity assessment, and the rules for placing devices on the market. At the same time, Article 7 of the MDR establishes the general principle that all communication about a device – regardless of its form – must not mislead users or patients about the product’s intended purpose, properties, safety, or efficacy.

In practice, this provision serves a much broader purpose than the classic ban on misleading advertising. It constitutes a specific interpretative principle that should be considered when assessing every form of communication conducted by a manufacturer or distributor. Increasingly, supervisory authorities are moving away from formalistic analysis of individual advertising slogans and focusing on the overall perception of the message by the average user.

At the same time, the activities of Medical Device Coordination Group (MDCG) highlights the growing importance of transparent information provided to users of medical devices. Although MDCG documents are not legally binding, in practice they guide the interpretation of MDR provisions by national authorities and notified bodies. Increasing emphasis is being placed on ensuring consistency between a device’s technical documentation, instructions for use, and market communications.

It can be predicted that in the coming years, marketing control will encompass not only traditional advertising but also recommendation algorithms of online platforms, message personalization, the use of artificial intelligence in marketing, and automated advertising profiles. The development of new technologies is blurring the lines between information, advertising, and educational content.

For manufacturers, this means moving away from a one-time approach to assessing marketing materials. Implementing ongoing compliance procedures that enable ongoing assessment of communications’ compliance with rapidly evolving regulatory requirements will be much more effective.

Practical checklist compliance before publishing marketing materials

In practice, most violations can be avoided by implementing simple verification procedures. Before publishing material regarding a medical device, it’s important to answer the following questions:

First, is the product intended for use by laypeople or exclusively by professionals? The answer to this question determines the acceptable scope of communication and the target audience.

Secondly, is the planned material truly informative, or is its primary purpose to increase interest in the product? When in doubt, it’s worth adopting a more cautious approach and evaluating the message according to advertising principles.

Third, are all claims regarding product properties supported by technical documentation, instructions for use, and conformity assessment results? Marketing departments should not independently make new claims regarding product effectiveness or safety.

Fourthly, does the material use evaluative terms such as “best”, “most effective”, “revolutionary” or “guaranteed effect”, the validity of which could be questioned by the supervisory authority?

Fifth, does the message include product use restrictions, the need for medical qualification, and other information relevant to user safety?

Sixth, does the publication contain photographs or recordings of patients? If so, it is necessary to verify not only compliance with regulations on advertising medical devices, but also the basis for processing personal data, the scope of consent granted, and the protection of personal rights.

Seventh, was the material reviewed by those responsible for regulatory and legal matters? In practice, even minor linguistic changes can significantly alter the legal assessment of the entire message.

Eighth, does the entrepreneur have documentation confirming the material approval process? In the event of an audit, the ability to demonstrate organizational diligence can be crucial to assessing the entrepreneur’s actions.

Summary

The development of the biostimulator market is one of the most dynamic areas in contemporary aesthetic medicine. These products respond to growing patient expectations for natural tissue regeneration methods, while simultaneously posing entirely new regulatory challenges for manufacturers, importers, distributors, and healthcare providers.

Contrary to popular belief, the biggest problem today isn’t the mere ability to advertise. The key challenge remains the ability to communicate effectively, while simultaneously providing accurate product information and complying with stringent legal requirements. The line between information and advertising is becoming increasingly blurred, especially in the digital environment, where communication occurs via social media, educational platforms, and artificial intelligence tools.

From the perspective of entrepreneurs, this means a shift in thinking about medical device marketing. Instead of treating compliance as a final stage of reviewing advertising materials, it’s worth viewing them as an integral element of the process of designing market communication. Early involvement of legal, regulatory, and quality specialists not only reduces the risk of administrative sanctions but also builds brand credibility and audience trust.

It can be expected that the requirements for communication transparency will systematically increase in the coming years. The development of artificial intelligence, data-driven marketing, and message personalization will force supervisory authorities to increasingly scrutinize not only the content of advertisements but also their distribution and impact on audience decisions. In this environment, competitive advantage will be achieved not by those businesses that conduct the most aggressive marketing communications, but by those that manage to combine innovation with regulatory responsibility.

Artykuł Biostimulants under the microscope of the law – where does information end and prohibited advertising of medical devices begin? pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

Jan K., a literature enthusiast with an extraordinary fondness for Polish children’s poetry, finally managed to find a very rare book after a long search – an edition of Julian Tuwim’s “Locomotive,” which he purchased without hesitation from a used bookstore in Maryland, USA, via the online platform AbeBooks. The ease and simplicity of the solution – clicking the “BUY NOW” button, which would soon bring his dream book to him – combined with the bargain price for such a sought-after rarity in the reading community, filled Jan K. with optimism. From that moment on, he simply waited for the Polish Post to knock on his door and deliver him the publication he considered the opportunity of a lifetime. Perhaps it would have been, had Jan K. considered the key issues surrounding importing goods from the USA and the associated costs.

In analyzing the above case, it is crucial to focus on the fundamental concepts related to consumer rights and obligations, which have legal implications – and which can be reduced to the following questions: who does Jan K. become and what does he do in this regard? Given the dynamic growth of global e-commerce between the European Union and the United States, current regulations impose on consumers the role of participants in trade in goods. Under the Union Customs Code, and as confirmed by the case law of the Court of Justice of the European Union (CJEU), goods mean any product that has a measurable monetary value and, as such, may constitute the subject of a commercial transaction. Therefore, every shipment of goods is subject to customs supervision upon crossing the EU border (Article 134, point 1 of Regulation 952/2013 establishing the Union Customs Code), which also includes customs control (Article 5, point 3 thereof), which refers to specific verification activities performed by customs and tax authorities, such as a search of the goods. This procedure may also involve the risk of a customs debt (Article 5, point 18, ibid.), which would impose on the debtor (Article 5, point 19, ibid.) the obligation to pay the applicable shipping charges. Furthermore, raising the issue of a customs representative – in the form of direct or indirect representation (Article 18, point 1, ibid.), Poczta Polska could potentially become this representative.

Returning to Jan K.’s case, since the book meets the definition of a commodity, the consumer effectively becomes an importer of non-EU goods. The American sales platform was therefore merely a tool enabling the transaction and payment, acting solely as an intermediary between the seller and the buyer. Therefore, the consumer bears all legal responsibility for the authenticity of the documents submitted to Poczta Polska for clearance. Returning to reality, Jan K. should pay attention to important legal aspects when purchasing a unique reading item. It’s worth starting by separating the price of the goods from the shipping costs.

Higher mathematics – calculating customs value

If additional fees related to importing goods from the US to Poland are not included in the price, you should calculate how much you will actually pay for shipping, as the final customs value is made up of several additional fees. Shipping to the EU must first be added to the product price. Customs duty, which varies depending on the product type, is added to this amount (this information is available, for example, in the Polish ISZTAR tariff system or the European TARIC). This amount becomes our VAT base, and the tax is calculated from it. Estimating the total cost of goods, including import, significantly helps in making rational consumer decisions and can save our wallets, sometimes unprepared for additional financial burdens.Play

When tariffs work and when they don’t

Is Jan K. rightly happy about his bargain, or will he first have to contend with the customs system? Until now, a fairly favorable rule existed, according to which shipments up to €150 worth were completely duty-free. However, July 1, 2026, introduces a revolution in this area – the duty exemption is replaced by a flat-rate duty mechanism of €3 for each item, representing a group of goods of the same type, and therefore classified under the same CN code. Although from a customs perspective, the seller would be the customs debtor, the Ministry of Finance emphasizes that how this cost is calculated depends on the business policy of the given platform. Many American platforms add the flat-rate duty to the final price in the basket or in the shipping costs. Additional fees may also be related to the seller’s shipping terms – the seller may declare that they will cover import duties (DDP), or the buyer may be responsible for this, and may be charged a surcharge (DAP). Failure to establish clear shipping terms often results in the buyer being required to pay, a fact that only becomes apparent upon delivery. For this reason, Jan K. should verify the terms he agrees to and what additional costs are included in the price.

The IOSS and OSS procedures may provide some stability in terms of fees. IOSS, which applies to purchases of physical goods, including those from the US, is aimed at non-EU entities that conduct distance selling of imported goods (SOTI) and have established an intermediary that is an active VAT payer in Poland. Currently, this system is used by the vast majority of large platforms in the US, such as Amazon, eBay, Etsy, and Shopify, although additional verification is always helpful. EU and non-EU OSS, on the other hand, are primarily useful for digital services (e-books, games), telecommunications and broadcasting services (internet-based television signal delivery), and other intangible services (e.g., educational services). However, a key aspect of the IOSS system, which we will discuss in more detail in the context of purchases on US platforms, is the value threshold – if the actual value of a physical book is within €150, the platform will collect Polish VAT directly during the payment transaction. However, if this value were higher than EUR 150, IOSS cannot be used and the parcel is subject to the standard customs procedure requiring declaration on the SAD H1 document in the AIS-IMPORT system (i.e. use of the VAT E-Commerce system).

Where is the Polish Post Office in all this?

Article 19 of the Customs Law is a treasure trove of knowledge on the proper conduct of customs procedures – it regulates, among other things, the procedure for presenting goods and filing customs declarations in postal traffic handled by a designated operator. This is where Poczta Polska SA comes in, fulfilling this role, thus acting as a link between the e-consumer and the foreign operator. As mentioned earlier, anyone can appoint a customs representative, acting directly or indirectly. However, in the case of shipments imported from countries such as the USA, there is a certain institutional facility known as tacit (implicit) customs representation.

This mechanism works simply: if the actual value does not exceed €150, the designated operator, i.e., Poczta Polska, will be authorized by law to file a customs declaration on behalf of and for the benefit of the recipient (unless the consumer objects to the notification of arrival). What does this mean in practice? The platform simply adds Polish VAT at the time of purchase. If it uses the IOSS system, the customs declaration in the e-commerce system is submitted using the simplified H7 customs declaration, and the consumer receives the parcel from the Poczta Polska postman at no additional charge upon delivery. If the platform is not equipped with IOSS, VAT must be calculated and collected upon the goods’ arrival in the EU, which means the consumer pays VAT under the general rules upon delivery.

What if the shipment value exceeds €150? The problem of verifying whether the platform uses IOSS resolves itself somewhat. In this case, the platform loses its customs supplier status and assumes only accounting obligations, and therefore, customs and tax duties are settled within the scope of full customs declarations in the national AIS-IMPORT system in the importing country. Poczta Polska does not have an implied power of attorney in this case – the recipient receives a notification and must submit the required documents within 14 days, grant Poczta Polska a customs power of attorney, or otherwise perform customs clearance on their own.

Cooperation with Poczta Polska – proper documents for conscientious service

Courier companies are becoming increasingly popular, ensuring efficient delivery and clear communication. However, when importing goods from a non-EU country, additional fees may be charged. Poczta Polska often proves to be a more cost-effective alternative, but it requires a complete set of documents. This list includes: confirmation of the type and value of the goods; proof of payment: shipping costs, insurance, and any discount information; recipient details and additional documents such as certificates and permits (in transactions between private parties, a “declaration regarding the goods contained in the shipment” in the case of gifts). Importantly, the better the description of the parcel, the less chance of additional complications, such as the need to clarify the contents, prepare corrections, or delays.

Polish Post’s negative dictionary

Since we’ve touched on customs situations that can prove particularly problematic, we should mention Poczta Polska’s blacklist of goods – or rather, its negative vocabulary. This list lists goods for which Poczta Polska does not perform customs clearance under the VAT E-commerce package; customs clearance is handled independently. These primarily include: goods shipped as commercial samples, medicines and medical devices (high risk of shipment detention), food (possible additional inspections), plant and animal products (often subject to separate sanitary regulations), weapons, collectibles and counterfeits (intellectual property rights), electronics with batteries (frequent transport requirements), alcohol and tobacco products (tax regime and quantity restrictions). These goods therefore require special care and adherence to formal requirements, not to mention the need for full customs clearance using the SAD H1 import document.

Other (this time favorable) exceptions

Goods that deviate from the rule regarding proper customs clearance can also have a positive impact on the consumer. These special situations include, among other things, customs duty exemption. Under Article 203(3) of Implementing Regulation 2015/2447, non-Union goods that originally had EU status are exempt from import duties as a result of being exported from outside the EU and then re-imported within three years and released for free circulation. Another example, although going beyond sales on foreign sales platforms, are gifts with an actual value of up to €45 – they are completely exempt from customs duty if they are a private-to-private, occasional, free-of-charge, and appropriately marked package (excise goods do not apply here).

How will all this work in practice? The case of Jan K.

To this end, let’s consider two scenarios: in the first, Jan K. managed to snag his dream book for only €50, as it didn’t stand out from the catalog of books available at the second-hand bookstore. In the second, Jan K. paid €300 for “Lokomotywa” (The Locomotive), as it was a collector’s edition, practically unavailable in the current reading market. The AbeBooks platform, like most major American platforms, uses the IOSS system. What path will a consumer of the American sales platform have to take to enjoy their desired book?

Scenario 1: Locomotive below €150

The customs value is immediately apparent – Polish VAT was added to the price of the goods, and payment was made via the AbeBooks platform, while imports at the border are VAT-exempt. Although the flat-rate customs duty of €3 per item should have been paid through the platform, Jan K. should be aware that this amount could have been included in the price of the book itself or in the shipping costs. The parcel was shipped from the USA, and the seller marked it with the platform’s IOSS identification number. Jan K. did not object, so Poczta Polska became the tacit customs representative and processed the clearance automatically, using a simplified H7 customs declaration in the e-commerce system. The parcel was not classified as a collector’s item, which was due to the seller’s precise and detailed descriptions. A Poczta Polska postman delivered the parcel to Jan K., and from that moment on, he was able to immerse himself in Tuwim’s poetry.

Scenario 2: “Locomotive” above €150

Now let’s analyze a slightly less favorable option for Jan K.: Here, customs duty and VAT are not included in the book’s price, which initially pleased Jan K. The seller shipped the package, but because it was shipped from the United States, the carrier must submit an Entry Summary Declaration (ENS) and lodge it with the appropriate customs office before the goods arrive. An ENS would not be necessary only if the sale was made from common transit countries that have concluded agreements with the EU on the recognition of security and safety inspections conducted in these exporting countries, namely Norway, Liechtenstein, and Switzerland. When the package reaches Poland, customs and tax systems block its further route, and it is placed under customs supervision. Poczta Polska sent the importer, Jan K., a paper notification (although electronic notification is also possible) about the shipment being held for customs clearance. A terrified Jan K. tried to find out what was happening with his parcel and why it had been detained. He finally discovered that Poczta Polska was not his customs representative. After controlling his emotions, he gathered the necessary documentation, which included proof of purchase, payment confirmation with a breakdown of the price of the goods themselves, shipping fees, and item description, as well as a signed power of attorney, and sent it to Paczka Polska. Poczta Polska, which had become Jan K.’s active representative, processed customs clearance using the AIS-IMPORT system, using full import customs declarations on the SAD H1 document. The customs and tax office then assessed fees: customs duty based on the CN customs classification and VAT based on the tax base, which is the combined price of the goods, transportation fees, and customs duties. This process was successful, the parcel was returned to postal service, and the postman knocked on Jan K.’s door – the importer’s enthusiasm was somewhat lower than in Scenario 1, as he had already incurred customs and VAT costs before beginning the reading.

What if the package arrives damaged?

The complications continue: the package was damaged, and we don’t know who to contact. Since the introduction of the Tax Explanations on July 1, 2021, autonomous tax law creates a legal fiction under which the electronic interface operator is considered a B2C supplier, the platform is therefore obligated to tax and settle the transaction. This solution is primarily beneficial to officials, who find it more convenient to collect VAT from a large platform than from hundreds of smaller sellers. On the other hand, it creates a certain ambiguity – as we established above, the platform is still merely an intermediary under civil law. Why do we see a discrepancy here? Because of the issue of tortious liability.

If the “Locomotive” purchased by Jan K. were lost or destroyed before delivery, from July 2021, the consumer would have to direct warranty or non-performance claims to the Maryland antiquarian bookstore, not the AbeBooks platform (if the damage occurred during transport, i.e., before formal release by customs). It should undergo a qualification process as defective goods, and if approved, the American seller is to make a price adjustment, which will reduce the overall customs value, automatically including the costs of customs duty and VAT. For goods over €150 or of collector’s value, the loss or destruction of a package in the warehouse results in a customs debt, and Poczta Polska becomes the debtor. If damage to goods worth less than €150 occurred during transport by Poczta Polska, after legal qualification and removal of the goods from customs supervision, the postal operator is obligated to pay the VAT, along with default interest.

Despite the many scenarios, one important rule stands out – the platform itself very rarely pays compensation. Based on US court decisions (such as the Bolger vs. Amazon.com, LLC case, in which Angela Bolger suffered serious bodily injury after a laptop battery purchased through Amazon exploded), it can be assumed that the chance of obtaining compensation increases essentially only if the platform controlled the physical delivery process. Or rather, if this can be proven in court. Platform uniqueness, as Janger and Twerski called it in their renowned 2023 analysis, is increasingly being raised as a serious problem for consumer protection and rational risk management. American sales platforms hide behind formal definitions of “sale” and “title,” but in practice, these explanations have little application. This absurdity is particularly evident in models such as FBA (Fulfillment by Amazon), where the platform stores, packages, and ships the goods, and claims the right to substitute without consulting the consumer. The fiction of a “recognized supplier” exists under VAT law, yet remains free from civil liability.

Cost-related catches – what to watch out for so as not to overpay

As the example above shows, the issues of cost and financial responsibility are often ambiguous, so it’s important to understand what additional fees we might be exposed to. Distinguishing the price of the goods from transportation fees, customs duties, and VAT is the first, but not the last, point at which we should consider how much importing goods purchased on an American marketplace will actually cost us. In addition to the components of the customs value, we must also consider other possible fees, such as the cost of insuring the imported goods, loading and handling fees associated with their transport to the national border or a Polish port.

The principle that “determinations of charges for transport costs must be unambiguous, precise, and separate for domestic and international sections” is one of the key aspects of EU customs law. Why is this so important? According to Articles 71 and 72 of the UCC, foreign and domestic sections are treated differently – the customs value of goods increases upon entry into the customs union, whereas within the EU, costs are not included in this value. However, the Act introduces a condition here, specifically a clear separation of goods and transport costs (which is why this had to be clearly stated in Scenario 2 of Jan K. in Jan K.’s documents for Poczta Polska). If only one transport amount appears on the invoice, the customs authority has the right to include 100% of the transport costs in the customs value. This trap, known as the cascading effect, is likely to occur in transactions on online marketplaces, as confirmed by the Supreme Administrative Court’s rulings in this case.

The customs authorities’ reasoning can be traced to the Supreme Administrative Court’s judgment of March 17, 1999 (SA/ Sz 1731/98). In this case, the Spanish wine seller failed to divide costs and sections into foreign and domestic, and the transaction itself resulted in two sets of invoices for different amounts (the second set of invoices had a significantly higher value). The Supreme Administrative Court dismissed the importer’s complaint regarding alleged violations of customs and administrative law by the customs authorities, and in its justification, cited the obligation to determine the amount due in a clear and precise manner, using objective and measurable data. The judgment is a reprimand for the company’s arbitrariness.

Separating costs is also important in so-called simplified procedures. As mentioned earlier, the simplified H7 declaration applies to products whose actual value, i.e., the price of the goods themselves, does not exceed €150. If the seller fails to separate the costs on the invoice, shipping costs will be included in the actual value – if this amount exceeds €150, the seller will have to go through the full customs procedure. Failure to clearly present the cost breakdown could also impact the efficiency of the entire import procedure. Because the simplified H7 declaration is processed automatically by the National Tax Administration, the algorithm may detect irregularities in the declared data, which may result in document revisions or a physical inspection of the package. This, in turn, can generate potential delays and other problems.

There are also minor and often overlooked issues, such as different CN codes for goods in the same package. A separate flat-rate customs duty must be paid for each item from a different line item. Let’s not forget the mundane, yet utterly human, issue: if the item we ordered doesn’t meet our expectations and we want to return it, the customs and VAT costs will not be refunded. With this in mind, it’s important to weigh the pros and cons before making a final decision.

Summary

The purchase of Tuwim’s “Locomotive,” besides its aesthetic appeal, undoubtedly provided Jan K. with insight into the EU customs system for goods imported from outside the European Union, specifically the USA. The most important lessons learned from this lesson include an awareness of the consumer’s role when importing goods from outside the EU and their customs and tax obligations, as well as the operating principles and powers of the Polish Post, along with its requirements for importers. The potential costs incurred by both consumers and sellers in transactions made via the online marketplace were also analyzed. A study of regulations and specific examples demonstrated the importance of a properly conducted procedure for both parties, so as to avoid unnecessary financial burdens on either side.

In the current era of globalization and the development of global export giants, purchasing products and services online is inevitable. American platforms such as Amazon, eBay , Wayfair, Target, and Walmart, having established a stable and strong position in the global market, conduct sales primarily focused on protecting their structures and generating profits. Therefore, as Polish consumers of American products, we should, above all, protect our own interests and financial security, be aware of the dangers and risks associated with ignorance of appropriate customs procedures and our obligations as a party to the transaction. In other words, let’s follow the example of Jan K., who fulfilled his desire for a unique book by studying his consumer rights and responsibilities on the American platform AbeBooks.

Bibliography:

Legal acts:

Act of 11 March 2004 on tax on goods and services (consolidated text: Journal of Laws of 2025, item 775, as amended). https://sip.lex.pl/#/act/17086198/444640770/podatek-od-towarow-i-uslug?keyword=podatek%20od%20towar%C3%B3w%20i%20us%C5%82ug%20&searchPit=2026-07-15

Act of 19 March 2004 – Customs Law (consolidated text: Journal of Laws of 2024, item 1373). https://sip.lex.pl/#/act/17088507/441956979/prawo-celne?keyword=ustawa%20prawo%20celne%20&searchPit=2026-07-15

Council Regulation (EC) No 1186/2009 of 16 November 2009 setting up a Community system of reliefs from customs duty (codified version) (OJ L 324, 2009, p. 23, as amended). https://sip.lex.pl/#/act/67914249/3571055/rozporzadzenie-1186-2009-ustanawiajace-wspolnotowy-system-zwolnien-celnych-wersja-ujednolicona?keyword=Rozporzadzenie%C4%85dzenie%201186%2F2009%20ustanawiaj%C4%85ce%20ws%C3%B3lnotowy%20system%20zwolnie%C5%84%20celnych%20(wersja%20ujednolicona)&searchPit=2026-07-15

Regulation (EU) No 952/2013 of the European Parliament and of the Council of 9 October 2013 laying down the Union Customs Code (OJ L 269, 2013, p. 1, as amended). https://sip.lex.pl/#/act/68359246/176766672/rozporzadzenie-952-2013-ustanawiajace-unijny-kodeks-celny?keyword=Rozporz%C4%85dzenie%20952%2F2013%20ustanawiaj%C4%85ce%20unijny%20kodeks%20celny%20z%201%20maja%202016%20&searchPit=2026-07-15

Commission Implementing Regulation (EU) 2015/2447 of 24 November 2015 laying down detailed rules for implementing certain provisions of Regulation (EU) No 952/2013 of the European Parliament and of the Council laying down the Union Customs Code (OJ L 343, 2015, p. 558, as amended). https://sip.lex.pl/#/act/68591768/181445989/rozporzadzenie-wykonawcze-2015-2447-ustanawiajace-szczegolowe-zasady-wykonania-niektorych…?keyword=Rozporzadzenie%20wykonawcze%202015%2F2447%20z%201%20maja%202016%20&searchPit=2026-07-15

Ministry of Finance. (2021, September 1). Tax clarifications regarding the so-called VAT e-commerce package introduced by the Act of May 20, 2021, amending the Act on Value Added Tax and certain other acts (Journal of Laws, item 1163) . https://www.podatki.gov.pl

Judgment of the Supreme Administrative Court in Szczecin of 17 March 1999, SA/ Sz 1731/98, M.Podat. 2000, no. 5, item 29.

https://sip.lex.pl/#/jurisprudence/520132316/1?directHit=true&directHitQuery=SA%2FSZ%201731%2F98

Artykuł A well-aimed shot at American e-commerce. A practical guide to customs clearance of US shipments through the Polish Post. pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The holiday season is in full swing, but our litigation team remains fully alert — and fully engaged. The best proof: ongoing preparations for proceedings before the General Court of the European Union in Luxembourg in one of the most complex categories of disputes — EU grant litigation.

What is the dispute about?

We represent a client — a beneficiary of a grant awarded under an EU framework programme — in a dispute with the European Innovation Council and SMEs Executive Agency (EISMEA). At the heart of the dispute lies the allegation of so-called technology abandonment (departure from the technology) — the EU agency’s claim that, in the course of the project, the beneficiary departed from the technology on which the funding decision was based, which, in the Agency’s view, justifies a demand for repayment of the funds.

This is one of the most difficult and most judgment-laden categories of allegations in grant disputes. The line between impermissible “abandonment” of a technology and the natural — indeed expected — evolution of a solution in a research and innovation project is fluid, and where that line is drawn determines the fate of the entire funding. Disputes of this kind require navigating simultaneously the grant agreement regime, European Union law and the technological specifics of the project.

A direct action before the EU General Court

The dispute will be brought before the General Court of the European Union by way of a direct action based on the arbitration clause contained in the grant agreement (Article 272 TFEU). As part of the preparations, our attorneys-at-law have set up individual representative accounts in e-Curia — the mandatory electronic filing system of the EU courts — and stand ready to represent the client at every stage of the proceedings in Luxembourg.

What does this mean for you?

If your company is implementing, or has implemented, an EU-funded project (Horizon 2020, Horizon Europe, EIC Accelerator and others) and you have received a letter from an EU institution questioning the implementation of the project, an audit notification, a debit note or a repayment demand — you are not without recourse. Decisions and demands of EU executive agencies are subject to review, and beneficiaries have real legal remedies at their disposal, including judicial proceedings before the EU General Court.

Our litigation team combines experience in civil and commercial disputes with hands-on knowledge of EU law, the EU grant regime and the procedure before the EU courts.

Feel free to reach out — holiday season included. We are not slowing down.

Artykuł Summer holidays? Not for our litigation team. We are preparing a dispute before the EU General Court pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The phenomenon of fake reviews in the digital space has evolved from a marginal image issue to a central focus of market supervision authorities and EU legislators. The contemporary ontology of this phenomenon extends beyond primitive content fabrication to encompass any form of communication that, by distorting the actual consumer experience, misleads the recipient, directly influencing their decision-making process. Legally, a fake review is considered not only a completely false message, but also one that, by omitting important facts or manipulating context, creates a false impression of the quality of a product or the reliability of a seller. This practice is classified as unfair commercial activity if its nature causes or is likely to cause the average consumer to make a transactional decision they would not otherwise make, thus violating the fundamental principles of fair dealing.

The typology of activities considered unfair rests on several fundamental pillars, the most blatant of which is direct fabrication. This involves posting or commissioning the creation of false recommendations from specialized external entities, such as marketing agencies, which directly violates regulations on combating unfair market practices. Another mechanism is selective manipulation, in which a business intentionally manages the visibility of reviews by removing, concealing, or delaying the publication of negative reviews while favoring positive ones. Such action distorts the image of actual customer satisfaction and is considered misleading regarding the essential characteristics of a product or service. An equally significant aspect is feigned verification, i.e., declaring that reviews come from real buyers without implementing proportionate and reasonable steps to verify their authenticity, which constitutes a direct violation of the disclosure obligations imposed by the Omnibus Directive.

Contemporary market practices have also evolved more subtle forms of manipulation, such as astroturfing, which involves creating artificial social support through employees or store owners posing as independent consumers. These activities often involve the manipulation of user profiles, where images generated by artificial intelligence algorithms are used to authenticate fictitious accounts, creating false social proof. Each of these practices, regardless of their technological sophistication, is subject to strict scrutiny by competition and consumer protection authorities.

The role of the President of the Office of Competition and Consumer Protection and the responsibility of management boards

The President of the Polish Office of Competition and Consumer Protection (UOKiK) serves as a central regulator in the legal system, endowed with rigorous powers to counteract violations of collective consumer interests. The main disciplinary instrument at the authority’s disposal is an administrative fine, which can be imposed in the amount of 10% of the turnover achieved by the entrepreneur in the financial year preceding the year of issuance of the decision. The amount of the fine is not determined arbitrarily, but rather results from precisely defined criteria, which include, above all, the scale of the violation, its duration, and the degree of intentionality of the perpetrator. Importantly, this fine is intended to serve not only a repressive function but, above all, a preventive and deterrent one, discouraging other market participants from engaging in similar unfair practices involving the manipulation of reviews or misleading as to the authenticity of reviews.

The enforcement procedure in consumer matters is designed to ensure high effectiveness of supervisory activities. A business subject to a sanction is obligated to settle the fine within 14 days of the decision becoming final, which directly contributes to the state budget. A crucial procedural element is the prejudicial nature of the decisions of the President of the Office of Competition and Consumer Protection (UOKiK), which means that the authority’s findings regarding violations of the law are binding on common courts in compensation cases brought by injured customers. This legal structure significantly facilitates consumers in pursuing civil claims, as they do not have to prove the illegality of the store’s actions, focusing solely on demonstrating the damage suffered. The office’s activity in recent years, reflected in numerous proceedings against e-commerce leaders, confirms that protecting the transparency of reviews has become a regulatory priority, translating into real and severe financial consequences for violators.

The contemporary model of liability in consumer protection law departs from a concept focused solely on the business entity, shifting the burden of sanctions also to individuals who actually manage the enterprise. The President of the Office of Competition and Consumer Protection (UOKiK) has the authority to impose a personal fine of up to PLN 2,000,000 on a manager. This liability is triggered by demonstrating that the manager has intentionally allowed – through their actions or conscious omissions – the company to violate collective consumer interests. In case law, the degree of management involvement in decision-making processes regarding marketing and communications is crucial. This liability may therefore affect a management board member who approves a budget for obtaining reviews from external opinion farms or ignores the lack of implementation of verification procedures under the Omnibus Directive, despite being aware of such deficiencies.

It should be emphasized that the responsibility of managers is autonomous and independent of any penalty imposed directly on the entrepreneur. This is intended to provide a strong incentive for management to build internal compliance structures and actively oversee the entity’s operational ethics. In the era of digitalization of trade, where algorithms and automation of marketing processes can generate violations on a massive scale, the personal financial risk of managers is intended to compel prioritizing compliance as the foundation of business strategy. Therefore, the systemic fight against false reviews is implemented not only through sanctions against corporate structures but also by disciplining those who actually shape companies’ market policies. This, according to the legislature, is intended to ensure long-term improvement in integrity standards in electronic trading.

The Omnibus Directive and the blacklist of market practices

The implementation of the Omnibus Directive into the Polish legal system significantly redefined transparency standards in e-commerce, introducing mechanisms that directly address the systemic manipulation of consumer reviews. A key instrument in this regard is the so-called blacklist of market practices, which constitutes a catalog of behaviors considered unfair in all circumstances, eliminating the need for supervisory authorities to conduct a case-by-case analysis of the consequences of a given action. Classifying these market torts as unfair practices aims to eliminate evidentiary difficulties, as their mere existence exaggerates the entrepreneur’s wrongdoing. This legal framework not only strengthens the consumer’s position but, above all, simplifies the evidentiary process, making the fight against e-commerce abuse more effective and predictable for market participants. The foundation of the new regulations is an absolute prohibition on manipulating the verification and authenticity of product recommendations, which imposes an active obligation on sellers to implement procedures to verify the origin of reviews.

Under the current wording of the regulations, it is considered an unfair market practice for a trader to claim that product reviews were posted by consumers who actually used or purchased the product, in situations where reasonable and proportionate steps were not taken to verify their authenticity. This practice violates the consumer’s right to reliable information, which is essential for making an informed decision about purchasing the product, and violating it constitutes conduct contrary to good practice. The law prohibits not only posting completely false reviews, but also commissioning third parties to create them, or transferring recommendations between products with different parameters, which is referred to as review hijacking. Other offenses listed in the catalog are treated equally severely, such as using false quality certificates without appropriate authorization or using surreptitious advertising, which involves using editorial content to promote a product without clearly identifying the paid nature of the communication. Aggressive techniques are also considered particularly burdensome, including mass spamming and forced selling, which involves demanding payment for products delivered to the consumer without their prior order.

The blacklist also eliminates techniques such as bait advertising and direct persuasion of children to purchase, which aims to protect the integrity of the consumer decision-making process from manipulation. This protection of minors stems from their particular vulnerability to advertising messages and their inability to critically assess the persuasive nature of commercial offers. Expanding the list to include a ban on posting or commissioning another person to post false reviews for the purpose of promoting products significantly complements the system, preventing brands from using agencies that fabricate social evidence. It is emphasized that any form of distortion of the actual image of a product’s popularity constitutes a violation of the collective interests of consumers, which entitles the President of the Office of Competition and Consumer Protection (UOKiK) to intervene under public law as soon as a threat to the interests of all market users arises.

A particularly significant and painful consequence of these unfair techniques for entrepreneurs is a specific civil law sanction in the form of an extended right of withdrawal from the contract. If an e-store engages in practices listed in the prohibited catalog or fails to comply with information obligations regarding review verification, the statutory return period granted to the buyers is extended from 14 days to a full 12 months. This mechanism is a direct consequence of the assumption that, in the absence of reliable information, the consumer could not have expressed a fully informed intention to purchase, which suspends the running of standard mandatory deadlines. Systematic combating of review fraud and the use of black market practices is therefore becoming not only a matter of business ethics but the foundation of legal security and stability for every entity operating in the e-commerce sector. Neglect in transparency can lead to mass claims for refunds, posing a real threat to the operational liquidity of the company.

Manipulation Architecture and Platform Obligations under the Digital Services Act (DSA)

The phenomenon known as dark patterns constitutes a sophisticated form of interference in the user’s decision-making process, based on the deliberate use of interface architecture to distort their autonomy of will. Manipulative design patterns are not merely a manifestation of aggressive marketing, but a systematic designer’s action aimed at inducing a specific cognitive bias in the consumer, which ultimately leads to a purchase decision they would not have made in conditions of full transparency. The psychological foundation of these actions is the use of heuristics, i.e., simplified rules of reasoning and automatic thinking, which in the fast-paced environment of e-commerce transactions make the user susceptible to subliminal suggestions. This phenomenon has evolved from simple forms of persuasion to advanced interface manipulation, where the line between inducement and fraud is deliberately blurred to maximize conversion at the expense of the interests of the weaker party in the legal relationship.

A particularly significant area of application of these practices is the system for presenting reviews and suggesting their authenticity, where manipulation takes the form of so-called interface interference. Businesses often employ patterns involving selective content display, which in practice means deliberately hiding negative reviews on subsequent pages of the website while simultaneously highlighting only enthusiastic reviews on the product’s home page. This practice violates the model of the average consumer, who has the right to expect that the image presented of a product’s popularity and quality is reliable and has not been subjected to arbitrary filtering. Manipulation in the sphere of social evidence also includes fabricating popularity indicators, such as false messages about the number of people viewing a given product at a given time or false offer duration counters, which create an artificial sense of scarcity in the user and pressure them to immediately close the transaction. Under the Polish Act on Combating Unfair Market Practices, these activities may be classified as misleading because they distort the actual market conditions, preventing a rational comparison of offers.

Another dimension of manipulation is the technique known as confirmation shaming, which in the sphere of opinion writing involves the use of evaluative and emotional language to coerce users into specific behaviors, for example, through unsubscribe buttons suggesting a lack of consumer awareness. These practices are closely related to the “roach motel model”, where the process of issuing a favorable review is simplified to the maximum extent, while editing, reporting an error, or deleting content requires navigating a complex subpage structure, which is intended to discourage users from correcting false information. In the legal context, such procedural barriers are considered burdensome impediments that violate good practice and the principle of commercial fairness. An analysis of case law and the positions of supervisory authorities indicates that an interface that deliberately hinders users from exercising their rights or changing their minds loses its neutrality and becomes a tool for harming consumer interests.

A fundamental change in the regulatory sphere was brought about by the entry into force of the EU Digital Services Act (DSA), which, in Article 25, explicitly prohibits online platform providers from designing, organizing, and operating interfaces in a way that misleads or manipulates service users. This regulation is overarching and complements the existing consumer protection framework by introducing a direct obligation to maintain neutrality in choice architecture and prohibiting structures that significantly impede users’ ability to make free and informed decisions. Violation of this prohibition entails not only civil law risks but also severe administrative sanctions, which can amount to a significant percentage of the business’s global turnover.

In the sphere of law enforcement, the key role is played by the model design of the average consumer, who is observant and cautious but lacks specialized knowledge of the psychological mechanisms used in interface design. This protection is preventative and abstract in nature, meaning the President of the Office of Competition and Consumer Protection (UOKiK) can intervene in situations where the mere existence of a manipulative pattern poses a real risk of distorting market behavior, without having to wait for measurable financial damage to a specific individual. Effectively combating dark patterns requires businesses not only to comply with the law but, above all, to shift to a design model focused on reliability, where all product information, including opinions, is presented free from coercive mechanisms. Ultimately, interface transparency is becoming a prerequisite for maintaining trust in the digital economy, and the use of sophisticated forms of manipulation is perceived as highly harmful to society, subject to strict assessment in light of the principles of social coexistence.

New obligations for marketplaces regarding moderation and transparency

The entry into force of Regulation 2022/2065, known as the Digital Services Act (DSA), represents a fundamental shift in the liability paradigm for intermediary service providers, particularly marketplaces. This regulation shifts the emphasis from passive content hosting to active oversight of the transparency and security of the digital system, introducing rigorous operational standards aimed at eliminating illegal content while respecting users’ fundamental rights. A key pillar of this reform is the formalization of moderation processes, which until now were often subject to arbitrary internal platform decisions and are now subject to strict procedural rigors contained in the notice-and-action mechanism. Under the DSA, each platform is required to provide easily accessible and user-friendly tools for identifying potentially illegal content, including fake reviews or infringing offers. The mere receipt of a report obliges the provider to promptly and objectively address it.

The evolution of moderation obligations is inextricably linked to the requirement for transparency in decisions, which is achieved through the justification mechanism provided for in the EU regulation. When a marketplace decides to remove content, limit its visibility, or suspend a user’s account, the user is absolutely obligated to provide clear and specific reasons for such action, which is intended to prevent abuse by blocking reliable reviews that are unfavorable to the seller. This system is complemented by a mandatory internal complaint handling system, which allows users to appeal moderation decisions free of charge within a period of at least six months. This constitutes an important procedural guarantee and allows for the correction of potential algorithmic errors. It is indicated that such a legal framework is necessary to counteract the fragmentation of consumer protection, which previously relied primarily on general national clauses that were unsuitable for the scale of operations of global digital entities.

A significant innovation introduced specifically for trading platforms is the “Know Your Business Customer” (KYBC) principle, regulated in the chapter on marketplace transparency. These entities are charged with collecting and verifying information about traders offering their products through their interfaces, including registration data, payment account numbers, and declarations of commitment to offer goods in compliance with EU law. This mechanism aims to eliminate the phenomenon of anonymous sellers, who often promote defective products using fabricated reviews and, after raising capital, disappear from the market, avoiding legal liability. The platform is obligated to suspend services for sellers who fail to submit the required documents, making the marketplace an active guardian of the legality of trade, rather than merely a passive intermediary in trade.

The scope of transparency obligations extends beyond relationships with individual users to include public reporting through the periodic publication of transparency reports. These documents must include detailed data on the number of orders received from national authorities, statistics on content moderation initiated by the platform itself, and information on the use of automated tools in verification processes. For very large online platforms, these rigors are even stricter, including the obligation to conduct annual audits and systemic risk assessments, including analysis of the interface’s vulnerability to manipulation that could negatively impact public safety or consumer protection. The systemic fight against disinformation and unfair market practices is therefore anchored in the full transparency of operational processes, which allows supervisory authorities to continuously monitor the effectiveness of implemented security measures.

Supervision of compliance with these obligations is based on a new institutional architecture, in which national digital services coordinators, working closely with the European Commission, play a central role. The enforcement system for the adopted regulations is based on fines of up to 6% of a provider’s global turnover, which compels compliance with specific cybersecurity standards. This control system is designed to ensure that marketplaces not only implement the required procedures but also apply them reliably and uniformly across the European Union, which is crucial for building consumer confidence in cross-border trade. The introduction of these standards ends the phase of full regulatory freedom for platforms, imposing on them real responsibility for shaping the environment in which the modern exchange of goods and services takes place.

Technological verification mechanisms and modern operating models

Authenticity Suggestion and Pressure Mechanisms

The evolution of digital market oversight has led to the development of mechanisms in which traditional legal instruments are increasingly being replaced by algorithmic jurisdictions based on advanced artificial intelligence systems. The phenomenon known as AI exclusion is a modern form of sanction that, for e-commerce entities, can prove more severe than traditional financial penalties imposed by administrative bodies. The foundation of this process is the integration of data on the credibility of reviews directly with positioning parameters in ranking systems, which means that transparency is no longer merely an ethical obligation but a condition for the technical visibility of an offer. Recommendation algorithms operating within platforms such as Google and Amazon constantly analyze behavioral and linguistic patterns to identify anomalies suggesting manipulation of social evidence. These systems are currently capable of recognizing the structure of texts generated by LLM language models, which are characterized by a specific repetition of phrases and a lack of emotional details typical of authentic consumer experiences. An additional risk factor subject to automatic verification is the so-called review growth rate, where a sudden jump in the number of positive ratings without correlation with actual website traffic or sales volume is interpreted by AI as a warning signal initiating restrictive procedures.

The consequences of an online store being classified by AI systems as posing a high risk of manipulation are immediate and often irreversible in the short term. This mechanism, known in market practice as shadow banning or de-indexing, leads to a drastic decline in visibility in search results and the blocking of offers in advertising systems, effectively cutting the entrepreneur off from key customer acquisition channels. Under the provisions of the Digital Services Act, providers of very large online platforms are required to maintain particular transparency regarding the parameters used in recommendation systems. Article 27 of the aforementioned regulation requires platforms to clearly define in their regulations the key parameters determining information ranking, which aims to limit algorithmic arbitrage and enable entrepreneurs to understand the reasons for a potential decline in their market exposure. It is worth noting that modern risk assessment systems may be classified as high-risk systems within the meaning of the Artificial Intelligence Regulation, which imposes strict requirements on their creators regarding human oversight and the prevention of algorithmic discrimination.

In parallel to restrictive systems, a paradigm known as agentic commerce is developing, in which purchasing processes are carried out by autonomous AI assistants acting directly on behalf of the consumer. In this model, traditional product reviews cease to serve as persuasive texts for humans and become raw input data for machines that filter the market in search of offers with the highest level of verified trust. A key element of this new commerce architecture is the so-called trust layer, built on protocols such as the Universal Commerce Protocol promoted by Google or the Agentic Commerce Protocol developed by OpenAI. These systems are guided not only by price or availability of goods but above all by the certified credibility of the seller’s data, automatically rejecting offers from entities that lack a clear digital traceability of their recommendations. The collaboration of AI assistants with secure payment systems, such as the Agent Payments Protocol, creates a closed ecosystem in which offers at risk of manipulation are excluded at the initial algorithmic selection stage, before they are even presented to the user.

In the era of agent-based commerce, the role of modern shopping assistants is becoming dominant, forcing businesses to redefine their credibility-building strategies. The Context Protocol model and other open-source solutions enable the exchange of context between various AI models and commerce systems, allowing information about unfair practices by a single store to be instantly shared across the entire assistant network. The doctrine suggests that this systematic approach to eliminating abuse is a natural response to the technological ease of fabricating content online. For an e-commerce store, losing its trustworthy status in the eyes of Google or OpenAI algorithms means the modern equivalent of server shutdown, as AI assistants, protecting the interests of their users, will systematically bypass offers that generate manipulative signals. Thus, the fight for authenticity is no longer a mere compliance issue but an existential foundation in the new, automated e-commerce environment, where barriers to entry into the trust layer are becoming increasingly difficult for entities employing pressure mechanisms and suggesting false authenticity.

Compliance as a Service and the Digital Feedback Path

The rapid evolution of the e-commerce market and the increasing professionalization of unfair market practices have forced entrepreneurs to abandon a reactive reputation management model in favor of proactively building a digital immune system. The scale of the challenge facing modern e-commerce is illustrated by analyses of the systematic erosion of trust in the digital sector, pointing to the prevalence of fake reviews and consumer concerns about the mass implementation of generative artificial intelligence for opinion fabrication. This state of affairs creates decision paralysis, where an overabundance of unreliable information, instead of supporting the purchasing process, becomes an insurmountable barrier.

The economic impact of the lack of reliable content verification is directly measurable and translates into tangible operational losses for businesses. The literature emphasizes that exposure to manipulated reviews drastically reduces purchase intentions and brand trust, generating measurable financial losses. The information vacuum filled with false enthusiasm also leads to a phenomenon known as post-purchase dissonance, in which a product that fails to meet expectations is returned to the seller as a complaint or contract withdrawal. Consequently, the lack of investment in transparent review processes generates hidden logistical and operational costs that, in the long run, may outweigh the gains achieved through the temporary increase in conversions driven by manipulation.

In response to increasing regulatory rigor, including the Omnibus Directive, the Digital Services Act (DSA), and the AI Act framework, an operational model known as Compliance as a Service (CaaS) has emerged in market practice. It involves fully outsourcing compliance processes to specialized technology providers who take over the burden of monitoring and verifying content in accordance with current regulations. CaaS allows for the automation of data oversight, which is essential in an environment where the volume of incoming reviews precludes manual oversight without risking accusations of disproportionality. In this approach, compliance ceases to be merely an administrative cost and becomes a component of a strategy for building brand value by guaranteeing the authenticity of every customer touchpoint.

The foundation of the Compliance as a Service model is the maintenance of clean data and the generation of an indisputable digital trace of the review’s provenance. Every published review should be accompanied by a log containing metadata regarding the specific transaction, a unique order number, and delivery status, creating auditable proof of authenticity that can be presented during inspections by supervisory authorities such as the President of the Office of Competition and Consumer Protection. This digital reconstruction of the review process provides the most effective legal shield for businesses, eliminating the risk of allegations of unfair market practices. In the era of algorithmic jurisdiction, where ranking systems favor content supported by digital evidence, having a certified trace of data provenance is becoming a prerequisite for maintaining the market visibility of an offer.

Parallel to technical verification, modern review management systems integrate mediation mechanisms that allow for the amicable resolution of disputes before they are publicly expressed. Market experience suggests that implementing structured review processes allows for the amicable resolution of a significant portion of consumer disputes, effectively preventing the publication of negative reviews resulting from logistical errors. This approach aligns with the principles of reliability and good market practices, building customer relationships based on dialogue rather than solely on the one-way transmission of ratings.

Transaction verification is now becoming the market standard, replacing open, abuse-prone review sections with a system of unique invitations sent only after a purchase is completed. The literature emphasizes that restricting the review process to those who actually purchased the product is the simplest and most effective way to comply with the obligations imposed by the Omnibus Directive. This not only minimizes the risk of severe financial penalties, but above all, provides AI shopping assistants with reliable input data, which, in the new agent-based commerce paradigm, will determine the viability of each entity in the e-commerce ecosystem.

Artykuł Faking reviews in e-commerce – analysis of new legal regulations, algorithmic mechanisms and market practices in the e-commerce sector pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

I. Introduction

On June 3, 2026, the European Commission adopted a proposal for the Cloud and AI Development Act (hereinafter: CADA or the draft), which is the centerpiece of the broader European Technological Sovereignty Package. This draft seeks to translate the political concept of digital sovereignty into binding legal standards governing public procurement, the certification of cloud computing providers, and artificial intelligence infrastructure.

CADA focuses on 3 goals:

•          Pillar 1 – Research and Innovation: Support for next-generation technologies, frontier, industrial and physical AI; introduction of “grand challenges”; implementation of Experience and Acceleration Centres for AI.

•          Pillar 2 – Capacity: target to triple EU data centre capacity within 5-7 years; simplify and speed up construction permitting.

•          Pillar 3 – autonomy (core of regulation): a single EU framework for assessing cloud and AI sovereignty, a public sector adoption mechanism; an open source-first principle; and a common public procurement framework.

CADA fits into the broader EU digital policy framework, which includes the AI Act, Data Act, Data Governance Act, Digital Markets Act (DMA) and Digital Services Act (DSA), as well as soft law initiatives such as Gaia-X and the 2020 European Data Strategy. CADA takes a coordinated “ecosystem approach” as it combines supply-side actions to strengthen national capabilities, demand-side actions to drive deployment, and enablers for innovation and investment in cloud computing and AI.

“This initiative will connect networks, cloud, artificial intelligence, and software into cohesive ecosystems to address the following:

(1) future challenges related to energy-efficient computing infrastructure;

(2) autonomy across the entire cloud stack;

(3) advanced EU capabilities in advanced AI technologies, such as frontier AI, physical AI and industrial AI;

(4) implementing cloud and artificial intelligence in the public and private sectors.”

II. The concept of digital sovereignty and the “sovereign cloud” in EU documents

1. Origin of the concept

The concept of digital sovereignty (technological sovereignty) entered the vocabulary of the European Commission and the Council of the EU around 2020-2021 as a reaction to three phenomena: (1) the ongoing consolidation of the global cloud market in the hands of hyperscalers from the United States. à”The current situation in the cloud computing and artificial intelligence sector is characterized by a clear dependence on a limited group of third-country providers. Although the EU cloud computing market is growing significantly, the share of EU providers fell from 29% in 2017 to 15% in 2022 and has remained unchanged since then. Currently, three non-EU cloud computing providers control over 70% of the European cloud computing market… This dependency also exposes European users to the risk of disruptions, especially in situations where unilateral decisions by third-country entities could disrupt service provision.”

(2) legal risks related to the extraterritorial application of the US CLOUD Act of 2018, which allows US authorities to access data stored by US-based companies regardless of the location of the servers, and

(3) the CJEU judgments in Schrems I (2015) and Schrems II (2020), questioning the legal basis for transatlantic transfers of personal data. The Court of Justice of the EU (CJEU) invalidated the Privacy Shield Agreement, finding that US regulations did not guarantee EU citizens adequate protection of their personal data against surveillance. This forced the processing of sensitive data in Europe.

The Gaia-X initiative, launched in 2019 by Germany and France, was the first attempt to operationalize cloud sovereignty. The project’s main goals are:

• reducing Europe’s dependence on American and Chinese cloud providers (such as AWS, Google Cloud, Azure, Alibaba)
• Gaia-X does not build its own cloud, but creates rules, standards and trust mechanisms that allow different providers (small and large) to offer interoperable, compatible services.
• companies and institutions must maintain control over where and how their data is stored and processed, in accordance with European regulations (e.g. GDPR)
• common certification rules, trust labels (“Gaia-X Trust Framework”) and open API

However, the project was criticized for its slow pace and the influence of large American technology companies, which raised doubts about the sovereign nature of the undertaking.

2. Components of digital sovereignty according to the CADA project

The CADA project does not have a single, closed dictionary definition of “cloud/digital sovereignty.” Instead, the project develops the concept through a system of levels and assessment criteria.

Recital 51 of the Preambleà “it is necessary to establish a Union cloud computing sovereignty framework determining criteria for trusted cloud computing services. To cater for the nuanced and layered nature of sovereignty, the framework should provide for four different levels of trusted offers (‘Union assurance levels’).”

Recital 50 of the Preambleà “The Union and Member States being critically dependent on a limited number of cloud computing service providers subject to the control of a third country or a legal entity established in a third-country may lead to risks such as misuse (ie manipulation, remote access and control, sabotage, weaponization), access to information (ie access to sensitive information, unauthorized communication, technology leakage, data manipulation or exfiltration, espionage) and dependency vulnerabilities (ie political and/or economic coercion, for example by using vendor or technology lock-ins, embargos or sanctions, monopoly pricing damaging the financial interest of the Union and Member States).” – risks to sovereignty

Article 16à “This Chapter establishes a Union cloud computing sovereignty framework comprising four Union assurance levels, the criteria for which are set out in Annex II, that cloud computing service providers shall meet in order to provide their cloud computing services to Union entities and public sector bodies”

Annex IIà contains four cumulative sets of technical, legal and organisational criteria. “Software” within the meaning of the Annex includes Regulation 2024/2847 (Cyber Resilience Act). CADA in Annex II defines sovereignty in the field of cloud computing and artificial intelligence, comprising four levels of guarantees that public sector bodies will benefit from based on their risk assessments. Cloud service providers can be recognised by Member States under this framework after passing an audit. The Commission retains the competence to issue implementing acts identifying third countries whose providers would be subject to audits under the above system.

Level 1 (Basic) –  pt. 1

The lowest threshold, covering all public sector services:

• supplier’s registered office in the EU; infrastructure and assets in the EU (unless the customer expressly agrees otherwise);
• customer data (including metadata, telemetry) remains exclusively within the EU, unless a public authority decides otherwise;
• when outsourcing technical support outside the EU, the requirement of traceability and safeguards that do not undermine operational autonomy;
• compliance with current cybersecurity standards;
• full transparency regarding subcontractors;
• if the supplier is controlled by an entity from a third country – a guarantee of no obligation to report security vulnerabilities to the authorities of that country before their disclosure.

Level 2 (Standard) – point 2

It requires an audit (not just a declaration) and adds:

• mandatory location of infrastructure, assets and personnel in the EU;
• the possibility of requesting EU citizenship of staff (at the client’s request);
• cybersecurity certificate of at least “substantial” level (EUCS or national equivalent);
• prohibition on using customer data to train AI models operated by a third-country entity;
• if the supplier is subject to third-country control – requirement to demonstrate safeguards against: limiting the ability to provide the service, access to data, disruption of service continuity, enforcement of sanctions/embargoes;
• technical support only from the EU;
• transparency of the software supply chain (SBOM – Software Bill of Materials), control of components from third-country suppliers, source code audit;
• legal and technical separation between the EU parent company and the subsidiary in a third country.

Level 3 (Enhanced) – point 3

Adds important refinements:

• staff must be EU citizens and, when handling classified information, have a national security clearance;
• “substantial” cybersecurity certificate;
• as a rule, a ban on control by a third-country entity – except where the Commission issues an implementing act under Article 19 authorising such a supplier (in which case additional safeguards apply, including “reasonable access to the code”);
• technical support provided exclusively by EU residents and entities not subject to third-country control.

Level 4 (Sovereign) – point 4

Highest, most restrictive threshold:

• complete lack of control by a third country entity (without any exception authorised by the Commission, as opposed to Level 3);
• cybersecurity certificate at least “high”;
• staff – EU citizens with appropriate security clearances;
• for software components: requirement of effective control over design, development and maintenance – no third-country entity may have the ability to materially influence the technical development, maintenance priorities or continuity of the component

III. EU Cloud Sovereignty Framework

The EU Cloud Sovereignty Framework is also a key document defining the “sovereign cloud.” This document is not part of the CADA regulation itself, but a separate DG DIGIT methodological tool used in specific procurement procedures. Compared to the four-level Union Assurance Levels scale in CADA Annex II (levels 1–4, based on cumulative binary criteria—pass/fail), the SEAL framework is more detailed. According to it, digital sovereignty consists of eight elements.

Eight Components of Digital Sovereignty (SOV-1 to SOV-8)

Rating scale: Sovereignty Effectiveness Assurance Levels (SEAL)

Independently of the eight components, the document introduces a five-level maturity scale (SEAL-0 to SEAL-4) used to assess each of the eight objectives separately:

Sovereignty Score

The document also introduces percentage weightings for each of the eight components when calculating the aggregate sovereignty score in the tender process:

• Supply Chain (SOV-5): 20% – Highest Weight
• Strategic sovereignty (SOV-1) and operational sovereignty (SOV-4): 15% each
• Technological Sovereignty (SOV-6): 15%
• Legal/Jurisdictional (SOV-2), Data/AI (SOV-3), Security (SOV-7): 10% each
• Environmental Sustainability (SOV-8): 5% – Lowest Weight

The lower weights for SOV-2 and SOV-7 were justified by the fact that these areas are already covered by separate procedural safeguards in the procurement procedure itself.

IV. Impact of the CADA project on public procurement

One of the central mechanisms of CADA is the common EU-level procurement framework.

Recital 64 of the Preambleà The free flow of data within the EU is a prerequisite for the functioning of the internal market – data cannot be artificially limited to the territory of a single Member State. The EU pledges, in principle, open, non-discriminatory market access in accordance with the TFEU and international obligations (including the WTO GPA on Government Procurement).

However, the EU invokes Article III:2(a) of the WTO GPA, which allows for measures necessary to protect public order, public morality, or security. This justifies proportionate restrictions on access to public procurement based on the risk of critical dependencies, unauthorized access to EU data, technology leakage, sabotage, and espionage by third-country entities. Contracting entities whose activities are identified as relevant to public order are required to procure cloud services only at levels 2-4. At the same time, level 1 becomes the mandatory minimum for the entire EU public sector, providing a consistent baseline level of security.

Motif 65à To reduce vendor dependency, EU entities and Member States should consider a multi-vendor/multi-cloud strategy in their procurement processes, based on a contextual risk assessment that takes into account operational, regulatory and resilience circumstances.

Motif 66à Public procurement is treated as a directional signal for the entire market – requirements imposed on the public sector regarding levels of assurance tend to be imitated by the private sector in regulated industries. Article 31 allows private entities from sectors covered by Annex I of the NIS2 Directive to carry out similar assessments.

Article 29 àMember States and EU entities are required (annually or biannually) to carry out risk assessments that:

• identify public sector activities using cloud services in areas covered by Annexes I/II of the NIS2 Directive and in the spheres of national security, defence, justice and law enforcement;
• determine which assurance level (Union assurance level 2, 3 or 4) is appropriate for a given activity.

The Commission has the power to impose the methodology for this assessment by means of implementing acts and, if it considers the Member State’s assessment to be inadequate, to determine the required level itself (Article 29(5)).

Article 30à

Paragraph 2: entities whose activities are not classified as important for public order must use at least level 1 cloud services.

Paragraph 3: contracting entities whose activities have been so qualified (NIS2, national security, defence, justice sectors) may only procure cloud services classified as level 2, 3 or 4 .

Paragraph 4: allows for derogations in exceptional, justified cases (lack of available services on the market, lack of offers in the previous procedure, grossly disproportionate cost).

Art. 32 àIn procurement procedures for innovative cloud services and AI systems, contracting authorities must take into account non-price criteria for the evaluation of offers , including:

• the contractor’s contribution to strengthening the EU digital technology supply chain,
• the use of technologies developed in the EU (including the results of EU R&D programmes),
• providing the service using hardware components designed/manufactured in the EU.

Recital 67 clarifies that this criterion cannot be decisive and suggests an indicative maximum weighting of 15 points out of 120 in the tender evaluation methodology – it is intended to be subsidiary to the technical and financial criteria.

Article 33à Member States are to aim to ensure that at least 25% of procurement for cloud services and AI systems goes to innovative SMEs, and report annual data on SME participation in procurement to the Commission.

V. Relationship of the CADA project with existing EU legal acts

1. AI Act (Regulation 2024/1689)

The AI Act governs the security and fundamental rights of AI systems; the CADA governs the sovereignty of the infrastructure that supports these systems.

Art. 2 point 3 of CADA does not create its own definition of an AI system, but refers directly to the AI Act à”‘AI system’ means an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689″

Explanatory memorandumà “The proposal also reinforces key objectives of the AI Act. The AI Act harmonises rules for AI systems and general-purpose AI models to be placed on the EU market, improving the functioning of the internal market and promoting the uptake of human-centric and trustworthy AI along the value chain. The AI Act ensures a high level of protection of health, safety and fundamental rights. It does not cover aspects of sovereignty.” – The Commission explicitly states that the AI Act does not cover the issue of sovereignty – this is the very gap that CADA aims to fill.

CADA entrusts the AI Board (the body established under the AI Act) with a coordinating role beyond its original mandate:

• Motif 33à “As cloud computing underpins and enables AI, the AI Board should serve as a platform to facilitate cooperation and coordination of AI adoption-related activities between the Union and the Member States.”
• Article 7(6) gives the AI Board a specific operational responsibility: to advise and support Member States in coordinating national cloud and AI strategies required by CADA, and to facilitate the exchange of good practices between Member States.

This is an important institutional arrangement: CADA does not create a new, parallel body for AI issues, but extends the remit of the existing body from the AI Act to a new area (cloud as an infrastructure supporting AI).

2. Data Act (Regulation 2023/2854)

The Data Act, effective from September 2025, imposes obligations on cloud service providers to facilitate data portability and switching. CADA builds on this foundation by adding a dimension of sovereignty: it’s no longer just about data portability, but also about ensuring that data remains under the sole jurisdiction of the EU throughout its time in the cloud. The two acts create a complementary layer of protection: the Data Act allows for switching providers, and CADA establishes criteria for which alternative cloud services are considered sufficiently sovereign. Without CADA, the Data Act’s switching mechanism would be “blind” to the quality or sovereignty of the target provider.

“”The proposal is consistent with the rules on switching between data processing services introduced by the Data Act. By enabling switching and removing key sources of vendor lock-in, the Data Act seeks to ensure that cloud computing service providers in the EU compete on quality, innovation, and price. It seeks to enable cloud users to freely choose the provider that best meets their needs and combine offers of different providers in a multi-cloud approach.”

“However, the Data Act does not contain elements to shape up a more competitive offer of European cloud computing services or encourage the entry into the market of a more diverse set of cloud computing service providers.”

“The Data Act opens the path towards a possible reduction of dependencies on non-EU providers but does not build the road towards a more sovereign and trusted EU cloud computing sector. […] The Data Act is thus an enabler for the proposal.“

3. Data Governance Act (Regulation 2022/868)

The Data Governance Act, effective from September 2023, establishes a framework for neutral data intermediaries and the reuse of public sector data. The CADA does not explicitly address the DGA in its text. However, it imposes sovereign certification requirements on the infrastructure storing this data, which in practice limits the range of providers deemed suitable for handling data covered by the DGA.

4. Digital Markets Act

The DMA, effective from May 2023, imposes obligations on gatekeepers, including interoperability requirements and prohibition of self-preferential services. CADA and DMA operate under different logics: DMA regulates market behavior ex ante, while CADA creates positive eligibility criteria for the public sector. There is a risk of conflict between the interoperability obligations with the DMA and the closed architectures required by the highest levels of CADA sovereignty.

5. Digital Services Act and the general regulatory context

The DSA, fully applicable since February 2024, governs the liability of online intermediaries. Although it does not directly address cloud infrastructure, it contributes to a regulatory climate characterized by high levels of EU intervention in the digital market and increasing assertiveness towards global technology providers.

“While certain providers of cloud computing services could be regulated under both this proposal and the DMA, the DMA has different objectives and does not contain measures that would actively promote the uptake of sovereign cloud computing services . The DMA only aims at maintaining and promoting a fair and contestable cloud market in the Union, regulating specific behaviors of companies designated as gatekeepers and thus intervenes at a different level than the proposal, which focuses on the uptake and use of the services provided.”

VI. Arguments in favor of introducing CADA regulations

• Security and strategic independence: AWS, Microsoft Azure, and Google Cloud control approximately 70-80% of the EU cloud computing market. This concentration means that key EU administrative, banking, and healthcare systems are de jure accessible to US authorities under the US CLOUD Act (the CLOUD Act gives US law enforcement and intelligence agencies the right to demand access to data from US service providers (including cloud computing providers)  – regardless of the physical location of the servers on which that data is stored.) – which EU authorities classify as a security risk. CADA will help mitigate this risk by introducing a complex system of vendor evaluation criteria.
• Risk of service interruptionà “This dependence also exposes European users to the risks related to operational discontinuity, particularly in scenarios where unilateral decisions by third-country actors could disrupt service provision.”
• Critical loss of market position for European providers – “While the EU market for cloud computing services is growing significantly, the market share of EU providers decreased from 29% in 2017 to 15% in 2022 and has remained stagnant since then.” CADA will help them regain their strategic position.
• Industrial and investment goal: The project assumes tripling the capacity of data centers in the EU within 5–7 years, which will significantly improve the efficiency and functionality of the AI system in the EU àtoday: “The EU’s limited data center capacity poses a significant threat to its ability to benefit from the digital transformation and adopt AI-driven solutions, notably those requiring low-latency compute capacity.” The lack of appropriate infrastructure also hinders the EU’s economic growth: “the lack of data center capacity in the EU forces European enterprises to route critical workloads through foreign hyperscaler infrastructure. This makes the EU a less attractive destination for tech investment than regions with more abundant, lower-cost compute resources.”
• Enabling the use of the EU’s own potential – “Europe has world-class research and development capabilities, vibrant open-source communities and a strong industrial base in cloud and AI, which however remain largely untapped.“

VII. Tensions with Single Market Principles and Competition Law

The CADA project, whose legal basis is Article 114 and Article 173(3) TFEU (harmonisation of the internal market and strengthening of the EU’s industrial competitiveness), is consciously constructed by the Commission as a means of removing internal market barriers – the argument justifying the intervention is precisely the divergence of national sovereignty criteria and procurement practices, which hinders suppliers from operating freely between Member States.

Despite this declared harmonisation logic, the practical effect of the sovereignty criteria at levels 3-4 (complete lack of control by a third-country entity, EU citizenship of staff, location of the entire infrastructure in the EU) may in fact restrict the freedom to provide services by non-EU suppliers in the EU internal market. However, the Act itself does not explicitly address this potential tension with Article 56 TFEU – the Commission locates the justification for procurement restrictions not in primary EU law, but in the public policy exception in Article III:2(a) of the WTO GPA (recital 64), consistently using the category of “public order” as the substantive basis for the restrictions (recitals 49-53).

The question whether the criteria thus constructed – despite their declared technological neutrality – in fact constitute a measure having an effect equivalent to a quantitative restriction or infringe the principle of proportionality required for derogations from the internal market freedoms remains open and not determined by the text of the act itself – this would require an assessment by the Court of Justice of the EU in a possible preliminary ruling procedure or an action for annulment.

Application

It is believed that despite the weaknesses identified earlier, the CADA project offers more benefits than threats – especially in the context of growing cyber warfare, where information, not just physical critical infrastructure, becomes the primary weapon.

Data collected by healthcare providers, the banking sector, and digital service providers is strategic in nature – its confidentiality and integrity today determine the security of citizens to a degree comparable to energy or military security. As the Schrems II case demonstrated, no contractual safeguards effectively protect against a situation in which an infrastructure provider is legally obligated to disclose data to third-party authorities – regardless of the physical location of the servers. CADA addresses precisely this gap: it no longer regulates only the method of data processing, but also the structure of control over the entity that manages it. This seems to me a necessary step, not an unnecessary one.

The complete dependence of the European digital economy on external infrastructure providers would limit its ability to fully develop – particularly in the field of artificial intelligence, where control over training data and computing infrastructure is becoming a key factor in competitiveness. The European Union possesses significant research and development resources, which currently remain largely untapped due to the lack of coherent institutional and regulatory support to fully develop their potential. CADA, by combining infrastructure investments with preferential procurement criteria, is attempting to fill this gap.

A mechanism to level the playing field for smaller European providers is also crucial. Automatic recognition of compliance for SMEs at the basic assurance level and the goal of at least a quarter of cloud and AI service contracts going to innovative SMEs create a real stimulus for development—not just a barrier for large entities. Such a competitive boost could, in the long run, motivate European providers to continually improve the quality and innovation of their services, rather than remain permanently in the shadow of foreign hyperscalers.

Finally, the planned tripling of data centre capacity in the EU over the next 5-7 years is an investment not only in sovereignty, but also in the security of the data itself – a distributed, redundant infrastructure located within the EU reduces the risk of systemic failures, service interruptions or abuses resulting from unilateral decisions by foreign entities.

Artykuł NOTE – EU Cloud and AI Development Act (CADA) project and the concept of the sovereign cloud in the European Union’s digital policy pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

1. Reports only via e-Sanepid

Every dietary supplement introduced to the market for the first time must be reported to the Chief Sanitary Inspector (GIS). Until now, various forms were acceptable – paper or electronic, with a handwritten or electronic signature. After the amendment comes into effect, the only acceptable method will be the e-Sanepid platform.

What does this mean in practice?

• It is necessary for each person submitting notifications to have a qualified electronic signature or a trusted profile.
• All communication with sanitary inspection bodies – letters, decisions, and confirmations – will be handled through the platform account. The moment of notification submission will be clearly confirmed with an official receipt, eliminating disputes over the deadline.
• Companies that have previously used paper forms or traditional correspondence must immediately switch to the new channel and ensure appropriate employee training.

The change also concerns the timing of the notification obligation: the previous option to notify the Chief Sanitary Inspectorate (GIS) at the stage of intended product introduction is no longer available. The obligation now arises at the time of actual introduction to the market.

2. Strict deadlines and automatic presumption of irregularities

The amendment introduces a completely new mechanism for conducting investigations. This change has the greatest potential to surprise companies without effective internal compliance procedures.

How does the new mechanism work?

If the Chief Sanitary Inspectorate initiates an investigation and requests the entity to submit a scientific opinion, the company has exactly 14 days to submit an application to an accredited scientific unit – at the same time forwarding a copy of it to the Chief Sanitary Inspectorate.

The mechanism for presuming irregularities is a significant innovation. Previously, a company’s inaction during the proceedings did not automatically result in any legal consequences – the proceedings could drag on for years. Following the amendment, any failure to meet the 14-day deadline will lead to direct negative consequences, regardless of whether the product is safe.

3. Advertising without reporting? A fine of nearly one million zlotys

This change directly impacts brands engaging in active digital marketing. Previously, advertising or presenting a dietary supplement without prior notification to the Chief Sanitary Inspectorate (GIS) was punishable by a fine (a misdemeanor). Following the amendment, this becomes grounds for imposing an administrative fine – with new, significantly higher penalties.

What exactly is prohibited?

The amendment penalizes not only the sale of a supplement without reporting it to the Chief Sanitary Inspectorate (GIS), but also the mere advertising or presentation of it if the notification has not been effectively submitted. In other words:

• Sponsored post on Instagram or Facebook promoting a new supplement before notification = grounds for an administrative penalty.
• Product page in the online store visible to the public before successful reporting to GIS = risk of infringement.
• Promotional materials sent to wholesalers or distributors before GIS is notified = potential infringement.
• Influencer marketing initiated before the date of effective notification = liability on the part of the entity commissioning the campaign.

Prohibition on suggesting medicinal properties – wider scope

The amendment expands liability for violations of advertising requirements from labeling to the entire marketing message. Previously, sanctions primarily covered incorrect packaging labeling. Following the amendment, a company is responsible for every communication channel – online advertising, point-of-sale materials, newsletters, or YouTube videos – if the message suggests that a varied diet does not provide sufficient nutrients, or if a supplement is presented as a medicinal product.

4. Public register – the company’s reputation under public scrutiny

The Chief Sanitary Inspectorate (GIS) has maintained a register of dietary supplements before, but the amendment will significantly expand its scope and availability. The data will be published on the e-Sanepid platform and will include:

• the name of the product and its qualitative composition (without quantitative data – the recipe remains protected),
• product qualification proposed by the entity,
• information about the initiation or ongoing investigation,
• data on the detection of a prohibited ingredient.

5. Fines – increase by over 330%

The maximum administrative fine for violating food safety regulations is increasing from 30 to 100 times the average monthly salary. At the current salary level, this means:

The new penalties are imposed administratively (not as fiscal or misdemeanor offenses), which means faster proceedings and no need to prove intentional guilt. A mere finding of a violation is sufficient. The increased level of sanctions has a real deterrent effect, especially for companies with turnover in the tens of millions of zlotys.

The biggest risks – a practical overview

Artykuł CLIENT ALERT Dietary supplements market in Poland Amendments to food safety regulations | May 2026 pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.