Consumer Protection

The Bank of England's Prudential Regulation Authority ordered a Section 166 skilled-person review of Revolut's internal controls for approving new products, following similar concerns previously raised by the European Central Bank, which had restricted Revolut's growth in 2025 over deficiencies in its new-product approval process. The order lands as Revolut, newly granted its full UK banking licence, pushes into unsecured personal loans and private-market investment products. CEO Nik Storonsky has urged staff to operate like 'self-guided missiles' with limited oversight when building new products.

Rhode Island Attorney General Peter Neronha sued Meta, alleging the company knowingly profited from fraudulent advertising: approximately 10% of Meta's 2024 ad revenue (~$16 billion) came from ads for scams or restricted goods, it used user data to help advertisers target consumers most susceptible to fraud (particularly seniors over 60), and it charged premium rates rather than removing suspected fraudulent ads, generating roughly $7 billion annually from ads presenting higher legal risk. Rhode Island is the first state to file this type of suit against Meta, following a similar action by Santa Clara County, California. Meta called the lawsuit 'unfounded' and cited removal of over 159 million scam ads in the past year.

The European Commission opened formal proceedings against Booking.com under the Digital Services Act on October 21, 2026, alleging the platform failed to diligently assess and mitigate systemic risks from fraudulent property listings and phishing scams that exploit its reservation and guest-messaging data, and failed to clearly label 'boosted' paid search listings as advertisements as required by DSA Article 26(1). A Commission official described Booking.com's approach as 'absolutely substandard.' The investigation follows a multi-year preliminary review of Booking.com's risk assessments and is being conducted in cooperation with the Dutch Authority for Consumers and Markets.

A federal filing confirmed that Tesla's driver-assist system (Autopilot or FSD) was engaged when a vehicle crossed a highway median on Route 55 in Vineland, New Jersey, killing 68-year-old Phillip Eastman, a longtime youth hockey coach and newly sworn-in school board member, on October 15, 2026. Initial police and local news reports made no mention of driver-assist being involved; Tesla's own federal filing later revealed the system was engaged within roughly 30 seconds of impact, but Tesla redacted the crash narrative, the software version in use, and whether the road was within the system's approved operating area, marking them as confidential business information. Engagement does not by itself establish that the system caused the crash; a driver override was possible.

A third-party software defect caused Wise's UK 'Wise Assets' investment product (Wise Interest and Stocks) to issue incorrect capital-gains and income figures on tax statements to roughly 4,000 UK customers for self-assessment returns covering 2021-2025, with some customers overpaying and others underpaying tax. Wise discovered the error through internal quality controls, fixed the underlying issue, reissued corrected statements, and is negotiating a bulk settlement with HMRC to cover shortfalls while committing to redress customers who overpaid.

Politico reported on October 4, 2026 that Apple and Google have been lobbying state legislatures across the US (including Arizona, Georgia, and Kansas) to promote an alternative bill, the 'Mobile Ecosystem Responsibility Act' (MERA), in response to a wave of state app-store accountability and age-verification bills. MERA would bar private rights of action over app-store child-safety and age-verification failures, leaving enforcement solely to state attorneys general and shifting liability away from the app stores. The reporting was based on draft legislation, internal emails, and interviews with seven people with knowledge of the lobbying effort; Apple's state lobbyists and trade-group allies circulated the alternative bill within days of competing bills being introduced.

Politico reported on October 4, 2026 that Google and Apple have been lobbying state legislatures across the US (including Arizona, Georgia, and Kansas) to promote an alternative bill, the 'Mobile Ecosystem Responsibility Act' (MERA), in response to a wave of state app-store accountability and age-verification bills. MERA would bar private rights of action over app-store child-safety and age-verification failures, leaving enforcement solely to state attorneys general and shifting liability away from the app stores. A Google lobbyist presented the alternative bill during a Georgia Senate committee hearing on February 17, 2026, and Google/Apple lobbyists circulated the model bill within three days of a competing Arizona bill's introduction. The reporting was based on draft legislation, internal emails, and interviews with seven people with knowledge of the effort.

Kenya's National Assembly Public Petitions Committee formally received, on October 3, 2026, a petition challenging Safaricom's practice of deactivating SIM cards after roughly six months of inactivity and later reassigning the numbers, which leaves M-Pesa mobile-money balances difficult or impossible for customers and - in several cited cases - deceased subscribers' estates to recover. The petition questions whether the practice complies with Kenya's Law of Succession Act (which bars unauthorized intermeddling with a deceased person's property) and the Unclaimed Financial Assets Act, and whether unrecovered balances are properly remitted to the Unclaimed Financial Assets Authority (UFAA). On October 6, 2026, Communications Authority of Kenya Director-General David Mugonyi appeared before the committee; as of the most recent hearing no new recovery mechanism had been established. The committee's inquiry is expected to also hear from Safaricom, the Central Bank of Kenya, UFAA, and consumer representatives.

In April 2024 Trade Republic agreed to stop running advertising for its 'Zinsen auf Dein Cash' (interest on your cash) offer after Verbraucherzentrale Baden-Wurttemberg, Germany's Baden-Wurttemberg consumer protection agency, found the ads did not clearly disclose that customers had to manually 'activate' interest in the app to receive it; in July 2026 the parties reached a court settlement requiring the company to stop the non-transparent advertising. Despite this, Trade Republic is refusing to retroactively pay customers who missed interest payments because they never knew activation was required, citing the same lack of activation the settlement found was inadequately disclosed. The consumer agency's Niels Nauhauser publicly called the refusal 'audacious' and said affected customers should not have to accept it.

When the BCEAO-backed instant interoperable payment platform PI-SPI launched across the West African Economic and Monetary Union on September 30, 2025 with 31 participating providers, Wave Mobile Money -- whose business model is built on a 1% transfer fee -- was conspicuously absent from the initial cohort. Wave only joined roughly a year later, around October 2026, as the regulator (BCEAO) moved to make PI-SPI participation mandatory ahead of a November 2, 2026 deadline and simultaneously capped mobile-money transfer fees (free for transfers up to 8,000 CFA francs/day, 0.8% above that). Industry analysts noted that free interoperable transfers directly threatened to erode Wave's fee-based competitive advantage, which had become a pricing benchmark across its markets, making the delay a strategic holdout rather than a technical one. A Senegalese lawmaker separately accused competitor Orange Money of shifting costs to withdrawal fees to blunt the same interoperability mandate, illustrating sector-wide resistance to the lower-fee system that regulators were trying to mandate for consumers' benefit.

Telangana's food safety authority (TG SAFE) inspected 16 quick-commerce dark stores across Hyderabad on September 30, 2026, and suspended the FSSAI licences of two Swiggy Instamart (Kwickbox Retail) outlets - at Pet Basheerabad and Saidabad - after finding cockroach infestation, fungal/mould growth, melted dairy products, expired food, and unhygienic, poorly-recorded storage. Three more Swiggy Instamart stores in the same sweep received improvement notices and three received show-cause notices for comparable violations. The same inspection drive also suspended licences at Flipkart and Zepto dark stores.

Telangana's food safety authority (TG SAFE) inspected 16 quick-commerce dark stores across Hyderabad on September 30, 2026, and suspended the FSSAI licence of a Flipkart (Instakart Services) outlet near Charminar after finding expired and damaged food products, rotten vegetables, rusted and dusty shelves, food stored alongside non-food items, and poor cold-room temperature monitoring. Two more Flipkart dark stores in the same sweep received improvement notices and two received show-cause notices for comparable violations. The same inspection drive also suspended licences at Swiggy Instamart and Zepto dark stores.

Telangana's food safety authority (TG SAFE) inspected 16 quick-commerce dark stores across Hyderabad on September 30, 2026, and suspended the FSSAI licence of Zepto's Ram Koti outlet after finding heavy cockroach infestation, fungus-contaminated vegetables, expired and damaged food products, and unhygienic, dusty storage, ordering an immediate halt to operations at that store. The same inspection drive also suspended licences at Swiggy Instamart and Flipkart dark stores.

Following 'substantive regulatory dialogue' with the European Commission under the Digital Markets Act, Booking.com implemented voluntary changes on September 28, 2026: it removed contractual parity clauses that barred hotels from offering lower prices on their own websites, stopped using external price comparisons to determine eligibility for its 'Booking Sponsored Benefit' placement, and published new transparency information on ranking methodology and program eligibility criteria (Genius, Preferred, Preferred Plus). The European Commission described these as compliance measures following dialogue, not a formal infringement decision or fine. The changes are without prejudice to separate ongoing national antitrust investigations in Greece, Italy, and Spain.

Brazilian consumer-defense institute Idec filed a request with the Ministerio Publico Federal (MPF) asking it to investigate Mercado Livre and Mercado Pago's requirement that sellers and couriers submit to facial biometric verification to access or keep their accounts active, with no alternative authentication method offered. Idec argued the practice risks digitally excluding users whose recognition fails due to device quality, lighting, age, disability, or phenotypic characteristics, and sought disclosure of the company's data protection impact assessment, audits of the biometric system, and information on account-blocking and human-review processes, plus referrals to Brazil's data protection authority (ANPD), the Central Bank, and consumer agency Senacon. Mercado Pago said it had not been notified of the investigation request and defended its use of facial recognition. Idec separately launched a public campaign, 'Quem ve cara, nao ve permissao,' calling for ANPD regulation of private-sector biometric data use.

A Reuters investigation published September 18, 2026 profiled Alice de Queiros, a 30-year-old Brazilian public servant earning close to minimum wage (~$300/month), whose Nubank credit card limit was raised twentyfold between 2022 and 2025 without any request for proof of income. She told Reuters 'they didn't even ask for proof that I had the income to repay it'; she now owes roughly $1,500, nearly her entire paycheck goes to repayment, and she has had to move in with her mother. Reuters situated the case within a broader pattern of high-cost Brazilian fintech lending -- Central Bank data from late August 2026 put unsecured consumer loan rates at 103.37% annualized for Nubank, versus 178.69% for Mercado Credito and 213.69% for PicPay -- against a backdrop where 82% of Brazilian households carry debt and revolving credit-card rates reach roughly 440% annualized. Fundacao Getulio Vargas economist Lauro Emilio Gonzalez Farias told Reuters 'we have a predatory lending model,' and the IMF's July 2026 review flagged fintechs for targeting low-income customers. Nubank responded that its credit decisions account for existing debt and income-commitment ratios, citing privacy rules on individual cases.

Nubank co-founder and CEO David Velez has publicly and repeatedly urged the Colombian government to eliminate or dismantle the country's 'tasa de usura' (usury rate cap), which limits maximum interest rates lenders can charge. Velez reiterated the call in September 2026 alongside Nubank's announcement of a 5-trillion-peso (~$1.3B) Colombia investment through 2030, arguing the cap is 'the biggest obstacle' to financial inclusion and that controlling prices limits credit markets. Economic-policy group ANIF opposed the proposal, warning that removing the cap would strip legal protection from vulnerable borrowers and could push more Colombians toward illegal 'gota a gota' lenders charging 382-666% annual rates. As Colombia's largest digital lender, Nubank would benefit financially from a higher or unregulated rate ceiling.

NHTSA opened Audit Query AQ26002 and issued a Special Order requiring Tesla to certify under oath, by September 30, 2026, how its Cybercab robotaxi - which has no steering wheel, pedals, or mirrors - complies with Federal Motor Vehicle Safety Standards. The order followed Tesla's September 3, 2026 launch of commercial Cybercab service in Austin, Texas, and carries civil penalties up to $139 million and potential criminal liability for false or withheld information.

Australia's communications regulator ACMA found that between June 26 and October 30, 2025, Telstra failed to use required identity-authentication processes for high-risk account transactions, contravening Section 8 and subsection 13(1) of the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022 and subsection 101(1) of the Telecommunications Act 1997. The investigation identified 15 unauthorized SIM swaps enabled by the lapses, contributing to customer fraud losses. ACMA issued Telstra an infringement notice of A$277,200, published September 3, 2026, alongside an enforceable undertaking.

UK consumer group Which? set up a fake listing for the UK Prime Minister's residence at 10 Downing Street on Booking.com in minutes, using the real address and photo. The listing received 14 inquiries in a 20-minute window, had a fabricated 10/10 review published despite promised moderation, and Booking.com processed a payment for a week-long stay that remained unrefunded more than six weeks later. Which? also used Booking.com's internal messaging system to send an external phishing-style payment link requesting card details without triggering interception. The listing stayed live for about six weeks before removal on August 27, 2026; under Booking.com policy, hosts are not required to provide ID or proof of ownership until three months after a listing goes live. Booking.com disputed the test's methodology, and Which? urged UK regulator Ofcom to investigate the platform's compliance with the Online Safety Act.