Costa Rica has just approved its first digital governance law. Law No. 10946, the Law on the Governance of Digital Services and Electronic Commerce, was published in Supplement No. 80 to La Gaceta No. 116 of June 24th, 2026, and will enter into force twelve months thereafter. During that period, the Executive Branch shall issue the corresponding regulations, as provided in its sole transitory provision.

At first glance, it appears to be another rule on electronic commerce. Upon closer reading, Article 1 reveals a broader reach. The purpose of the law is not limited to regulating electronic transactions; rather, it comprehends the information society services, the obligations and responsibilities of their various actors—especially providers of online intermediation services—and the preparatory activities of electronic commerce, such as advertising and the information provided to consumers regarding the characteristics, description and price of goods and services.

The objectives declared by the law itself help explain its logic. It seeks to effectively protect consumers, guarantee their fundamental rights, and increase their decision-making capacity and autonomy in the digital environment, with the aim of establishing a transparency framework for online platforms. This combination of autonomy, transparency and governance provides a lens through which many of the obligations subsequently developed can be understood.

The subjective scope of application also merits attention. The law applies to any natural or legal entity, public or private, that provides information society services—a concept defined by the law itself in Article 4—or carries out activities included within its purpose. Depending on the activity performed and the definitions set out in that same article, this may include merchants, online platforms, providers of intermediation services, search engines, data hosting services and cross-border digital service providers, defined in Article 4 as those services provided by suppliers not domiciled in Costa Rica but consumed from within the country.

That said, not all obligations apply with the same intensity to all subjects covered by the law. Article 42 excludes micro, small and medium-sized enterprises registered with the Ministry of Economy, Industry and Commerce (MEIC) from the obligations set forth in Chapter V on due diligence, for as long as they maintain that status.

The fact that an organization is not directly subject to all obligations does not mean it can disregard the law. Many of its provisions reflect good practices in transparency, consumer information and responsible design that may serve as a reference for any organization offering digital services or maintaining an electronic relationship with customers, even when it is not subject to all the law’s specific requirements. Viewed from this perspective, the law also constitutes a useful benchmark for good digital governance practices.

The law incorporates rules aimed at combating so-called commercial dark patterns1, expressly defined in Article 4 as digital practices that alter consumers ' decision-making through the way in which options are presented to them. Article 17 prohibits the preselection of services or features that the consumer has not chosen, as well as the use of automatic mechanisms that mislead consumers to obtain their consent. Article 39 develops this

approach and prohibits the design of interfaces that distort users’ ability to make free and informed decisions, including by giving greater visual prominence to one consent option over another or by making it significantly more difficult to cancel a service than to contract it. What for years was mainly a debate about digital design ethics and user experience2 now carries concrete regulatory consequences under this law.

Another set of obligations concerns automated systems. Article 48 requires platforms that use recommendation systems to clearly explain the main parameters used, the relative importance of each parameter and the objectives for which they were optimized. Article 43 provides that decisions regarding complaints filed by service recipientsmust not be made exclusively through automated processes and that meaningful human intervention must exist when the context so requires. Article 47 incorporates transparency obligations in digital advertising and prohibits the use of personal data of children under thirteen years of age for personalized advertising based on behavior. Article 33, for its part, protects end-to-end encryption and prohibits any authority from imposing general obligations for the indiscriminate retention of personal data, except pursuant to a specific and reasoned court order.

Organizations with mature Compliance programs have already been incorporating obligations that go beyond the prevention of corruption or fraud. Personal data protection, antitrust, consumer protection, whistleblowing channels, public procurement and, more recently, artificial intelligence governance are some examples. Law No. 10946 fits within this evolution and raises new challenges linked to digital governance. It will now also be necessary to assess whether the information provided to consumers is sufficiently clear, whether cancelling a subscription is as simple as contracting it, whether the organization can explain how its recommender systems operate, or whether certain design decisions may affect users’ autonomy.

Addressing these questions can hardly be done from a single discipline. The law itself, by providing that its rules are understood without prejudice to other legal regimes—consumer protection, competition law, personal data protection, telecommunications, intellectual property and digital signatures—confirms that digital governance requires a cross-functional approach in which Compliance, technology, marketing and user experience work toward a common objective.

The period prior to the law’s entry into force should not be viewed as time to postpone preparation. The pending regulations will provide technical criteria on how the Administration expects these obligations to be implemented and enforced, which reinforces the advisability of anticipating them. Organizations that use this period to conduct an applicability assessment, identify gaps and adjust platforms, terms and conditions, and internal processes will reach 2027 in a different position from those that choose to wait.

In any event, preparation should not respond solely to a preventive or good-practices rationale. The law itself incorporates a sanctions regime and grants the National Consumer Commission authority to hear and sanction the violations established therein. Depending on the obligation breached, the law distinguishes between minor and serious infringements and provides fines, warnings and other corrective measures, confirming that many of these requirements will have concrete legal consequences once the law enters into force.

If the evolution of Compliance has demonstrated anything, it is that its boundaries do not remain static. Law No. 10946 represents one more step in that evolution. Going forward, organizations will also need to assess matters such as interface design, the mechanisms used to obtain users' consent, and the transparency of recommendation systems.

1The term dark patterns was coined on July 28, 2010, by Harry Brignull, a user experience specialist, with the registration of the site darkpatterns.org, now available as deceptive.design. Brignull consolidated the conceptual framework in his reference book on the subject: Brignull, H. (2023). Deceptive patterns: Exposing the tricks tech companies use to control you. Testimonium Ltd. ISBN 978-1-7394544-0-1. The concept was later incorporated into international regulatory instruments, including Regulation (EU) 2022/2065 of the European Parliament and of the Council, of October 19, 2022, on a Single Market for Digital Services (Digital Services Act). Law No. 10946 adopts the expression "commercial dark patterns" and expressly defines it in its Article 4.

2The term user experience (UX) was coined in 1993 by Don Norman to identify his team at Apple Computer. The Nielsen Norman Group, the usability research firm founded by Norman and Jakob Nielsen, defines it as encompassing every aspect of the end user's interaction with a company, its services, and its products.

Nielsen Norman Group. (n.d.). What is User Experience (and What Is It Not?) Retrieved from https://www.nngroup.com/articles/what-is-user-experience/