The BCLI Mathew Good Memorial Prize 2026

How the Law Falls Behind: Digital Consumer Markets, Buy Now Pay Later, and Online Sports Betting

By Adhithya Krishnan

Introduction

On any day in Vancouver, a second-year university student with little income, no credit history, and a part-time barista shift can complete two financial commitments before her espresso machine finishes its cycle. She can finance a bike she cannot afford by tapping a four-instalment plan at a digital checkout, and she can stake the equivalent of her next paycheque on a single in-play wager pushed to her phone by a betting application that learned her preferences from her last session. Neither transaction triggers a hard credit check and neither prompts a meaningful pause. Neither is mediated by a human professional or a regulator with the authority to intervene at the moment of harm. By the end of the week, she may be servicing three overlapping Buy Now, Pay Later (BNPL) plans and chasing losses on a betting platform whose user interface has been engineered to keep her staking money she does not have. The screen on which all of this unfolds is the market itself, and it has been designed in ways that the law has not yet learned to adequately regulate.

Canadian law, including the law of British Columbia, treats these two products as belonging to entirely separate regulatory worlds. BNPL credit is governed, to the extent it is governed at all, by a patchwork of provincial consumer protection statutes such as the Business Practices and Consumer Protection Act (BPCPA) and partial federal oversight through the Financial Consumer Agency of Canada (FCAC).[1] Online sports betting falls under a Criminal Code exemption introduced by Bill C-218 in 2021 and is licensed provincially through bodies such as the British Columbia Lottery Corporation (BCLC), which operates PlayNow.com, alongside the Ontario private market model administered by iGaming Ontario.[2] That separation made sense when credit was extended through bank branches and when gambling required physical attendance at a licensed premise. The migration of both products to digital delivery has fundamentally reshaped them, erasing the structural differences on which the bifurcated regulatory architecture depended. What now matters in both markets is not whether the consumer is buying credit or placing a wager. It is the architecture of the screen on which she does so.

This submission is an essay about the law not keeping up in this domain. Both BNPL and online sports betting now generate revenue through an identical set of digital mechanics: frictionless onboarding that suppresses deliberation at the point of entry, repeated microtransactions whose individual magnitude appears trivial but whose cumulative exposure is significant, and interface design that systematically exploits behavioural biases to sustain engagement and spending.[3] Neither the consumer credit regime nor the gambling oversight framework reaches the mechanism through which harm is delivered, which is the digital interface itself. The result is a regulatory blind spot that is itself a product of organizing regulation by product category in a market in which the method of distribution is the highest common denominator.[4]

This paper argues that the distinction between “credit” and “gaming” is an artefact of a pre-digital market, that the law’s continued reliance on that distinction is the central reason it has fallen behind, and that the emergence of digitally mediated consumer harm demands a unified legislative response. The paper proposes that the federal Parliament of Canada enact a standalone “Vulnerable Markets and Consumers Act” (VMCA) anchored in the federal trade and commerce power. The VMCA would rest on four pillars: meaningful disclosure, friction by design, affordability and exposure checks, and platform responsibility. The contribution of this paper is twofold. First, it demonstrates that BNPL and online sports betting share three operational mechanics, drawing on empirical literature from behavioural economics and human-computer interaction studies. Second, it translates this convergence into a legislative architecture that regulates the digital interface as the common site of consumer harm.

The paper proceeds in three parts followed by a conclusion. Part I establishes the regulatory lag, beginning in British Columbia and broadening to the federal scheme, and identifies the shared mechanics of BNPL and online sports betting. Part II explains why the dominant statutory response, mandatory disclosure, has failed to keep up with the digital interface and why interface governance is the appropriate replacement. Part III translates the analysis into the VMCA’s legislative architecture, anticipates the most significant counterarguments, and addresses the constitutional foundation of this proposed statute.

I. The Regulatory Lag and the Shared Mechanics of BNPL and Online Sports Betting

A. British Columbia and the Limits of Provincial Consumer Protection

British Columbia’s consumer protection scheme is, on paper, one of the more comprehensive in the country. The BPCPA regulates unfair practices, prescribes disclosure obligations for consumer credit, and confers private and public rights of action against suppliers who engage in deceptive or unconscionable acts. The Act, however, was drafted in 2004 with bricks-and-mortar retail in mind. Its disclosure provisions assume a credit relationship that begins with a written application, contemplates a borrower who reads paper terms, and presupposes that the moment of contract formation is meaningfully separate from the moment of purchase. None of these assumptions is true of a BNPL transaction completed in three taps on a mobile phone. A BC consumer who selects an instalment plan at a digital checkout is, formally, entering a credit agreement governed by provincial law, but the digital context strips that legal category of its protective content.

The same observation holds for British Columbia’s gambling regime. Under the Gaming Control Act, the BCLC holds a statutory monopoly on lawful online gambling in the province through PlayNow.com.[5] That monopoly, however, is increasingly nominal. BC residents access offshore betting applications without meaningful technical or legal obstruction, and the legalization of single event sports wagering in 2021 has accelerated the migration of consumer attention to platforms over which the province has no licensing authority. The provincial regulator can dictate the design of PlayNow.com, but the consumer harm is being generated on platforms whose interfaces sit outside provincial reach.

The FCAC’s 2021 Pilot Study on BNPL is the only federally funded research on the product.[6] It surveyed over one thousand Canadians and identified risks of over-borrowing, poor consumer understanding of credit score consequences, and inconsistent penalty structures. The FCAC nevertheless stopped short of recommending regulation, committing only to continued monitoring and consumer education. The report’s most useful contribution, for present purposes, is its implicit concession of a jurisdictional gap. This paper contends that BNPL falls between federal banking regulation and provincial consumer protection, with no regime claiming clear authority over the digital interface through which the product is delivered. Where BNPL providers fall within federal jurisdiction, FCAC oversight attaches to the entity but not to the design of the checkout interface that drives consumer harm.

Comparable jurisdictions provide some insight on what Canada’s next steps could be. The United Kingdom’s Financial Conduct Authority commissioned the Woolard Review, which found an urgent case for bringing BNPL within the existing scheme of regulation, documenting that the unregulated market had tripled in size and that many consumers incorrectly believed BNPL was already regulated.[7] Australia’s behaviourally informed market-failure analysis demonstrated multiple forms of regulatory failure attributable to regulatory capture and the absence of meaningful consumer protections.[8] The European Union’s revised Consumer Credit Directive has begun to bring third-party BNPL within the scope of consumer credit regulation with enhanced obligations.[9] The lag, in other words, is not theoretical. It is measurable against the legislative output of comparable jurisdictions over the past five years.

B. The Federal Lag: Bill C-218 and a Decade of Monitoring

On the gambling side, Bill C-218 amended the Criminal Code to legalize single event wagering in 2021 and delegated regulation entirely to the provinces.[10] Ontario’s experiment with a private market model through iGaming Ontario has permitted former grey market operators such as Bet365 and FanDuel to enter the legal market, accompanied by an unprecedented flood of gambling advertising and growing concerns from addiction researchers that responsible gambling programming has not kept pace with commercialization, and that a fundamental tension exists between provincial revenue generation and consumer protection.[11] The federal legislation on the consumer protection dimension of online gambling, beyond the Criminal Code amendment itself, is essentially absent.

Neither regulatory regime addresses the mechanism through which harm is delivered. BNPL regulation, where it exists, attaches to the credit product. Gambling regulation attaches to the gaming activity. The digital interface that delivers both products, which is the checkout flow that fragments a purchase into painless instalments and the betting application that converts real currency into platform credits and presents one-tap wagering, sits comfortably outside both regulatory perimeters. As Soni argues in the Columbia Law Review, the unique BNPL market structure, which is characterized by lender-merchant agreements that promote financing at the point of sale, means that disclosure-based regulation fails to address the merchant’s incentive to encourage spending. The interface is the site of harm, not merely the facilitator of a transaction.[12] The gap arises not from oversight within either regime but from the very fact of organizing regulation by product category in a market where the method of distribution is the highest common denominator.

C. Three Shared Mechanics

The case for cross-sectoral regulation rests on demonstrating that BNPL and online sports betting are operationally convergent, and therefore that they share structural features causally linked to consumer harm. Three such features warrant attention: frictionless onboarding, microtransactional compounding, and dark pattern interface design.

1. Frictionless Onboarding and Suppressed Deliberation

Both products minimize barriers to entry through architectures specifically designed to suppress deliberation at the moment of commitment. BNPL providers embed checkout widgets directly into retail interfaces, enabling consumers to fragment purchases into instalments with soft credit checks or none at all. Sports betting platforms offer rapid account creation, instant deposit mechanisms, and promotional incentives that accelerate the consumer to the wagering stage. The frictionless nature of these transactions is deliberate. The revenue model in both cases depends on transaction volume, that is, transaction amount multiplied by frequency.

A consumer encountering a BNPL option at an online checkout is typically presented with a single prominent button offering to split the purchase into four instalments, accompanied by a display showing only the per-instalment amount rather than the total cost. Approval is communicated in seconds and often requires nothing more than a name, date of birth, and email address. The absence of a hard credit inquiry means the consumer receives no signal that she is entering a credit relationship at all. The entire sequence from product selection to credit commitment can be completed in fewer clicks than it takes to read a standard credit card disclosure. Sports betting onboarding follows the same logic. Platforms such as Bet365 and FanDuel routinely offer signup bonuses that require an initial deposit to unlock, funnelling the consumer through account creation and into a funded wagering position within minutes. Deposit mechanisms default to the fastest available method, and the conversion of currency into platform credits obscures the relationship between the funds in the consumer’s bank account and the amount at risk on the platform. In both cases, the onboarding architecture is not incidentally frictionless. It has been engineered to compress the interval between impulse and commitment to the point at which deliberation becomes very difficult.

The legalization of sports gambling in the United States has measurably deteriorated consumer financial health, with average credit scores in legalizing states declining modestly but detectably.[13] Analogous findings exist for the effects of BNPL: adoption correlates with increased overdraft incidence and bank fees, indicating that the product facilitates spending beyond consumers’ capacity.[14] In both markets, the suppression of deliberation at the point of entry is the mechanism through which consumers accumulate harmful exposure without the friction that would ordinarily trigger self-regulatory reflection.

2. The Compounding Effects of Repeated Microtransactions

The financial harm generated by both products arises not from single large transactions but from the cumulative effect of many small ones. This pattern is invisible to disclosure-based regulation, which operates at the level of the individual transaction and does not capture aggregate exposure across time and across platforms.

Prelec and Loewenstein’s double-entry mental accounting model demonstrates that consumers experience an immediate hedonic cost when making purchases, which serves as a natural brake on spending.[15] Credit instruments and digital payment methods decouple payment from consumption, reducing this pain and removing the brake.[16] BNPL exploits this mechanism by fragmenting a single purchase into four or more instalments, each individually painless. Sports betting exploits it by converting real money into platform credits and enabling rapid micro wagers whose individual stakes appear trivial. Further work on mental accounting explains why consumers systematically underestimate cumulative exposure: they treat money as non-fungible, assigning expenditures to separate mental accounts with independent budgets.[17] A consumer with three active BNPL plans and a weekly betting habit may track each commitment in isolation, never confronting total outflows, until it is too late.

Empirical research confirms that sports-betting legalization increases gambling participation rates, and that the resulting expenditure patterns display the compound characteristics predicted by behavioural theory: many small bets aggregating into significant financial harm.[18] Access to these products increases total spending beyond what standard intertemporal substitution models would predict, consistent with a “liquidity flypaper” effect in which the availability of painless credit induces consumption that would not otherwise occur.[19]

3. Dark-Pattern Interface Design as the Driver of Harm

The third and most significant shared feature is the deployment of manipulative interface design commonly termed “dark patterns.” These are the primary mechanism for sustaining consumer engagement and spending. The user interface is the first and most consequential site of behavioural manipulation, and it operates identically across both product categories.

A large-scale study by Mathur and colleagues crawled approximately eleven thousand shopping websites and identified 1,818 instances of dark patterns spanning fifteen types across seven categories, including sneaking, urgency, misdirection, and forced action. [20] The researchers also uncovered twenty-two third party entities providing dark patterns as turnkey solutions, demonstrating that manipulative design is becoming, or already is, an industry standard.[21] Gray and colleagues classify dark patterns into five categories: nagging, obstruction, sneaking, interface interference, and forced action, a taxonomy that maps cleanly onto both product categories.[22]

BNPL checkout flows deploy forced action through one click purchasing defaults, sneaking through hidden late fee structures, and interface interference through the visual de-emphasis of total cost information. Betting platforms deploy nagging through loss chasing prompts, obstruction through long withdrawal processes, and interface interference through the visual prominence of odds and promotional incentives alongside the suppression of loss data. The Office of the Privacy Commissioner of Canada’s 2024 Sweep Report confirms that these patterns are pervasive in Canadian digital markets, identifying nagging, obstructive design, preselected options, and interface interference as recurring features.[23] Although the report targets privacy, its findings transfer directly to financial and gambling interfaces because the underlying mechanism is identical. The United States Federal Trade Commission’s staff report further documents enforcement actions against platforms deploying manipulative billing interfaces, establishing authoritative regulatory recognition that dark patterns constitute actionable consumer harm.[24]

II. Why Disclosure Has Not Kept Up, and What Should Replace It

A. The Structural Failure of Disclosure in Frictionless Environments

The dominant statutory response to consumer harm in both credit and gambling markets has been mandatory disclosure. The premise is straightforward: a consumer who receives material information at the point of decision will process that information and act rationally. This premise is also defeated by design in digital environments where the timing, presentation, and salience of information are controlled by the firm delivering the product.

Ben-Shahar and Schneider’s critique of mandated disclosure demonstrates that disclosure regimes fail systematically across every domain studied, including healthcare, financial regulation, and constitutional rights such as Charter warnings during arrest.[25] Consumers find disclosures complex, obscure, and dull. They lack the literacy to analyze them. The cumulative volume of mandated disclosures means that no one could heed them all. The problem is not implementation but the concept of mandatory disclosure itself.[26] If mandated disclosure fails across every domain studied, there is no reason to expect it to succeed in the novel, high-speed digital environments of BNPL checkout and in-play sports betting, where interfaces are specifically engineered to direct attention away from risk information.

Brenncke argues that commercial practices that exploit consumer behavioural biases through online choice architectures constitute a distinct form of harm because the timing, sequencing, and visual hierarchy of information are all controlled by the firm.[27] The argument here is not that disclosure does not exist in these environments, but that it has been rendered functionally inert by the interface. A BNPL cost breakdown buried three screens into a checkout flow, presented in small grey text beneath a prominent “Complete Purchase” button, satisfies the letter of disclosure law while violating its purpose. A responsible gambling warning displayed briefly during account creation and never resurfacing during in-play wagering does the same.

Harris and Griffiths’ systematic review of electronic gambling harm minimization tools confirms the pattern empirically. The evidence on pop-up messaging is largely inconsistent and limited in changing behaviour, while limit-setting shows more promise but voluntary uptake is extremely low.[28] Interventions fail not because they convey inaccurate information but because the digital environment in which they are presented has been designed to minimize their salience.

B. From Disclosure to Interface Governance

If disclosure cannot do the regulatory work assigned to it, the question becomes: what should replace it? The central claim of this paper is that regulation must shift from prescribing what information is disclosed to prescribing how the transactional environment is structured. This is the move from disclosure regulation to interface governance, that is, the recognition that the design of the digital environment is itself a regulable object. It is also the change in the unit of legal analysis that allows the law to begin keeping up.

The foundation for this claim is Lessig’s argument that computer code functions as a form of regulation.[29] Under the “code is law” framework, four modalities constrain behaviour: law, social norms, markets, and architecture.[30] In cyberspace, code is the dominant modality, and choices about what code will govern cyberspace are fundamentally political choices about values.[31] If code is law, then BNPL checkout flows and betting application interfaces are already regulating consumer behaviour by design, in the platforms’ commercial interest. The VMCA’s interface standards are therefore not new regulation but a rebalancing of an existing architectural regulation, from platform serving to consumer protecting.

Thaler and Sunstein’s concept of libertarian paternalism provides further justification.[32] If the choice environment is always designed by someone and no neutral default exists, the question is not whether the state may structure the decisional context, but on what terms it may do so.[33] This compounds Lessig’s insight that code already regulates the design of a digital environment that constrains and channels behavior as effectively as any statute.[34]  Applied to BNPL and online sports betting, the consequence is that current interface designs are not unregulated spaces into which the VMCA would introduce regulation for the first time. They are already regulated environments, regulated by the platform in its own commercial interest, in which the default has been engineered to maximize spending and suppress deliberation. The VMCA’s interface standards would not impose paternalistic constraints on an otherwise free consumer; they would rebalance an existing architecture of constraint that currently operates exclusively in the platform’s favour.

The most predictable objection to interface governance is that it constitutes behavioural paternalism and will stifle fintech innovation. The BNPL industry’s principal defence has been that its products empower consumers to manage their finances responsibly and function as a cheaper alternative to revolving credit card debt. The empirical record complicates this narrative considerably. Di Maggio and colleagues find that BNPL access increases total consumer spending beyond what standard substitution models would predict, consistent with a liquidity flypaper effect rather than rational credit substitution.[35] The picture that emerges is of a product whose frictionless design systematically induces overconsumption among precisely the consumers least equipped to absorb it.

The more rigorous version of the objection holds that policymakers cannot possess the knowledge needed to improve upon individual decision-making, that behavioural research is incomplete and unreliable, and that modest regulatory interventions tend to expand through a slippery slope. The objection deserves a serious answer. The shift from disclosure to interface governance is distinguishable, however, from the paternalistic interventions these critics target. The VMCA would not regulate consumer preferences; it would regulate the manipulative presentation of choices. A mandatory cooling-off period does not prevent a consumer from making a BNPL purchase or placing a bet. It would merely reintroduce a moment of deliberation that the platform has deliberately removed. The proposed Act does not presume to know what consumers truly want, but it would prevent firms from designing environments that ensure consumers never pause long enough to find out. The Australian experience offers early evidence that responsible lending obligations for BNPL have not collapsed the market. Wilson documents that the industry has adapted rather than contracted, suggesting that compliance costs are absorbable within the business model.[36]

III. The Vulnerable Markets and Consumers Act

Part III translates the preceding analysis into a legislative proposal organized around four pillars, followed by a constitutional analysis. Each pillar addresses a specific dimension of the digitally mediated consumer harm identified in Parts I and II. Together, the four pillars are designed to do what the existing patchwork has failed to do: regulate the interface as the common site of harm rather than chasing each new product category as it emerges.

A. Pillar One: Meaningful Disclosure

The central deficiency of current disclosure regimes is not that they require too little information but that they are indifferent to the presentational context in which information appears. A statutory obligation to disclose the cost of a BNPL plan is satisfied by text buried in a terms-of-service document that no consumer reads. A requirement to display responsible-gambling information is satisfied by a brief pop-up at account creation that never resurfaces during in-play wagering.

Reconstituted disclosure under the VMCA would attach obligations to the presentational context of information, looking beyond mere content. The Act would require plain-language warnings at active decision points (not only during onboarding but at the moment of transaction), rolling weekly or monthly summaries of cumulative transactions delivered through the interface itself, and standardized warning formats that cannot be visually subordinated within the interface. The obligation, in other words, would be to disclose effectively, not merely to disclose. This approach draws on the Woolard Review, which identified the invisibility of BNPL on credit files and poor consumer understanding as key harms, and recommended bringing BNPL within the FCA’s regulatory perimeter precisely because voluntary disclosure had failed.[37]

B. Pillar Two: Friction by Design

The second pillar mandates friction in transactional environments designed to be frictionless. This includes mandatory pause points before repeat transactions, default spending and repayment limits with active opt-up mechanisms requiring affirmative consumer action, reconfirmation prompts after rapid repeat activity, and cooling-off periods for high-risk BNPL plans and betting features such as in-play wagering and accumulator bets. Mandated friction is best understood as deliberate pause points and reconfirmation prompts that counteract the platform’s removal of natural transactional barriers. The analogy to time, place, and manner restrictions is useful: friction by design does not prohibit the underlying activity, it regulates the conditions under which the activity occurs, preserving the consumer’s capacity to act while restoring the deliberative conditions under which that action is meaningful. Sunstein’s work on nudge ethics establishes that nudges work best when they promote welfare and autonomy without undermining dignity, and they must preserve the freedom to opt out.[38]

Frischmann and Benesch argue that digital society needs friction-in-design regulation targeting the architectures, algorithmic systems, and interfaces that shape human behaviour. [39] The relentless push to eliminate friction for efficiency has created hidden social costs, and mandated friction and deliberation nudges should be understood as legitimate regulatory tools. Ontario’s iGaming responsible-gambling framework already mandates centralized self-exclusion tools and requires responsible-gambling features built into platform architecture. The VMCA would formalize and generalize these scattered measures into a unified design standard applicable across both BNPL and gambling platforms.

C. Pillar Three: Affordability and Exposure Checks

The third pillar addresses the onboarding stage. The VMCA would require mandatory affordability assessments for BNPL and cumulative exposure limits for sports betting. Both products currently permit consumers to accumulate harmful levels of exposure without any systemic check. The VMCA would impose gatekeeping obligations at the point of entry rather than warnings after the fact.

Auer and colleagues provide an empirical justification for this approach. [40] Their study of 49,560 online gamblers found that, among the top ten per cent of most gambling-intensive players, those who set deposit limits gambled significantly less. Only 1.31 per cent of players voluntarily set limits, however, demonstrating the critical limitation of voluntary tools. The paradox is that limits work when used, but almost no one uses them, especially those who need them most. If the tool works but voluntary uptake is negligible, the policy implication is to make limits mandatory or default-on with meaningful opt-out friction. This logic transfers directly to BNPL spending caps. Affordability assessments function as the credit-market equivalent of deposit limits, preventing consumers from accumulating obligations beyond their capacity to repay. The Australian regulatory agency’s decision to regulate BNPL as a credit product from June 2025, requiring compliance with responsible-lending obligations, reflects the conclusion that voluntary codes and industry self-regulation are insufficient.[41] The VMCA would adopt a similar posture while extending it across the BNPL and gambling boundary.

D. Pillar Four: Platform Responsibility

The fourth and most significant pillar imposes affirmative duties on firms that design, distribute, and profit from digitally mediated consumer products. Firms that control the interface and hold real-time consumer data are better positioned than any regulator to detect and respond to escalating patterns of consumer harm. A failure to do so externalizes costs to households and public systems while the firm captures the upside.

Fletcher and colleagues argue that digital platforms engaging in data-driven manipulation should face enhanced regulatory obligations including affirmative duties toward consumers, moving beyond disclosure to substantive platform responsibility.[42] The VMCA would operationalize this principle by requiring platforms to implement real-time monitoring systems that detect patterns indicative of escalating harm, including rapid repeat BNPL approvals for the same consumer, accelerating bet frequency, or significant deviation from a consumer’s baseline spending pattern, and to intervene through graduated friction responses.

This framing draws on the corporate digital responsibility (CDR) literature. Lobschat and colleagues propose that organizations bear responsibility for the ethical deployment of digital technologies and data across four stakeholder dimensions.[43] Wirtz and colleagues extend this framework to service firms, concluding that regulation must step in when a firm’s CDR calculus becomes sufficiently negative that good CDR is unlikely to emerge voluntarily.[44] The VMCA positions platform responsibility not as punitive liability but as a logical extension of this framework. Firms that design the architecture of consumer harm bear a corresponding duty to mitigate it. The Lancet Commission on Gambling reinforces this framing by documenting the public-health costs of gambling expansion and arguing for regulatory infrastructure commensurate with the scale of digital gambling’s reach.[45]

The marketing dimension of platform responsibility warrants particular attention. Thomas and colleagues document the intensive exposure of children to gambling marketing and its normalizing effects, disproportionately affecting children and young people despite codes prohibiting such appeal.[46] Di Censo and colleagues further confirm that sports-betting marketing is a significant predictor of youth problem gambling.[47] The VMCA’s platform-responsibility pillar would require operators to ensure that their marketing practices and interface design do not facilitate youth exposure or target vulnerable populations.

A legitimate concern about platform-responsibility obligations of this scope is whether a federal regulator, presumably the FCAC or a newly constituted body, would have the technical capacity and institutional mandate to oversee interface design across two distinct industries. Interface governance requires expertise not only in financial regulation and gambling oversight but also in human-computer interaction, behavioural psychology, and digital design. That varied skill set places a genuine limit on the public service’s capacity to monitor compliance in real time. The VMCA could address this constraint through a co-regulatory model in which the regulator sets outcome-based standards while delegating technical specification to an expert body or to industry participants subject to regulatory approval and periodic audit.

The cooperative-federalism architecture described below further distributes the burden: the federal government would establish minimum interface standards while provincial regulators would retain day-to-day enforcement authority within their existing sectors. The Lancet Commission’s discussion of regulatory infrastructure for digital gambling supports this layered approach, noting that effective gambling regulation requires multi-jurisdictional coordination and technical expertise that no single regulatory body currently possesses.[48] The Australian case offers a further caution: well-designed regulation requires robust enforcement and ongoing adaptation to industry evolution. The VMCA should therefore include a statutory review mechanism, perhaps on a three- or five-year cycle, to ensure that its provisions remain responsive to evolving digital market practices and do not calcify around the design conventions of a single technological moment.

E. Constitutional Foundation

The VMCA can be anchored in the general branch of the federal trade and commerce power under section 91(2) of the Constitution Act, 1867, as articulated in the five-part test from General Motors of Canada Ltd v City National Leasing.[49] That test requires that the impugned legislation form part of a general regulatory scheme, be subject to ongoing regulatory oversight, concern trade as a whole rather than a particular industry, be of a nature that the provinces jointly or severally would be constitutionally incapable of enacting, and that the failure to include one or more provinces would jeopardize the scheme’s successful operation in other parts of the country. Digitally mediated consumer markets satisfy these criteria. BNPL providers and online betting platforms operate across provincial borders through digital infrastructure that is inherently interprovincial and international in character. A consumer in Alberta accessing Klarna’s checkout interface or Bet365’s wagering platform is engaging with a digital environment designed, operated, and monetized from outside the province or the country. No single provincial legislature can effectively regulate the interface design of platforms whose operations span all Canadian jurisdictions. This is precisely the kind of national concern that the general trade and commerce power is designed to address.

The Supreme Court of Canada’s treatment of cooperative securities regulation supports the assertion. In Reference re Securities Act, the Court unanimously held that a proposed federal Securities Act was ultra vires because it attempted a wholesale displacement of provincial securities regulation.[50] Crucially, however, the Court left the door open for a cooperative approach addressing genuinely national concerns such as systemic risk to the country. The subsequent Reference re Pan-Canadian Securities Regulation vindicated that cooperative model, unanimously upholding a framework in which federal legislation targeted systemic risk while provincial legislation governed day-to-day regulation.[51] The VMCA is distinguishable from the failed Securities Act because it does not seek to displace provincial consumer protection regimes. Its object is to establish minimum interface standards for digitally mediated consumer markets that create cross-border harm.

Provincial regimes such as the BPCPA in British Columbia would continue to govern the substantive terms of credit agreements and gambling licences. This is consistent with the precedent set in Canadian Western Bank v Alberta, in which the Court declared that constitutional doctrine must facilitate cooperative federalism and that overlapping jurisdiction should be accommodated through flexible overlap rather than rigid exclusivity.[52] Parliament has already demonstrated its willingness to legislate directly in this space. Bill C-218 amended the Criminal Code to legalize single-event sports betting, and the Financial Consumer Agency of Canada Act establishes federal oversight over certain financial consumer protection matters.[53] The VMCA would build upon these existing footholds rather than create jurisdiction from nothing.

Conclusion

BNPL and online sports betting are functionally parallel forms of digitally mediated consumer harm. They share three revenue generating mechanics, namely frictionless onboarding, microtransactional compounding, and dark pattern interface design, all of which are causally linked to measurable consumer financial deterioration. Their regulatory separation in Canadian law reflects legacy product category thinking inherited from an era when credit was delivered through bank branches and gambling required physical attendance at licensed premises. That era has passed.

The competition prompt asks how the law is or is not keeping up with the pace of change. The answer this paper has developed is that the law is not keeping up, but its failure is not chiefly a failure of speed. It is a failure of categorization. Canadian law, both provincially in instruments such as the BPCPA and federally in the FCAC’s monitoring posture and the Criminal Code gambling exemption, continues to organize its protective architecture around what a consumer is buying. The digital market is no longer organized that way. Whether the consumer is buying credit, a wager, a subscription, or an in-game purchase, the same set of design mechanics is delivering harm through the same medium. Until the law shifts its unit of analysis from the product category to the interface, it will continue to legislate against last decade’s problem.

The VMCA proposed in this paper offers one viable response. Anchored in the general branch of the federal trade and commerce power and structured through cooperative federalism, the Act would regulate the digital interface as the common site of consumer harm across both markets. Its four pillars, meaningful disclosure, friction by design, affordability and exposure checks, and platform responsibility, address distinct dimensions of interface-mediated harm while preserving the substantive distinctions between credit and gambling. British Columbia’s BPCPA and BCLC framework would continue to operate, but they would do so against a federal floor that finally reaches the medium through which most provincial consumers actually transact.

The broader implication extends beyond BNPL and sports betting. As digital distribution increasingly mediates consumer markets, the interface itself will become a primary site of regulatory concern across sectors. The VMCA is not a final solution to the problem of digitally mediated consumer harm. It is an attempt to give Canadian law a vocabulary for a category of harm that the law has not yet developed the words to describe. The distinction between what a consumer buys and how the buying environment has been designed to shape that consumer’s behaviour is, increasingly, the distinction that matters most for consumer protection. Closing the gap between the pace of digital change and the pace of legal change starts with admitting that the gap exists, and that it cannot be closed by adding more disclosure to a screen that has been designed to hide it.

[1]Business Practices and Consumer Protection Act, SBC 2004, c 2; Financial Consumer Agency of Canada, “Pilot Study: Buy Now, Pay Later Services in Canada” (18 November 2021), online: Government of Canada <canada.ca/en/financial-consumer-agency/programs/research/pilot-study-buy-now-pay-later-services-in-canada.html>.

[2]John T Holden & Joanna Wall Tweedie, “Sports Betting in Canada: Legal Perspectives from Two Years of Legal Single-Game Wagering” (2024) 11:3 Current Addiction Reports 419.

[3]Ryan Calo, “Digital Market Manipulation” (2014) 82:4 Geo Wash L Rev 995, online: SSRN <ssrn.com/abstract=2309703>.

[4]Daniel Susser, Beate Roessler & Helen Nissenbaum, “Online Manipulation: Hidden Influences in a Digital World” (2019) 4:1 Geo L Tech Rev 1, online: SSRN <papers.ssrn.com/abstract=3306006>.

[5]Gaming Control Act, SBC 2022, c 29, ss 1 (definition of “lottery corporation”), 3(2); British Columbia Lottery Corporation, “PlayNow.com” (2025), online: BCLC <bclc.com>.

[6]Financial Consumer Agency of Canada, supra note 1.

[7]Christopher Woolard, The Woolard Review: A Review of Change and Innovation in the Unsecured Credit Market (London: Financial Conduct Authority, 2021) at 44, online (pdf): <www.fca.org.uk/publication/corporate/woolard-review-report.pdf>.

[8]Di Johnson, John Rodwell & Thomas Hendry, “Analyzing the Impacts of Financial Services Regulation to Make the Case That Buy-Now-Pay-Later Regulation Is Failing” (2021) 13:4 Sustainability 1992.

[9]OO Cherednychenko, “On the Bumpy Road to Responsible Lending in the Digital Marketplace: The New EU Consumer Credit Directive” (2024) 47:2 J Consumer Pol’y 241 at 242–43, online: <link.springer.com/article/10.1007/s10603-024-09564-z>.

[10] Bill C-218, An Act to amend the Criminal Code (sports betting), 2nd Sess, 43rd Parl, 2021 (assented to 29 June 2021) SC 2021, c 20.  

[11]Holden & Wall Tweedie, supra note 2.

[12]Sahil Soni, “Regulating Buy Now, Pay Later: Consumer Financial Protection in the Era of Fintech” (2023) 123:7 Colum L Rev 2035 at 2055–62, online (pdf): Columbia Law Review <columbialawreview.org/wp-content/uploads/2023/11/Soni-Regulating_buy_now_pay_later.pdf>.

[13]Brett Hollenbeck, Poet Larsen & Davide Proserpio, “The Financial Consequences of Legalized Sports Gambling” (8 December 2025) at 3–5, online: SSRN <ssrn.com/abstract=4903302>.

[14]Marco Di Maggio, Emily Williams & Justin Katz, “Buy Now, Pay Later Credit: User Characteristics and Effects on Spending Patterns” (September 2022), NBER Working Paper No 30508, online (pdf): National Bureau of Economic Research <nber.org/system/files/working_papers/w30508/w30508.pdf>.

[15]Drazen Prelec & George Loewenstein, “The Red and the Black: Mental Accounting of Savings and Debt” (1998) 17:1 Marketing Science 4.

[16]Ibid.

[17]Richard H Thaler, “Mental Accounting Matters” (1999) 12:3 J Behavioral Decision Making 183.

[18]Daniel McCarthy, Wayne Taylor & Kenneth C Wilbur, “Online Market Launch and the Distribution of Gambling Risk: Evidence from Online Sports Betting” (9 April 2026), SMU Cox School of Business Research Paper No 24-7, online: SSRN <ssrn.com/abstract=4856684>.

[19]Di Maggio, Katz & Williams, supra note 14 at 2.

[20]Arunesh Mathur et al, “Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites” (2019) 3:CSCW Proceedings of the ACM Human-Computer Interaction 1, online: <doi.org/10.1145/3359183>.

[21]Ibid.

[22]Colin M Gray et al, “The Dark (Patterns) Side of UX Design” in Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems (New York: ACM, 2018) at 5, online: <dl.acm.org/doi/10.1145/3173574.3174108>.

[23]Office of the Privacy Commissioner of Canada, Office of the Privacy Commissioner Sweep Report 2024: Deceptive Design Patterns (9 July 2024), online: <priv.gc.ca/en/about-the-opc/what-we-do/international-collaboration/international-privacy-networks/international-privacy-sweep/2024_sweep/opc-sweep-report-2024/>.

[24]US, Federal Trade Commission, Bringing Dark Patterns to Light: Staff Report (2022), online: <ftc.gov/reports/bringing-dark-patterns-light>.

[25] Omri Ben-Shahar & Carl E Schneider, “The Failure of Mandated Disclosure” (2010) Law & Economics Working Papers 9, online: University of Michigan Law School Repository <repository.law.umich.edu/law_econ_current/art9>.

[26]Danielle Y Cornaccia, “Book Note – More than You Wanted to Know: The Failure of Mandated Disclosure, by Omri Ben-Shahar & Carl E Schneider” (2015) 52:2 Osgoode Hall LJ 673, online (pdf): Osgoode Digital Commons <digitalcommons.osgoode.yorku.ca/cgi/viewcontent.cgi?article=2826&context=ohlj>.

[27]Martin Brenncke, “A Theory of Exploitation for Consumer Law: Online Choice Architectures, Dark Patterns, and Autonomy Violations” (2024) 47:1 J Consumer Pol’y 127, online: <doi.org/10.1007/s10603-023-09554-7>.

[28]Andrew Harris & Mark D Griffiths, “A Critical Review of the Harm-Minimisation Tools Available for Electronic Gambling” (2017) 33:1 J Gambling Studies 187, online: PubMed Central <pmc.ncbi.nlm.nih.gov/articles/PMC5323476>.

[29]Lawrence Lessig, Code: Version 2.0 (New York: Basic Books, 2006) at 120–37.

[30] Ibid at 123.

[31]Ibid at 120-37.

[32]Richard H Thaler & Cass R Sunstein, “Libertarian Paternalism” (2003) 93:2 Am Econ Rev 175, online: <aeaweb.org/articles?id=10.1257/000282803321947001>.

[33] Ibid.

[34] Lessig, supra note 17.

[35]Di Maggio, Katz & Williams, supra note 14.

[36]Therese Wilson, “The Regulatory Response to Buy Now Pay Later in Australia” (2025) 50:2 Alternative LJ 91, online (pdf): <intrechtdok.de/servlets/MCRFileNodeServlet/mir_derivate_00019634/10.1177_1037969X251338353.pdf>.

[37]Woolard, supra note 7.

[38]Cass R Sunstein, “The Ethics of Nudging” (2015) 32:2 Yale J Reg 413, online (pdf): <openyls.law.yale.edu/bitstream/handle/20.500.13051/8225/15_32YaleJonReg413_2015_.pdf>.

[39]Brett M Frischmann & Susan Benesch, “Friction-in-Design Regulation as 21st Century Time, Place, and Manner Restriction” (2023) 25 Yale JL & Tech 376, online: SSRN <ssrn.com/abstract=4178647>.

[40]Michael Auer, Niklas Hopfgartner & Mark D Griffiths, “The Effects of Voluntary Deposit Limit-Setting on Long-Term Online Gambling Expenditure” (2020) 23:2 Cyberpsychology, Behavior & Social Networking 113, online: <liebertpub.com/doi/10.1089/cyber.2019.0202>.

[41]Wilson, supra note 36.

[42]Amelia Fletcher et al, “Consumer Protection for Online Markets and Large Digital Platforms” (2023), Cowles Foundation Paper No 1845, online (pdf): Tobin Center for Economic Policy <tobin.yale.edu/sites/default/files/2023-09/P1845.pdf>.

[43]Lara Lobschat et al, “Corporate Digital Responsibility” (2021) 122 J Bus Research 875, online: ScienceDirect <doi.org/10.1016/j.jbusres.2019.10.006>.

[44]Jochen Wirtz et al, “Corporate Digital Responsibility in Service Firms and Their Ecosystems” (2023) 26:2 J Service Research 173, online: SAGE Journals <journals.sagepub.com/doi/10.1177/10946705221130467>.

[45]Heather Wardle et al, “The Lancet Public Health Commission on Gambling” (2024) 9:11 The Lancet Public Health Commissions e950, online: The Lancet <thelancet.com/journals/lanpub/article/PIIS2468-2667(24)00167-1/fulltext>.

[46]Samantha Thomas et al, “Protecting Children and Young People from Contemporary Marketing for Gambling” (2023) 38:2 Health Promotion Intl 1, online: Oxford Academic <doi.org/10.1093/heapro/daac194>.

[47]Gianluca Di Censo, Paul Delfabbro & Daniel L King, “Examining the Role of Sports Betting Marketing in Youth Problem Gambling” (2024) 40:4 J Gambling Studies 2005, online: PubMed Central <pmc.ncbi.nlm.nih.gov/articles/PMC11557612>.

[48] Wardle, supra note 45.

[49]General Motors of Canada Ltd v City National Leasing, [1989] 1 SCR 641, 1989 CanLII 133 (SCC).

[50]Reference re Securities Act, 2011 SCC 66 at paras 118-22.

[51]Reference re Pan-Canadian Securities Regulation, 2018 SCC 48 at paras 93-104.

[52]Canadian Western Bank v Alberta, 2007 SCC 22 at paras 23-24.

[53]Department of Justice Canada, News Release, “Government of Canada Announces Coming into Force Date of Criminal Code Amendments on Single Event Sport Betting” (12 August 2021), online: Government of Canada <canada.ca/en/department-justice/news/2021/08/government-of-canada-announces-coming-into-force-date-of-criminal-codeamendments-on-single-event-sport-betting.html>.