I'm not sure it's down to the new EU Digital Services Act (which is more focused on "online" behaviour, rather than client-side), but nb Art. 25(1) of the DSA:

I'm not sure it's down to the new EU Digital Services Act (which is more focused on "online" behaviour, rather than client-side), but nb Art. 25(1) of the DSA: "1. Providers of online platforms shall not design, organise or operate their online interfaces in a way that deceives or manipulates the recipients of their service or in a way that otherwise materially distorts or impairs the ability of the recipients of their service to make free and informed decisions." Or there might be an argument that downloading instructions to a user's device, causing it to do something they didn't want, is a breach of the EU's anti-malware rule (AKA the much-despised "cookie law", even though that name downplays its significance)