Look out for the "Digital Fairness Act", which will be tabled by the European Commission in November. It is expected to include the same "Click to Cancel" principle continent-wide.
Source: I'm an EU digital policy analyst in Brussels.
It seems like a good rule, and I am eager to see what NYC’s enforcement is going to look like. I have historically been disappointed (as a life-long resident) by the discontinuity between the city’s eagerness to legislate and its recalcitrance around enforcement, particularly when public interest in any given topic fades.
(Compare the city’s historic problems around preventing illegal de-stabilization of rental units, inability to prevent the NYPD from parking on sidewalks, and so forth.)
Not a NYC-only problem though. There are tons of federal, state, and local laws that go under-enforced or unenforced. Legislators love the performance art of writing these kinds of popular laws, but law enforcement often doesn't care enough to enforce most of them. In this case, the website says the penalty is "starting at $525" which is basically nothing to a corporation, and nothing to the police/government. So you can file a complaint but it will probably go to /dev/null. After a year of this people will give up on even filing complaints.
What needs to happen for rules like this is: 1. the complaint should be easy/automatic to validate and rule on, 2. hard for the company to appeal and stonewall, and 3. the fine money should go to the person who filed the complaint as a bounty to motivate people to look for violators.
> A person making an automatic renewal or continuous service offer to a consumer must provide the consumer with the option to cancel at any time using a simple cancellation mechanism that is as easy to use as the mechanism that the consumer used to provide consent and that is through the same medium that the consumer used to provide consent
So if a startup lets someone sign up using Stripe, for example, does this mean that they need to have a way to unsubscribe that is as easy as Stripe? Lots of companies have a way to unsubscribe electronically, but it requires logging in to your account, going into settings, saying you want to unsub, and possibly declining various offers to stay.
Surely at some point a company could cross the line of "a simple cancellation mechanism that is as easy to use as the mechanism the consumer used to provide consent". But where is the line exactly? Surely you don't have to have a big red cancel button on every page of your platform, but at the same time surely it can't be hidden 8 levels down in the settings.
Some examples would be helpful to let businesses and consumers know what is acceptable and what is not acceptable.
There's a funny thing when people don't like something where they can intentionally misunderstand it or impart artificial complexity onto it painting a picture like the rule is hard to comply with. I suppose to variation of a straw man argument. I honestly don't think this is one is hard to understand at all. If you can sign up through the web you should be able to cancel through the web. If you can sign up through the phone you should be able to cancel through the phone. Companies knowingly an intentionally make it harder to cancel than to sign up for obvious reasons that have nothing to do with doing right by the consumer. This is a very good law and it should be adopted everywhere.
Maybe those people who’ve spent so much time A/B testing where to put the signup buttons can use those skills to figure out where to put the cancel buttons so that they are as easy to find.
Worse. We are going to see signup flows that are initially simple but take the user through several steps to do it but not in a way to make them abandon the process.
Heres what you should do to be safe.
On the user's settings/profile/whatever user page you have, add a cancel button. When the user clicks it say "are you sure? Yes/no". If the user clicks yes, cancel the account.
> ...and possibly declining various offers to stay
Unless there were several efforts to get you to think twice before subscribing, clearly trying to get you to think twice before unsubscribing is not as easy to use.
I suspect that something as simple as 2-3 emails prior to renewal, each with a one-click (no auth needed) clear, unobscured "unsubscribe" button would be sufficient.
I don’t think anyone will have trouble figuring out a good way to comply with this. It’s not clear exactly where the line is, so just don’t go near it. Make it easy to cancel, job done. If a company wants to push the boundaries by making it as difficult to cancel as the rule allows, they’re running the risk of being on the wrong side of the line and suffering the consequences, and that’s their choice.
The only reason any company would have trouble complying with this rule is if they want to abuse customers to keep them from canceling when they want to cancel. The amount of sympathy I have towards such companies requires advanced scientific notation to quantify.
This is what courts are for. There is no exact line because many situations are different.
Surely you don't have to have a big red cancel button on every page of your platform
Why not?
Some examples would be helpful
The text you quoted is clear enough to me, and it's probably clear to any reasonable person (most rules are written this way). If you're worried about gaming the system to find the exact process that just on the "legal" side of things, you probably aren't reasonable.
Ya, a reasonable interpretation would likely mean that where you sign in and manage your accounts and payments you have the means to discontinue further service. Anyone trying to push these boundaries will likley find themselves on the wrong side of the law.
In my country the rule is "unsubscribe the same way you subscribed". So no bullshit with having to write a literal physical letter through the mail (yes really this happened) or having to call a callcenter in India and having to explain why you want to your stop subscription.
One abstract idea is to convert every digital event into a hook. The hook then goes into a local LLM that has a rule to figure out what to do with it. I use DDG or mozilla email aliases as much as I can. All my emails go to a local email client and for the non-spam classified mails I have a few rules(**) I am toying with right now:
1. If non-money sub, categorize its content and create a P1 watch event and a set of follow up actions.
2. If its a money/trial sub, create a P0 watch event and its own set of followup actions.
All watch events are queued for me by priority where i ask on the weekend: "Tell me P0 events", it then asks me what action. The ergonomic factor here is I the human can tune this valve on the information hose. There is also a dashboard for P0 notifications and an android push notification that notifies me of P0 events, but they aren't "consumed" until i decide. There are tons of places this can be useful: make progress on non-work related todos, systematic investment, writing year-end reviews.
None of this is rocket science.
**Local service webhooks are the key: Every web-hook has some kind of decision maker in it - an LLM + deterministic logic.
To avoid the overhead, we could simply adopt pro-consumer practices across the board? Easier than segmenting users and deciding which cancellation mechanisms are available to them based on region.
Alternatively, let people cancel easily everywhere. If you think it’s worth the extra revenue to geofence easy cancellations, then—well, you do you, but you are making a business judgment that the additional development cost is justified. This is different from VAT/sales tax etc., where it is in fact impossible to comply everywhere without discriminating by jurisdiction.
Worse by following NYC laws and putting everyone else in a different harder to get away from bucket you may be setting yourself up for future legal problems. You now have a chain of documentation on your evil practices rather than them just being a norm you may have verbally agreed on before.
It’s an easy rule to comply with and nothing stops you from complying with it everywhere.
We will see a patchwork regime, where companies make it easy to cancel if you’re in NYC or another jurisdiction with similar rules, but difficult otherwise. When you see this, you must remember that the easiest thing would have been to make it easy for everyone to cancel regardless of location. That would be perfectly legal and it would be the cheapest option to build. If a company didn’t do that it’s because they made a deliberate choice to spend more money just so they could continue screwing some people over.
> While I think this is a good idea, we already have so many different regions to comply with, now we're adding cities....
Lina Khan's FTC passed a rule to make click-to-cancel nationwide in 2024.
It was killed on procedural grounds by the highly conservative Eighth Circuit Court of Appeals.
The take-away from how it was killed boils down to "we (companies) know that we'd lose more than $100 million dollars if people could reasonably unsubscribe rather than deal with our dark patterns".
The old FTC would have been able to fix the procedural problem, but then Trump took office and gutted the FTC and destroyed all the good work it was doing.
Since the federal government is failing us, I support local governments doing the right thing. If enough do, companies will eventually be forced into compliance nationally because it won't be worth the complexity to have hundreds of regional carve-outs.
You can't seriously think this makes you sound like a sympathetic party, right? "Oh no, we have to maintain two codepaths now: the pro-social one for places with functional governments, and the slimy anti-consumer fuck-you one for everywhere else. Won't anyone think of our plight?"
Source: I'm an EU digital policy analyst in Brussels.
(Compare the city’s historic problems around preventing illegal de-stabilization of rental units, inability to prevent the NYPD from parking on sidewalks, and so forth.)
What needs to happen for rules like this is: 1. the complaint should be easy/automatic to validate and rule on, 2. hard for the company to appeal and stonewall, and 3. the fine money should go to the person who filed the complaint as a bounty to motivate people to look for violators.
Failing to provide salary transparency in job postings is another common one with zero enforcement.
So if a startup lets someone sign up using Stripe, for example, does this mean that they need to have a way to unsubscribe that is as easy as Stripe? Lots of companies have a way to unsubscribe electronically, but it requires logging in to your account, going into settings, saying you want to unsub, and possibly declining various offers to stay.
Surely at some point a company could cross the line of "a simple cancellation mechanism that is as easy to use as the mechanism the consumer used to provide consent". But where is the line exactly? Surely you don't have to have a big red cancel button on every page of your platform, but at the same time surely it can't be hidden 8 levels down in the settings.
Some examples would be helpful to let businesses and consumers know what is acceptable and what is not acceptable.
― Upton Sinclair
No extra hoops at all.
Unless there were several efforts to get you to think twice before subscribing, clearly trying to get you to think twice before unsubscribing is not as easy to use.
The only reason any company would have trouble complying with this rule is if they want to abuse customers to keep them from canceling when they want to cancel. The amount of sympathy I have towards such companies requires advanced scientific notation to quantify.
This is what courts are for. There is no exact line because many situations are different.
Surely you don't have to have a big red cancel button on every page of your platform
Why not?
Some examples would be helpful
The text you quoted is clear enough to me, and it's probably clear to any reasonable person (most rules are written this way). If you're worried about gaming the system to find the exact process that just on the "legal" side of things, you probably aren't reasonable.
1. If non-money sub, categorize its content and create a P1 watch event and a set of follow up actions.
2. If its a money/trial sub, create a P0 watch event and its own set of followup actions.
All watch events are queued for me by priority where i ask on the weekend: "Tell me P0 events", it then asks me what action. The ergonomic factor here is I the human can tune this valve on the information hose. There is also a dashboard for P0 notifications and an android push notification that notifies me of P0 events, but they aren't "consumed" until i decide. There are tons of places this can be useful: make progress on non-work related todos, systematic investment, writing year-end reviews.
None of this is rocket science.
**Local service webhooks are the key: Every web-hook has some kind of decision maker in it - an LLM + deterministic logic.
Then again, the lobbying and resistance from Chrome must be unreal because it would be pretty huge blow for them to enable such setting.
So I provided a fake address in California, and it was done.
Unfortunately that's how things work these days sometimes.
We will see a patchwork regime, where companies make it easy to cancel if you’re in NYC or another jurisdiction with similar rules, but difficult otherwise. When you see this, you must remember that the easiest thing would have been to make it easy for everyone to cancel regardless of location. That would be perfectly legal and it would be the cheapest option to build. If a company didn’t do that it’s because they made a deliberate choice to spend more money just so they could continue screwing some people over.
Lina Khan's FTC passed a rule to make click-to-cancel nationwide in 2024.
It was killed on procedural grounds by the highly conservative Eighth Circuit Court of Appeals.
The take-away from how it was killed boils down to "we (companies) know that we'd lose more than $100 million dollars if people could reasonably unsubscribe rather than deal with our dark patterns".
The old FTC would have been able to fix the procedural problem, but then Trump took office and gutted the FTC and destroyed all the good work it was doing.
Since the federal government is failing us, I support local governments doing the right thing. If enough do, companies will eventually be forced into compliance nationally because it won't be worth the complexity to have hundreds of regional carve-outs.
IL has had click-to-cancel since 2022. (Actually 2000, but updated in 2022, with continuous amendments being put forward all the time.)
So close yet so far
New York City to ban deceptive subscription practices
https://news.ycombinator.com/item?id=48863464