Not good enough. As an "Opt-out" with no password required, there will always be cases of unintentional purchases. This is obvious. IMO a company should be obligated to give refunds if their default settings are this way.

Reducing the barriers to payment this way does 2 things. * Consumers are more likely to impulse buy. This can affect everybody, but severely affects people with low impulse control who can't manage money. * Consumers are more likely to unintentionally buy.

Both are taking advantage of people.

It would be nice if there were consumer protections similar to "Explicit Consent" in the GDPR. I.e. Explicit Consent should be required when purchasing something.