Comment by AlphaGeekZulu | Hacker News Reader

Comment by AlphaGeekZulu | Hacker News Reader

In Germany a new law will take effect on July 1st 2022, that obligates online shops to provide an "easily accessible, clearly visible" cancellation button on their websites, that allows to cancel any contract that has been established online or via App.

The entire procedure is described very explicitly in the law and breaks down to a 2-step process:

1. mandatory cancellation button, which, if pressed, leads to a

2. confirmation page, where a defined set of parameters is requested and a confirmation button then cancels the contract.

In my eyes the defined set of parameters on the confirmation page can easily been abused to make the process more difficult for the user.

The parameters required are:

1. Type of cancellation

2. Unique identification of the user

3. Unique identification of the contract

4. The desired end date of the contract

5. Means of electronic communication for cancellation confirmation (email)

Topic 2 can be made very difficult and is in my eyes superficial - if the user logged into his account, he is identified IMO.

Topic 3 is ambivalent, how do you identify an contract? By title and date, by ID? In my eyes there should be a popup with existing contracts to choose from (which can easily be done if the user is logged in).

Topic 4 is prone to errors, because many contracts have notice periods. So the user has to do research on his contract and if he gets the lifetime/notice periods wrong his cancellation will fail.

Information (unfortunately only in german):

https://www.voelker-gruppe.com/stuttgart/kuendigungsschaltfl...

And this is why regulating companies is hard. It's difficult to word things in a way that's generic enough to cover many businesses while at the same time not leaving big loopholes.

See, I'd approach it a different way. Don't even give them the option of building their own UI.

Require all companies who provide any kind of subscription service to implement specific API hooks that interact with a government portal. Specify the API endpoints, their expected payloads, and the resultant behaviors in excruciating detail (use formal methods if needed) and require that they send the API tokens to a specific secure endpoint controlled by the government.

And the standard way of cancelling your service will be to log into the government portal, browse the list of subscription services you're subscribed to until you find what you're looking to cancel, click the checkbox next to it, and click 'Unsubscribe'. And the government portal will send an authenticated request to the company's legally-mandated cancel API and the cancel request, by law, must immediately result in automated total purging of the user's account with the company within 10 seconds of receiving the request.

A lot of people would not be particularly thrilled with the idea of the government having record and access to all of their online subscriptions.

Apple pretty much has the solution you describe for IAP subscribtions and has a pseudo governmental role within in its ecosystem.

I think the challenge for extending this approach to the rest of the economy is that many recurring payments / subscriptions involve situations where cancellations are naturally complex.

Insurance, premium bank accounts, property taxes, car rentals, and school fees all involve recurring payments - but are naturally complicated to cancel for fair-ish reasons.

They just need to mandate that every company the provides a subscription, also provides a secure API for cancelling subscriptions.

I want a god damn subscription manager app with centralized payment processing and toggle subscription switches.

> And the standard way of cancelling your service will be to log into the government portal, browse the list of subscription services you're subscribed to until you find what you're looking to cancel, click the checkbox next to it, and click 'Unsubscribe'. And the government portal will send an authenticated request to the company's legally-mandated cancel API and the cancel request, by law, must immediately result in automated total purging of the user's account with the company within 10 seconds of receiving the request.

Turkey has that, but unfortunately only a limited number of companies participate.

> Unique identification of the user

"The account logged in right now"

> Unique identification of the contract

"The only contract I have with you"

> The desired end date of the contract

"Next possible date"

Note that specifications like that already have to be accepted when canceling via email or letter since forever. Requiring anything substantially harder than that won't qualify. In particular, customers can't be required to go through a maze to hunt for some arcane contract number that is not typically used in communication with them.

This is all great, but I do not see any incentive for companies to roll out a broader solution. They will simply enable a workaround for their German customers and continue to abuse the rest of the world.

it's a step in the right direction.

unlike some problems[+], this one doesn't immediately seem like a problem that requires widespread international cooperation. if country X cannot be bothered to regulate against companies using dark patterns for cancelling subscriptions, then the citizens in country X suffer the negative consequences. there's a local and short-term incentive for country X to fix the problem for the benefit of its current citizens.

maybe it breaks down if the state in country X makes policy decisions for the benefit of special interest groups (e.g. those enjoying the riches plundered by companies with hard-to-unsubscribe services) and is unwilling to regulate for the benefit of its citizens

[+] such as global warming

Maybe but having country-specific implementations is also a cost and often enough things required for one country will also be provided to users in other countries. If that does not happen here then other countries will simply have to enact similar regulations.

> Topic 3 is ambivalent, how do you identify an contract?

It is not ambivalent. Most places have an account number. (It is needed because you might have more than one contract with the same company)

i can imagine intentionally useless UI for this. require the account number to be entered in a particularly stupid format. 12345 -> one TWO 3 four FIVE. add heavy input validation. make the validation give no hint about what is wrong with the input. defer validation as late as possible in the process "processing cancellation request --- something went wrong, we could not match the entered account, name, blood type against our records. please try again". route all requests for cancellation to a particular backend server bathed in cosmic rays.

hopefully there is a regulator to monitor and enforce the new legislation, and it will be treated as an adversarial iterative game, where v2 of the legislation will eliminate some of the more malicious interpretations of how to comply

FWIW laws like that are not enforced in Germany by public regulators but by competitors and associations sending out endless of the infamous costly cease-and-desist letters ("Abmahnung"). So just one competitor (or business/consumer association) with enough will and money to fight that question through courts will be enough to settle such questions. Happens all the time with consumer protection laws. There is a large industry of lawyers for both sides.

Your online shop says it offers "insured shipping"? Cease-and-desist letter in your mailbox next day. You don't give a price per unit (kg, l, etc.)? Cease-and desist. Send the required information on the mandatory 14 day return period in the email body instead of a PDF attachment? Cease-and-desist. Don't comply to just one of the other ever changing consumer protections laws? Cease-and-desist.

OK, so I just tried to look up my Prime account number. All I can find, pretty hidden, is an order number, which changes with every prolongation. Legally, I have one contract, that prolongs every year if I do not cancel. This contract has no ID (it is my email address, sort of). So if I enter the Prime order number in the new cancellation form, would I cancel the entire contract or just the running instance?

My parents wouldn't know what to fill in the contract identification field of the cancellation form.

Plenty of room for dark patterns.

I don't think lawmakers are that dumb. They will have used words like "easy" in the law. If it's taken to a court, then the judge might very well deem the technical solution to not be easy if he is convinced that it was intentionally or even accidentally made much harder than necessary. And that could get expensive.

I think the law should mandate cancellation at your bank (and no more harrassement from the service)

Reply on news.ycombinator.com