Tell HN: Hulu does not allow subscription cancellation | Hacker News Reader

Tell HN: Hulu does not allow subscription cancellation

55 pointsthrowawayhulu152 comments

Just bumped into this this morning - I'm so sick of these dark patterns.

1. Try to cancel your hulu subscription on account and billing 2. You'll be presented with an option to "pause" subscription 3. If you ignore that, you'll be presented with new "offer" 4. Now finally if you ALSO ignore that, you'll get a CORS error trying to actually cancel

account/cancel:1 Access to fetch at 'https://www.hulu.com/api/v1/subscription/cancel' from origin 'https://secure.hulu.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled. _app-bf55b49463c4f36f.js:1 POST https://www.hulu.com/api/v1/subscription/cancel net::ERR_FAILED

There's zero UI feedback about the cancellation status.

Fuck hulu.

Also good luck trying to get support for this.

I'm in the process of closing some web accounts myself. Here's what worked for me:

1. Block all charges or cancel the card, but do NOT issue charge backs just yet (there's no point burning your relationship and I've recently learned that many SaaS share a list of evil charge-backers, so it wouldn't just affect hulu).

2. Send them a registered letter, I always ask to be refunded any charges from after my first support ticket as well as refunded for the letter itself. They rarely do the latter but they always do the former.

But yeah, it's a total hassle and I've come to hate the internet lately...

I believe that organized, mass-scale petty crime will only be fixed when executives are charged under RICO.

> I've recently learned that many SaaS share a list of evil charge-backers

That sounds concerning, as the list likely has no proof and could easily be used to ban and discriminate against folks. In fact any startup passing that list around is one I’d never want to do business with because it seems pretty gross.

I know you want to act like this is nefarious but it is, in fact just a bug.

I was able to cancel just fine just now. Nothing about the process was that bad. No worse than Netflix at least.

Same I cancelled a few weeks ago without issue.

I'm willing to bet that this is due to some browser extension on the user's side messing with CORS headers. But too late, the outrage mob has already assembled.

I wouldn't be so sure, that its a user side issue since CORS is handled on the backend. That is in your server config, explicitly allowing https://secure.hulu.com to access https://www.hulu.com as an example.

That said its likely a bug and nothing nefarious. Not to diminish that this is a really severe issue that you should raise to customer support, who likely has ways of cancelling for you.

In California if you subscribed online the law requires online cancellation.

https://www.pillsburylaw.com/en/news-and-insights/changes-ca...

“ Even before these changes, the ARL has been a frequent focus of both private class action litigation and government enforcement actions. ARL class actions frequently settle in the seven figures, and earlier this year a popular weight-loss app settled such an action for over $60 million. On the enforcement side, several California district and city attorneys have joined forces to pursue ARL claims as the California Auto Renewal Task Force (CART). In recent years, CART has also reached several seven-figure settlements, including with a direct marketing company for over $8 million and with the owner of several online dating sites for over $2 million.”

Hulu allows online cancellation, the user was on the correct page already. The webpage probably has a - hopefully temporary - bug.

Or a browser extension messing with CORS headers. Plenty of people (including some in this thread) are able to cancel Hulu subscriptions just fine.

Legal compliance has a way of increasing focus on certain bug fixes, particularly if there are potential non-trivial fines :)

Edit: I was happy to hear about some legislation and regulatory action against dark patterns.

SiriusXM does something very similar. Offers the option to cancel through their account portal, but it just happens to "error" out before processing, asking you to contact support. Luckily I used a Privacy virtual card [0] in anticipation of this, as I only wanted to take advantage of their cheaper 1-year offer. They attempted to charge the card the full amount multiple times, even after submitting a chat (without response to up-sell new offers), before giving up and successfully charging my account pro-rata for the few days I was submitting tickets (it went through as it was cheaper than the limit I had set on the Privacy card).

[0] https://privacy.com/

I had a laugh at "pro-rata," suddenly these greedy fuckers can pay enough attention to what is going on so they can grab the spare change before they go.

That was my reaction when I got the notification of the charge. A whopping $1.49.

Make sure you don't an extension enabled that might be messing up with CORS headers.

> Also good luck trying to get support for this.

File an arbitration and their real customer support (legal) will reach out to you and resolve it.

I highly doubt this is some conspiracy to prevent people from unsubscribing. It’s a bug.

I wonder if turning off browser CORS with one of those browser extensions some devs use would let it go through.

Make sure you don't have shields up if you're using Brave and/or adblock is disabled. Probably won't help but sometimes this fixes broken endpoints for me

Write a letter canceling your account and send it via certified mail to their legal correspondence address.

Or for added giggles print out the ToS, alter and initial it to suit your whims, and send that certified to their legal as your new terms of service. “By continuing to provide the Hulu service, Hulu agrees to …”

Most likely that will result in your account being canceled when they see the letter. But hey maybe it will result in a cause of action for the lifetime free annual two week long Disney vacation getaway or whatever else it is they will have agreed to.

One thing I've never understood w.r.t. certified letters and the law:

Isn't the content of the letter still subject to debate?

E.g., either party could create a fake letter and claim it's the one that was sent via registered mail.

The only solution that comes to mind is having a notary public atomically notarize all the relevant details.

> Isn't the content of the letter still subject to debate?

Yes. I'm not a lawyer, (like at all :D) but I used to work admin for a lawyer's office during high school as a summer job. As a matter of procedure that office kept a hard copy of every outgoing certified letter and a continuously numbered ledger with metadata about the outgoing letters. Presumably in case of a dispute these would be used as evidence.

And yeah notary public is an other option. Obviously it is more expensive so only used when it is necessary. Lugging papers to the notary public and waiting for my turn, getting them processed and then carrying them back to the office was one of my tasks.

I had the same issue. Turns out it was caused by home network adblocker. Don't know why, but when I tried to cancel using my phone not connected to home wifi, everything worked. I never figured which rule was causing this problem...

Aside from dark patterns, is there a good theory why this cors issue is present? Maybe the QA test on locally hosted instances, which are exempt from cors?

Or you know, someone was just overworked and pushed a change without writing tests for it.

My guess is some transient error was thrown by the cancellation service which did not invoke the path which sets appropriate CORS headers.

I guess having a proper intermediary AppStore does have benefits, huh

not really. So this one example should outweigh all the other negatives of a walled garden?

I’m a sample size of one but I suspect that most folks don’t see many negatives to the walled garden. I don’t want to hack about on my phone. I don’t need root nor do I want to worry about security on my phone. I don’t think Apple is perfect or impervious to attack vectors but for me. I actively prefer the walled garden. It’s mostly something I don’t have to worry about.

Once I change to a laptop then I’ll shoulder the additional risk and work to have a more open platform.

Count me in with jbverschoor. Life is so much easier when cancellation is just a few clicks on my iDevice instead of dealing with dark patterns and broken workflows.

Benefit, no S. But I appreciate your finding the silver lining.

Arguably there's no reason this shouldn't be something managed by the payment processor instead of a supposed app store

If you are unable to reach a human then I would suggest contacting your bank and disputing the charge(s) and doing charge-backs. You can also report your card stolen to get a new card number unrelated to the last card number to prevent them from charging again. Hulu's HQ is in California so you may also consider writing up a terse factual report to the BBB. Businesses do respond to the reports. [1]

[Edit] As toomuchtodo mentioned one can also contact the AG. [2] Their site does not support secure renegotiation so I can not verify this link.

[1] - https://www.bbb.org/us/ca

[2] - https://oag.ca.gov/contact [ssl error]

I think organizations like the BBB are smoke and mirrors. Despite calling themselves a "bureau," suggesting they are official in some way, it is not a government organization. And despite their claims of neutrality, they are a 501(c)(6) business league funded by the very businesses against whom you might complain. How Stuff Works has an article describing much of the criticism BBB receives, and I think it's valid.

https://money.howstuffworks.com/better-business-bureau5.htm

This sounds like a inadvertant bug, not an intentional dark pattern. If you can't reach someone to cancel and accept feedback about the bug, contacting your state's attorney general will go farther than complaining to the BBB. Though, you should probably try a different browser first; it would be easier than calling your bank or AG.

What you wrote is factually true, but a lot of businesses do handle complaints through them and I have personally had luck where other avenues have failed. Maybe I am a little too moneyball but if they get on base they are good with me.

In OK the BBB is not allowed to show the public any details on any particular business! Only reports in aggregate. They have been entirely declawed.

The BBB is the pre-internet Yelp

BBB is a scam. Contact your state's attorney general.

I had good luck going to the state AG when I got into a Kafkaesque situation when I tried to sign up for fiber with CenturyLink, when it turns out it was not available in my area.

> You can also report your card stolen to get a new card number unrelated to the last card number to prevent them from charging again.

That frequently does not work. Visa, MasterCard, and Discover (not sure about American Express) offer update services that allowed qualified merchants to get updates on changes to credit card accounts.

The merchant can ask about a card they have on file and the update service will tell them if that number is still valid or not, tell them if it has a new expiration date, and if the number is no longer valid tell them the new number and expiration date.

In that case I would probably just close the associated bank account. I consider them all disposable. Banks love opening new accounts as it makes the bankers numbers look good.

Reply on news.ycombinator.com