Got To Glow

The email lands on a Friday. Apple TV is going from $12.99 to $14.99 a month, the fourth rise in four years, and you decide you have had enough. You open the app, tap through to your subscription, and land on a page offering you three months at half price. Cancel is in there somewhere. It is just never sitting where the discount is.

Why It Matters

The rule everyone remembers was real, and then it wasn't. The FTC finalised its click-to-cancel rule in 2024, and on July 8, 2025 the Eighth Circuit vacated it, not on the merits but because the agency had skipped a preliminary regulatory analysis the law required. A paperwork failure. Years of drafting undone by a procedural step nobody outside the agency was watching.

The FTC hasn't given up on it. In March 2026 it opened an advance notice of proposed rulemaking to build the thing back, and the comment window shut on April 13, 2026. Rulemaking of that kind runs in years. In the meantime the agency keeps suing under the older Restore Online Shoppers' Confidence Act, which still requires a simple mechanism to stop a recurring charge, and it has teeth: the FTC's own September 2025 announcement put its Amazon Prime settlement at $2.5 billion, the largest the agency has ever secured, over sign-up flows and cancellation paths it called deliberately obstructive.

So the federal floor is enforcement after the fact, case by case, years late. The actual rules about clicks and notice windows have moved to the states, and the better ones have gone well past disclosure into the mechanics of the exit itself: how many steps, how much warning, whether a retention offer is allowed to sit between you and the cancel button. It is the same fragmentation that shows up in how refund rights split between the UK and the US on device financing, and it produces the same result. Two people paying the same company the same money have different rights.

That first number is the one worth memorising. New York doesn't only require a warning before a price rise, it gives you a short run of days after the higher charge actually lands to leave and take back the unused portion. Most people spot an increase on the statement, not in the email that announced it three weeks earlier. The law is written around how people behave rather than how they are supposed to behave, which is rarer than it should be.

Where Your Rights Actually Come From

Read this as a map of leverage, not a legal opinion. The question is never whether a company is behaving badly, it is which specific obligation you can point at when you write the complaint. Find your row, then quote it back to them.

The pattern in that table is worth naming. The strong provisions are the boring procedural ones, notice windows and step counts, because those are the only things a regulator can measure without arguing about intent. Nobody wins a fight about whether a cancellation flow felt manipulative. Everybody wins a fight about whether a reminder arrived 12 days before renewal when the statute said 15.

Friction Points

Here is the part the compliance blogs skip. A patchwork does not give everyone the strongest rule, it gives every company a map. Large subscription businesses run geo-detection already, and the rational move is to build the compliant flow for California and New York and serve the old one everywhere else. Smaller merchants do the opposite and overcomply nationwide because writing 25 versions of a cancel page is absurd. My read is that the patchwork has been quietly good for consumers in strict states and slightly worse for everyone else, which is not the outcome anyone campaigning for these laws intended.

Second problem, and this one is yours to manage. Almost none of these statutes cover the subscription you bought through an app store. The billing relationship sits with Apple or Google, the cancellation flow is theirs, and the merchant you are angry with genuinely cannot cancel it for you. The same routing confusion turns up in who carries the loss when an AI agent buys the wrong thing. Knowing which party actually holds the switch is most of the battle.

• A retention discount you accept usually restarts the clock, so the renewal notice you were owed next month may no longer be owed.
• Annual plans are where the notice rules bite hardest, and also where most people forget they are enrolled until the charge clears.
• A cancellation confirmed only on screen and never by email is not evidence, and support systems lose it with impressive consistency.
• Calling your bank to block the charge before you have formally cancelled can leave the contract alive and the debt accruing.

Do one thing this week. Open your card statement, find every recurring charge you cannot immediately justify, and cancel the ones that fail, starting with anything on an annual renewal. Do it now rather than at renewal, because the notice windows that protect you only help if you are watching the calendar, and the company running the cancel page is not going to remind you twice.

The Xbox got more expensive this month. The financing offer sitting next to it at checkout did not. That pairing is the whole story of consumer electronics this year: the hardware costs more, and the company selling it would very much like you to spread the damage across a few instalments instead of walking away.

Instalment plans at the point of sale used to be a fringe option for clothing. Now they are a default button on consoles, laptops, phones and televisions. And the protection attached to that button is not what most buyers assume it is.

Why It Matters

Start with the price pressure, because it explains the timing. Microsoft announced on 25 June 2026 that the 512GB Xbox would rise by $100 from 1 August, its second increase in under a year, and said storage and memory costs had gone up two and a half times over. In the same announcement it offered Buy Now Pay Later, interest-free financing and cheaper refurbished units. That is a company reading its own demand curve correctly. Fewer people can absorb the new sticker price, so the sticker price gets broken into pieces.

Breaking a price into pieces is not automatically a bad deal. Four payments at zero interest beats a credit card balance you carry for eight months, and for a lot of households it is the difference between replacing a dead laptop now and going without. The problem is what quietly changes when you press that button instead of the card one. You are no longer making a card purchase with decades of dispute law wrapped around it. You are taking out a small loan from a company whose refund policy is, in most markets, its own invention. This is the same structural gap that shows up when software starts spending on your behalf, which is why who pays when an AI shopping agent buys the wrong thing is still an open question.

The rules moved after the meter did, the same sequence that played out when usage-based AI billing reshaped the software budget. Two things happened five weeks apart that pulled the two biggest English-speaking markets in opposite directions. In the UK, the Financial Conduct Authority began regulating Deferred Payment Credit in mid-July 2026, which brings affordability checks, Section 75 refund cover through the lender, and access to the Financial Ombudsman Service. Agreements signed before that date stay unregulated, so the plan you took out in June carries none of it. In the US, the Consumer Financial Protection Bureau revoked the interpretive rule that would have treated these plans like credit cards for dispute purposes, and confirmed it would not issue a replacement. Same product, same app, opposite floors.

The late-payment figure is the one worth sitting with, because it is not describing people in financial trouble. Default rates stay low. What it describes is a repayment schedule that does not line up with how anyone actually gets paid, running quietly in the background while three other schedules do the same thing. Miss one and the cost is a flat fee rather than interest, which sounds gentler and often is not, because a fixed fee on a small balance is a brutal effective rate.

What Each Payment Method Actually Protects

Below is the comparison nobody selling you a plan is going to put on screen. It covers the three ways most people pay for a device that costs real money, judged on what happens when the thing arrives broken, never arrives, or turns out to be nothing like the listing.

Read down the dispute-route row and the pattern is obvious. The instalment plan is the only column where the company you are complaining about and the company deciding your complaint answer to the same commercial pressure. That is not fraud. It is just a worse seat at the table, and it costs nothing at the moment of purchase, which is exactly why it is easy to miss.

Friction Points

The credit-file question is where honest people disagree, and I am not going to pretend it is settled. Putting short instalment plans into credit files could finally give thin-file borrowers a way to prove they repay things, which is the industry's argument and a decent one. It could equally turn a forgotten $40 payment into a score event that follows someone for years, on a product marketed as too small to matter. Both futures are plausible right now, and anyone claiming certainty is selling something.

The second friction is a design problem, not a policy one. These plans are approved in seconds, at the moment your resistance to spending is lowest, on a screen that shows the instalment and not the total. Stack three of them across three retailers and no single provider sees the whole picture. That is a familiar shape if you have ever compared subscription tiers and found the real cost buried two clicks deep, the way the family sharing fine print in Google One and OneDrive hides who is actually paying for what.

Watch for these specifically:

• The pre-regulation gap. A UK plan opened before the new rules took effect is not covered by them. Check the agreement date before assuming Section 75 applies.
• Refunds that go to the wrong place. Money can be returned to the provider while your instalments keep running. Confirm the plan is cancelled, not just that a refund was approved.
• The unfamiliar-seller trap. Instalment plans are heavily promoted on low-cost gear, which is precisely where quality disputes cluster, and where cheap televisions from brands you have never heard of tend to go wrong.
• Late fees that outrun interest. On a small balance, one flat fee can beat a month of card interest. Do that arithmetic before choosing.

Pick the payment method by what could go wrong, not by what the checkout screen nudges you toward. Expensive item, unfamiliar seller, shipped rather than carried home: use the card, take the dispute rights, clear it in full. Everything else is a cash-flow decision you can make on the merits. Before the next big purchase, open your instalment app and count how many plans are already running. That number is the answer to a question most people never ask themselves.

The agent bought the wrong size. Not the wrong item, not a scam, just a size 9 where you needed an 11, ordered at 2am while you slept, paid for with a token your card network minted specifically so software could spend without asking you first. You call the bank. The bank asks who authorised the transaction. And that is the moment you find out nobody has written the answer down.

Why It Matters

For thirty years, consumer payment protection has rested on a single question with a clean answer: did you authorise this charge? Say no, and a whole machinery of chargebacks, provisional credits and liability shifts spins up on your behalf. That machinery assumes a human at a keyboard. It has no category for a purchase you approved in principle, months ago, in a settings pane, executed by software you have never met on terms you did not read.

And the money is not waiting. Visa published its Trusted Agent Protocol on 14 October 2025, a cryptographic scheme letting a merchant tell a legitimate shopping agent apart from a scraper. Mastercard's Agent Pay binds a tokenised card credential to one specific agent, one merchant scope, one consent policy. Amex went further and shipped a developer kit with an actual promise attached. The rails are built, tested and open. The consumer-protection layer is a blog post from a payments vendor and a lot of hopeful language about "emerging frameworks."

This is a familiar shape if you have been reading along. It is the same trick as the switch from flat AI subscriptions to metered billing, where the pricing model changed underneath people who were still budgeting on last year's assumptions. It is the same omission as Apple Creator Studio shipping without the storage its own workflow requires. The capability arrives first, fully funded and beautifully marketed. The thing that protects you arrives later, if the complaints get loud enough.

Here is the scale, because the numbers explain why nobody is slowing down to sort out the liability question first.

That trust figure is the one worth sitting with. Forrester's survey found roughly a quarter of US online adults willing to let an agent buy on their behalf, which means the overwhelming majority looked at the pitch and declined. The rails were built anyway, because the forecast that actually moves boardrooms is the business one, and Gartner's projection of $15 trillion in agent-run B2B purchasing by 2028 does not care whether retail shoppers are comfortable yet. Consumer adoption is expected to follow the plumbing rather than lead it. That is a bet, not a finding, and it is being placed with your card as the chip. You already know how a cheap device with delegated credentials behaves once someone finds it: the credential is the whole attack surface, and now the credential can buy things.

What Actually Exists Right Now

Strip out the press releases and the picture is narrow but readable. There is one real, written promise on the consumer side, a set of identity plumbing that helps merchants more than it helps you, and a legal vacuum where the rest should be.

Read the Amex row against the Fraud Gap row and the shape of the promise gets clear. Covering agent error is a quality guarantee on their own software. It is not a fraud guarantee, and payments people have been saying so since the announcement, drawing the parallel to Apple Pay's 2014 launch, where tokenisation worked exactly as designed and criminals simply loaded stolen identities onto devices instead. The rails did their job. The gap moved upstream.

Fourteen months separates Mastercard's first Agent Pay announcement from always-on machine payments going live, with the two card networks joining Google's AP2 protocol in between and Amex adding the first error guarantee. No consumer-protection statute landed anywhere in that window.

Friction Points

The genuinely unsettled question, and I do not think anyone has a defensible answer yet, is whether an agent's mistaken purchase is legally an unauthorised transaction at all. You authorised the agent. You did not authorise that purchase. Existing law was drafted for a world where those two things were the same event, and reading a decades-old consent regime onto delegated software is going to produce results that satisfy nobody. My own view is that "unauthorised" will end up defined narrowly, in the card networks' favour, unless a regulator forces the issue early. But that is a prediction, not a finding, and I would not build a spending plan on it.

Meanwhile the practical failure modes are already visible, and none of them require a criminal. An agent misreads a variant. A price changes between the plan and the checkout. A subscription renews inside a delegated scope you forgot you granted, the same way a shared family plan quietly extends permissions past the person who set it up. Watch for these:

• Spending caps that apply per transaction rather than per month, so an agent can make forty compliant purchases and still empty the account.
• Merchant scopes granted broadly at setup, because the narrow option made the agent useless in testing and nobody went back to tighten it.
• Dispute windows counted from the transaction date, not from the day you noticed, which matters more when a machine is buying while you sleep.
• Return policies written for human buyers, where "changed my mind" is refused and "the agent picked wrong" is not a category the support script recognises.

Open your card issuer's app this week and find out, in writing, what it says about purchases made by an AI agent. If the answer is nothing, that is your answer: the protection you are relying on does not exist yet, and the rails that let software spend your money are already live. Delegate small amounts to a card you can afford to have go wrong, and let somebody else be the test case.