Brussels Reinvents the Door
There are certain dates, in the long calendar of European Union legislation, that should be celebrated with confetti, marching bands, and a small civic moment of silence for everyone in the procurement department of a SaaS company.
19 June 2026 is one of those dates.
From today, an updated piece of the EU Consumer Rights regime requires that, for any online business-to-consumer contract, the option to cancel must be at least as easy to find and use as the option to subscribe. In Brussels jargon, it is the “withdrawal-function” rule. In human English, it is the “stop torturing people with maze-like cancellation flows” rule. In the rest of this article, we will call it, with appropriate dignity, the Button.
A short geological history of unsubscribing
To understand why a button is a piece of legislation, you have to remember that, in the standard internet timeline, signing up to a service takes between four seconds and one and a half minutes, depending on whether your phone autofills your credit card. Cancelling the same service, in the same standard timeline, takes between forty-five minutes and the remaining length of your natural life.
This asymmetry did not happen by accident. It is the product of an entire discipline, broadly known as growth engineering, and more narrowly as dark patterns, which is the polite term for designs deliberately engineered to make a user act against their own clearly stated preference.
The dark-pattern industry has produced extraordinary innovations over the years. Cancellation links rendered in three-pixel grey on a slightly darker grey background. “Are you sure?” dialogues stacked four deep, each one phrased as if the user were leaving a beloved spouse rather than a streaming service. Cancellation flows that require, at some point, a telephone call to a centre open only on weekdays between eleven and noon, local Luxembourg time. Pre-checked boxes that re-subscribe the user to a different plan, gently, on their way out.
None of this is illegal in most jurisdictions. It is creative. The European Union, after thirty years of admiring this creativity from a distance, has decided that perhaps the creativity has gone far enough.
What the Button actually does
The text of the updated rule is, as is the local custom, dry. The cancellation function must be:
- displayed prominently and continuously during the contract period
- labelled clearly and unambiguously
- accessible without unnecessary steps
- not subordinated to demonstrations of regret, surveys, or counter-offers placed before the cancellation can be executed
Translated again, the Button must look like a button, be called something that looks like “cancel”, be where a normal person would look for it, and not require the user to first explain themselves to a panel of imaginary HR officers.
The legal mechanism is not particularly exotic. It rests on the existing EU Consumer Rights Directive (2011/83/EU) as amended, and on the relevant provisions of Directive (EU) 2023/2673 transposed into national law across Member States. National enforcement will be carried out by consumer protection authorities. Penalties are calibrated to local consumer law regimes, which vary widely, from “polite fine” to “actual deterrent” depending on the country.
The next eighteen months, predicted with limited risk
There are several things one can confidently predict about the immediate future of the Button.
First, the Button will exist. Every B2C SaaS vendor with a billing relationship in the EU is, as of this morning, a customer of a small army of legal consultants and UX redesigners. The Button will be implemented. The Button will be in production by next quarter. The compliance memos have been written. The cookies are being baked.
Second, the Button will be ugly. It will not be the cheerful, prominent “Cancel my subscription” link the regulation imagines. It will be a faded grey link, two or three menu levels deep, called something like “Manage subscription”, which opens a page where the actual cancellation requires one more click on a smaller link in another faded grey, just inside the limit of what an enforcement agency could plausibly call “prominent” without laughing.
Third, the surrounding theatre will be magnificent. The Button will be preceded, when clicked, by polite expressions of regret. By a personalised offer. By a second offer, generated dynamically. By a single, optional survey question that, somehow, the user feels rude skipping. None of this is technically illegal, because nothing in the rule says the seller cannot ask, gently, why the customer is leaving. The rule only says these conversations cannot block the cancellation. They will not block it. They will just delay it, exhaust it, talk it out of itself.
Fourth, a number of test cases will end up in front of national courts, then in front of the Court of Justice of the European Union. The relevant national authorities will produce guidance documents. The guidance will produce more guidance. By 2029, a body of case law will exist that defines, in fine grain, what constitutes “prominent”, “clear”, “unambiguous”, and “without unnecessary steps”. By 2030, the Button will have stopped being a Button and will have become a regulatory category, with its own conferences in Vienna and Lisbon.
Why this is, in the end, still progress
It is fashionable to mock European Union consumer regulation. The mockery is, in equal parts, deserved and beside the point.
The truth is that the EU consumer protection apparatus exists precisely because no single market actor will fix asymmetries like the cancellation asymmetry on its own. A company that makes cancellation harder than its competitors keeps more revenue. A company that makes cancellation easier loses revenue to companies that did not. In the absence of a rule, the floor of behaviour is set by the most aggressive actor in the market, and everybody else either follows or dies. The rule, however clumsy, raises the floor.
That is, in essence, what consumer regulation is for. It is not designed to make markets virtuous. It is designed to keep the worst actors out of the room.
The Button will not, in the end, fix the trust problem between consumers and digital service providers. It will not undo thirty years of asymmetric design. It will not, by itself, kill the dark-pattern industry, which has shown a long-standing capacity to retreat one pixel at a time and call it surrender.
But for the first time in a long time, on this one narrow point, the gradient is no longer pointing only against the user.
19 June 2026, by EU decree. The Button is here. Let us see how creatively they hide it.
Sources and references
- Directive (EU) 2023/2673 of the European Parliament and of the Council, amending Directive 2011/83/EU as regards financial services contracts concluded at a distance, and the related extension on withdrawal-function design.
- EU Consumer Rights Directive (2011/83/EU), consolidated text.
- Scrive, “New EU withdrawal-function rules are coming in June 2026”, knowledge hub note.
- EUbusiness, “June 2026 EU infringements package: key decisions”.
- European Data Protection Board (EDPB), Guidelines on deceptive design patterns in social media platforms, 03/2022.
- French CNIL, “Shaping Choices in the Digital World”, 2019.
- UK ICO, guidance on dark patterns and consent.
- US FTC, Bringing Dark Patterns to Light, staff report, September 2022.
All my “insane” books on cybersecurity and governance are here 👉 https://www.amazon.it/stores/author/B0FB47T6Q4/allbooks