I would be in favor of a different approach: a merchant should not, under any circumstances, be able to remove money from an account, charge a credit card, or otherwise take money from someone without the explicit authorization of the customer. In this context, explicit means one of two things:
1. The customer intentionally authorized that specific transaction. A specific transaction means one transaction. If a merchant wants to use this approach, they need to ask for authorization each time they charge.
2. The merchant may register a subscription or other recurring charge arrangement with the customer’s bank or card provider. The customer must explicitly authorize this registration at the time it occurs and may, by contacting their bank, revoke the authorization at any time. The merchant may not recreate the authorization without the customer re-authorizing it at the time of creation.
Eventually, the whole pull model of money transfers needs to go away. Taking money from someone by knowing their account number is nonsensical and should not be possible.
>The merchant may register a subscription or other recurring charge arrangement with the customer’s bank or card provider.
An advantage of Direct Debits in the UK is that I see them all in my banking app and can cancel them individually. A company is legally required to gain my consent again before charging again.
I think the explicit authorization is the contract you sign that allows for the subscription. It's already pretty risky to loan people money, and your system makes it even riskier. (Consider the business model of cloud providers; you agree to pay for whatever you use, and then they charge you for last month's usage. If you could just not pay, then the business wouldn't really be viable. You'd have to figure out what you're going to use in advance, and pre-pay, and the consequences for getting it wrong by 1 cent would be unnecessary downtime. Cloud providers of course let you pre-pay at a discount, but having both pre-pay and post-pay make a lot of sense. But, we're all paying extra because of the people that walk away at the end of the month and don't pay their bill.)
It would be worthwhile to consider not letting "click agree" create a binding contract. I think I'm in favor of that.
I agree that things like newspapers don't need to be a subscription or have a contract. On the first of the month they should just pop up a dialog that asks if you still want the subscription, and if so, it charges your card for 1 month. I would certainly like that, but it does carry a risk on my end -- if they go out of business on the second of the month, I'm stuck paying for 29 days of the subscription I can't use.
Like I said, the big problem is not being able to cancel. That's why I buy subscriptions through Apple -- there's always a cancel button. I think we should make that mandatory for every subscription provider.
This is literally what “sending you a bill” is. They don’t need to have an upfront agreement to charge your card. They need an upfront agreement that you will pay for services used at the end of the month. This is standard invoicing that these companies already do just without automatically charging cards.
When you pay your medical bills it’s still an explicit payment.
So for newspapers and whatnot, the bill is the problem, not charging your credit card. You can close your credit card to stop the payment, but you can never get out of a contract you signed.
Businesses probably need contracts in order to function, but they are overused in business-to-consumer transactions. That's the underlying problem that we should solve -- you should be able to walk away, no questions asked, from paying for a newspaper or magazine.
I think there are a couple of issues. One is that most countries consider giant piles or fine print that no one reads to be binding contracts and that customers can’t credibly negotiate them. The other is that it’s far too easy for merchants to extract money from customers without the customers’ consent.
Attacking the latter might make a large difference even if the former remains unsolved. The New York Times can get away with making cancellation difficult because they have the power to unilaterally take money from their (former?) customers. But, if anyone could trivially revoke their authorization to charge them money, I doubt that the New York Times would actually try to sue or collect from their customers en masse. Sure, they could try, but that would be a fantastic way to piss everyone off and to recover very little money.
Though I’m skeptical of cryptocurrencies as a market, I’m very bullish on the technology long-term for use-cases like this. Having programmable money where every party is able to audit something like a smart contract and see how their deposited money will be treated is huge. We could effectively get rid of pull-model money transfers and instead relegate similar functionality to open smart contract pools.
Even worse! Now you don't have protection from your credit card company not redress through the courts.
You already have the ability to "audit" the EULA/ToS/PP; it's that link you never click next to the "I agree" button.
The powerful (in money, size, skill, fame, strength, etc.) always try to (ab)use systems to bully the weak. Smart contracts only amplify their ability to do so.
Why would a company, which (reasonably) declines to deploy its limited legal resources negotiating with each user, possibly be interested in deploying its limited engineering resources to negotiate a smart contract with each user—especially when one screw-up can "legally" bankrupt the company? (See The DAO.)
If there can be no negotiation, the options are:
1. You reject their terms and don't use the service.
2. You accept their terms and legally use the service.
3. They accept your terms and you legally use the service. (Usually too risky/costly for them.)
4. You reject their terms and illegally use the service anyway.
We could legalize option 4, but that is a very bold move—the equivalent of the Chicxulub impact on legal and business practices.
I'm always amazed reading that this isn't already the case in the US. In India, every charge requires SMS based 2fa. Starting a bank mandate (ECS/NACH) for automatic transfers needs me to physically sign a paper. It can be revoked any time by the user without any involvement of the receiving party, and can be done online as well.
1. The customer intentionally authorized that specific transaction. A specific transaction means one transaction. If a merchant wants to use this approach, they need to ask for authorization each time they charge.
2. The merchant may register a subscription or other recurring charge arrangement with the customer’s bank or card provider. The customer must explicitly authorize this registration at the time it occurs and may, by contacting their bank, revoke the authorization at any time. The merchant may not recreate the authorization without the customer re-authorizing it at the time of creation.
Eventually, the whole pull model of money transfers needs to go away. Taking money from someone by knowing their account number is nonsensical and should not be possible.