The $2.5 Billion Cancel Button: 7 Design Tricks That Now Get Companies Fined
Sep 14, 2026
In September 2025, Amazon agreed to pay the US Federal Trade Commission $2.5 billion. Not for a data breach. Not for anticompetitive behaviour. For the design of a cancellation flow.
The regulator argued that signing up for Prime was easy and leaving was not, and that the difference between those two experiences was engineered rather than accidental. Amazon settled. It remains one of the largest FTC settlements in history, and the whole case is essentially about buttons, wording, and how many screens stand between a customer and the exit.
In March 2026, Adobe and the Department of Justice settled for $150 million over a cancellation process the complaint described as carrying unnecessary steps, delays, unsolicited offers and warnings. Vonage paid $100 million for similar reasons. Epic Games agreed to $520 million in total over interface design in Fortnite. Since 2022, US regulators have recovered over $2.9 billion from cases of this kind.
These are not obscure legal technicalities. Every one of them is a decision somebody made in a design review.
What follows is the list regulators actually pursue. Read it as a checklist against your own site, because that is what it is.
This is the expensive one. If subscribing takes two clicks and cancelling takes a phone call, a retention offer, three confirmation screens and a survey, you have built the exact thing that cost Amazon $2.5 billion and Adobe $150 million.
The standard regulators are converging on is symmetry. Cancellation should be available through the same channel used to sign up, and should take a comparable number of steps. One retention offer is fine. A maze is not.
"Offer ends in 09:58." Refresh the page and it says 09:58 again. This is the most common pattern found in the European Commission's study, and it is also one of the easiest to prove, because anyone with a browser can demonstrate it in ten seconds.
Real deadlines are excellent marketing. Invented ones are a misrepresentation of a material fact, which is the specific thing consumer protection law exists to address. If the offer genuinely ends Sunday, say Sunday.
"No thanks, I prefer paying full price." "I don't care about growing my business."
Naming the decline option in a way designed to make the user feel foolish is on the EU's named list under confirm-shaming. Beyond the legal question, it is worth noticing what it does to the people who click it anyway, which is most of them. You have taken a neutral moment and made your brand mildly unpleasant in exchange for a small lift in opt-ins.
The basket says $40. The payment page says $58.50. The difference is a service fee, a handling charge and a delivery surcharge that were never shown until the customer had already invested eight minutes.
This is called drip pricing, and it is under active enforcement pressure in several markets. It also has an unusually clear commercial cost: unexpected fees at checkout are among the most frequently cited reasons for cart abandonment anywhere. You paid for the traffic, you earned the intent, and then you surprised them.
France's data protection regulator fined Google €150 million and Facebook €60 million on a precise point: accepting cookies took one click, refusing them took several. The imbalance itself was the violation.
The rule is simple to implement and widely ignored. Accept and Reject should be equally prominent, equally styled, and equally easy to reach. If your Reject button is a grey text link below the fold while Accept is a filled blue rectangle, you already know which side of that line you are on.
The upsell is a large coloured button. The decline is small grey text placed where nobody looks. Nothing here is untrue, and the interface is still steering the decision in a way the user would not have chosen with a clear view.
This is the pattern the EU consultation calls leading presentation, and it is also the one that most often survives internal review, because every individual choice seems defensible. The test is whether both options would be found equally fast by someone genuinely looking for the second one.
A free trial that converts to a paid subscription without a reminder, using a card you took at signup, is forced continuity. It generates revenue that looks excellent in a dashboard and arrives largely from people who forgot.
That revenue is not free. It returns as chargebacks, refund requests, bank disputes and one-star reviews, and in several jurisdictions it now also returns as a regulatory question. Sending a reminder email three days before the charge costs almost nothing and removes the entire category of problem.
None of these require a lawyer, a budget, or a quarter of planning. They require thirty minutes and a willingness to find something you would rather not.
The regulator argued that signing up for Prime was easy and leaving was not, and that the difference between those two experiences was engineered rather than accidental. Amazon settled. It remains one of the largest FTC settlements in history, and the whole case is essentially about buttons, wording, and how many screens stand between a customer and the exit.
In March 2026, Adobe and the Department of Justice settled for $150 million over a cancellation process the complaint described as carrying unnecessary steps, delays, unsolicited offers and warnings. Vonage paid $100 million for similar reasons. Epic Games agreed to $520 million in total over interface design in Fortnite. Since 2022, US regulators have recovered over $2.9 billion from cases of this kind.
These are not obscure legal technicalities. Every one of them is a decision somebody made in a design review.
How common is this, really
76% of sites and apps use at least one
A 2024 international sweep by consumer regulators across multiple countries found more than three quarters of the websites and apps examined used at least one deceptive design pattern. 67% used several.Countdown timers lead the list
A European Commission study of 399 online shops found 37% used at least one tracked pattern, with fake urgency timers the single most common.Regulation is tightening, not loosening
The EU consultation on the forthcoming Digital Fairness Act ran from July to October 2025 and named nine specific practices, including click fatigue, nagging, confirm-shaming and artificial urgency. The Commission proposal is expected before the end of 2026.
What follows is the list regulators actually pursue. Read it as a checklist against your own site, because that is what it is.
1. The exit that takes six screens
This is the expensive one. If subscribing takes two clicks and cancelling takes a phone call, a retention offer, three confirmation screens and a survey, you have built the exact thing that cost Amazon $2.5 billion and Adobe $150 million.
The standard regulators are converging on is symmetry. Cancellation should be available through the same channel used to sign up, and should take a comparable number of steps. One retention offer is fine. A maze is not.
2. The countdown timer that resets
"Offer ends in 09:58." Refresh the page and it says 09:58 again. This is the most common pattern found in the European Commission's study, and it is also one of the easiest to prove, because anyone with a browser can demonstrate it in ten seconds.
Real deadlines are excellent marketing. Invented ones are a misrepresentation of a material fact, which is the specific thing consumer protection law exists to address. If the offer genuinely ends Sunday, say Sunday.
3. Confirm-shaming
"No thanks, I prefer paying full price." "I don't care about growing my business."
Naming the decline option in a way designed to make the user feel foolish is on the EU's named list under confirm-shaming. Beyond the legal question, it is worth noticing what it does to the people who click it anyway, which is most of them. You have taken a neutral moment and made your brand mildly unpleasant in exchange for a small lift in opt-ins.
4. Costs that appear at the last step
The basket says $40. The payment page says $58.50. The difference is a service fee, a handling charge and a delivery surcharge that were never shown until the customer had already invested eight minutes.
This is called drip pricing, and it is under active enforcement pressure in several markets. It also has an unusually clear commercial cost: unexpected fees at checkout are among the most frequently cited reasons for cart abandonment anywhere. You paid for the traffic, you earned the intent, and then you surprised them.
5. The consent banner where refusing is harder than agreeing
France's data protection regulator fined Google €150 million and Facebook €60 million on a precise point: accepting cookies took one click, refusing them took several. The imbalance itself was the violation.
The rule is simple to implement and widely ignored. Accept and Reject should be equally prominent, equally styled, and equally easy to reach. If your Reject button is a grey text link below the fold while Accept is a filled blue rectangle, you already know which side of that line you are on.
6. Misdirection through colour, size and position
The upsell is a large coloured button. The decline is small grey text placed where nobody looks. Nothing here is untrue, and the interface is still steering the decision in a way the user would not have chosen with a clear view.
This is the pattern the EU consultation calls leading presentation, and it is also the one that most often survives internal review, because every individual choice seems defensible. The test is whether both options would be found equally fast by someone genuinely looking for the second one.
7. The trial that bills quietly
A free trial that converts to a paid subscription without a reminder, using a card you took at signup, is forced continuity. It generates revenue that looks excellent in a dashboard and arrives largely from people who forgot.
That revenue is not free. It returns as chargebacks, refund requests, bank disputes and one-star reviews, and in several jurisdictions it now also returns as a regulatory question. Sending a reminder email three days before the charge costs almost nothing and removes the entire category of problem.
The uncomfortable part
Here is what most articles on this subject leave out: these patterns work. They genuinely lift signups, opt-ins and short-term revenue, which is precisely why they are everywhere. Anyone claiming otherwise has not watched the numbers move after a confirm-shaming line goes live.
The honest argument is not that they fail. It is that they borrow. They pull forward conversions from people who would not have chosen you with full information, and the cost arrives later, spread across refunds, support load, churn, disputes and the slow erosion of whether people believe your pricing page. That cost is harder to attribute than the conversion lift is to celebrate, which is exactly why these patterns survive review after review.
And now there is a second bill, arriving from regulators who have recovered $2.9 billion since 2022 and are actively writing more rules.
Three tests you can run this week
The cancel test
Time how long it takes a real person to cancel or delete their account, starting from your homepage. Compare it to how long signing up takes. If the second number is much smaller, you have found your problem.The fee test
Add a typical item to your basket and note the price. Note it again on the final payment screen. Every number that appeared in between should have been visible at the start.The reject test
Open your site in a fresh browser and try to refuse all optional cookies as quickly as you can. Count the clicks. Compare to accepting.
None of these require a lawyer, a budget, or a quarter of planning. They require thirty minutes and a willingness to find something you would rather not.
