I'm building a SaaS right now and made the "non-deceptive" choices this law wants: cancellation is one click from settings, no retention maze, no surprise renewal, 30-day money-back. What surprised me is how much the tooling assumes you want the dark patterns. Billing platforms ship "cancellation flow" templates that are really retention funnels — discount offer, pause offer, survey, guilt screen, then maybe the button. The default path is the deceptive path; you have to actively rip stuff out to be straightforward.

Which I think explains why this needs regulation at all. Every individual dark pattern is locally rational — it demonstrably improves net retention, so any PM optimizing a dashboard will keep it. The cost (people who feel trapped and tell everyone) never shows up in the same spreadsheet. Markets are bad at pricing "customers who quietly hate you."

The one-click-cancel requirement is the part with real teeth. Junk-fee rules die by carve-out (see California's restaurant exemption), but "cancel must be as easy as signup" is binary enough to actually enforce.