Got To Glow

Your two year old washing machine stops draining. You dig out the receipt, and the retailer tells you the manufacturer's warranty ran out last month, so there is nothing they can do. That answer has always been wrong inside the EU. From 27 September 2026 it also gets harder to give, because the EU legal guarantee notice has to sit on the product page you bought from, in colour, before you click pay.

Why the EU legal guarantee notice matters now

The notice matters because the right it describes was already law and almost nobody used it, and a rule that forces the wording onto the product page removes the retailer's most reliable excuse.

The underlying cover is old news. Anyone buying goods in the EU gets a minimum of two years of protection from the seller, counted from the day the goods arrive, and that has been settled law for years. What was missing was any duty to say so at the moment it would change a decision. Commission Implementing Regulation (EU) 2025/1960, adopted on 25 September 2025, fixes the wording and the artwork. Directive (EU) 2024/825, the Empowering Consumers directive, supplies the legal hook, and Article 22a of the Consumer Rights Directive is where the display duty actually lands.

The interesting part is who this disciplines. Not the manufacturer. The legal guarantee is owed by the shop that took your money, so putting the notice on that shop's own product page strips out the "contact the manufacturer" deflection that has done most of the damage. We have seen the same shape before, in the way UK statutory cover beat provider policy on Buy Now Pay Later refunds, and again in the state by state cancellation patchwork that replaced the federal click to cancel rule. The cover existed. The disclosure did not. The gap between the two is where shoppers lost money.

And there is real money in that gap. The European Consumer Centre in Spain, run under the Ministerio de Consumo, reported recovering roughly 700,000 euros for consumers across its 2025 caseload, almost all of it on rights those consumers already held before they complained. Read the four figures below as what this rule is worth in practice, not as a summary of what it says.

The repair extension is the one worth planning around. Pick a repair rather than a replacement while you are still inside the statutory window, and the clock restarts far enough that a second failure of the same part still lands inside cover. Retailers push replacement because it closes the file and ends their exposure. Convenient for them. It can quietly cost you the extension.

What is the legal difference between warranty and guarantee?

A warranty is a promise a company chooses to make and writes the terms of itself. A guarantee, in EU law, is the cover the seller owes you whether or not anybody promises anything at all.

That distinction is exactly what the two new on-page items are meant to separate. One is a notice about a right. The other is a label about a product claim. Confusing them is how shoppers get talked into paying for protection they already have, so it is worth seeing the two side by side before the notice starts appearing.

Read down the first column and the practical rule falls out on its own: the legal guarantee is the one you can rely on without reading anything, and the labelled one is the tie breaker between two products that both already carry it. Neither replaces the other, and a seller who implies otherwise is selling you something.

Is a guarantee legally binding, and where does it fall short?

Yes, both kinds bind, but they bind different people in different ways, and the gaps that will annoy shoppers most sit in enforcement and in what this new notice deliberately leaves out of scope.

Line up the four 2026 dates and something becomes obvious that none of the source documents says outright. Transposition in March, an easy cancel button in June, a repair duty in July, the guarantee notice in September. Four separate consumer obligations landing inside a single six month window, which is the fastest run of retail-facing rule changes the EU has shipped in years. That pace is the story, and it is also the reason compliance will be uneven for months after each date.

Scope is the other soft spot. The notice is about goods, so it says nothing useful when the thing that failed was a service, an app, or an automated purchase you did not personally make. That last category is growing fast, and the question of who pays when an AI shopping agent buys the wrong thing sits well outside anything a guarantee notice can answer. The same is true for connected home devices that stop working when a cloud service is withdrawn, where the hardware is fine and the failure is somewhere else entirely.

• A missing GARAN label tells you nothing about build quality. Producers opt in, and plenty of durable products will never carry one.
• Second hand goods can be cut to a one year floor, but only where the seller discloses that clearly before you pay.
• Enforcement runs through injunctions brought by competitors and qualified consumer organisations, not through a hotline that fixes your washing machine this week.
• A trader outside the EU selling into it is still a distance seller. Marketplaces are in scope, which is precisely where compliance will slip first.

Do one thing this week. Open the last expensive thing you bought online, find the seller's returns and guarantee page, and check whether it still points you at the manufacturer. If it does, that page has three weeks left to be correct, and knowing it is wrong is what turns a shrug at the service desk into a claim the seller has to answer.

The email lands on a Friday. Apple TV is going from $12.99 to $14.99 a month, the fourth rise in four years, and you decide you have had enough. You open the app, tap through to your subscription, and land on a page offering you three months at half price. Cancel is in there somewhere. It is just never sitting where the discount is.

Why It Matters

The rule everyone remembers was real, and then it wasn't. The FTC finalised its click-to-cancel rule in 2024, and on July 8, 2025 the Eighth Circuit vacated it, not on the merits but because the agency had skipped a preliminary regulatory analysis the law required. A paperwork failure. Years of drafting undone by a procedural step nobody outside the agency was watching.

The FTC hasn't given up on it. In March 2026 it opened an advance notice of proposed rulemaking to build the thing back, and the comment window shut on April 13, 2026. Rulemaking of that kind runs in years. In the meantime the agency keeps suing under the older Restore Online Shoppers' Confidence Act, which still requires a simple mechanism to stop a recurring charge, and it has teeth: the FTC's own September 2025 announcement put its Amazon Prime settlement at $2.5 billion, the largest the agency has ever secured, over sign-up flows and cancellation paths it called deliberately obstructive.

So the federal floor is enforcement after the fact, case by case, years late. The actual rules about clicks and notice windows have moved to the states, and the better ones have gone well past disclosure into the mechanics of the exit itself: how many steps, how much warning, whether a retention offer is allowed to sit between you and the cancel button. It is the same fragmentation that shows up in how refund rights split between the UK and the US on device financing, and it produces the same result. Two people paying the same company the same money have different rights.

That first number is the one worth memorising. New York doesn't only require a warning before a price rise, it gives you a short run of days after the higher charge actually lands to leave and take back the unused portion. Most people spot an increase on the statement, not in the email that announced it three weeks earlier. The law is written around how people behave rather than how they are supposed to behave, which is rarer than it should be.

Where Your Rights Actually Come From

Read this as a map of leverage, not a legal opinion. The question is never whether a company is behaving badly, it is which specific obligation you can point at when you write the complaint. Find your row, then quote it back to them.

The pattern in that table is worth naming. The strong provisions are the boring procedural ones, notice windows and step counts, because those are the only things a regulator can measure without arguing about intent. Nobody wins a fight about whether a cancellation flow felt manipulative. Everybody wins a fight about whether a reminder arrived 12 days before renewal when the statute said 15.

Friction Points

Here is the part the compliance blogs skip. A patchwork does not give everyone the strongest rule, it gives every company a map. Large subscription businesses run geo-detection already, and the rational move is to build the compliant flow for California and New York and serve the old one everywhere else. Smaller merchants do the opposite and overcomply nationwide because writing 25 versions of a cancel page is absurd. My read is that the patchwork has been quietly good for consumers in strict states and slightly worse for everyone else, which is not the outcome anyone campaigning for these laws intended.

Second problem, and this one is yours to manage. Almost none of these statutes cover the subscription you bought through an app store. The billing relationship sits with Apple or Google, the cancellation flow is theirs, and the merchant you are angry with genuinely cannot cancel it for you. The same routing confusion turns up in who carries the loss when an AI agent buys the wrong thing. Knowing which party actually holds the switch is most of the battle.

• A retention discount you accept usually restarts the clock, so the renewal notice you were owed next month may no longer be owed.
• Annual plans are where the notice rules bite hardest, and also where most people forget they are enrolled until the charge clears.
• A cancellation confirmed only on screen and never by email is not evidence, and support systems lose it with impressive consistency.
• Calling your bank to block the charge before you have formally cancelled can leave the contract alive and the debt accruing.

Do one thing this week. Open your card statement, find every recurring charge you cannot immediately justify, and cancel the ones that fail, starting with anything on an annual renewal. Do it now rather than at renewal, because the notice windows that protect you only help if you are watching the calendar, and the company running the cancel page is not going to remind you twice.

The Xbox got more expensive this month. The financing offer sitting next to it at checkout did not. That pairing is the whole story of consumer electronics this year: the hardware costs more, and the company selling it would very much like you to spread the damage across a few instalments instead of walking away.

Instalment plans at the point of sale used to be a fringe option for clothing. Now they are a default button on consoles, laptops, phones and televisions. And the protection attached to that button is not what most buyers assume it is.

Why It Matters

Start with the price pressure, because it explains the timing. Microsoft announced on 25 June 2026 that the 512GB Xbox would rise by $100 from 1 August, its second increase in under a year, and said storage and memory costs had gone up two and a half times over. In the same announcement it offered Buy Now Pay Later, interest-free financing and cheaper refurbished units. That is a company reading its own demand curve correctly. Fewer people can absorb the new sticker price, so the sticker price gets broken into pieces.

Breaking a price into pieces is not automatically a bad deal. Four payments at zero interest beats a credit card balance you carry for eight months, and for a lot of households it is the difference between replacing a dead laptop now and going without. The problem is what quietly changes when you press that button instead of the card one. You are no longer making a card purchase with decades of dispute law wrapped around it. You are taking out a small loan from a company whose refund policy is, in most markets, its own invention. This is the same structural gap that shows up when software starts spending on your behalf, which is why who pays when an AI shopping agent buys the wrong thing is still an open question.

The rules moved after the meter did, the same sequence that played out when usage-based AI billing reshaped the software budget. Two things happened five weeks apart that pulled the two biggest English-speaking markets in opposite directions. In the UK, the Financial Conduct Authority began regulating Deferred Payment Credit in mid-July 2026, which brings affordability checks, Section 75 refund cover through the lender, and access to the Financial Ombudsman Service. Agreements signed before that date stay unregulated, so the plan you took out in June carries none of it. In the US, the Consumer Financial Protection Bureau revoked the interpretive rule that would have treated these plans like credit cards for dispute purposes, and confirmed it would not issue a replacement. Same product, same app, opposite floors.

The late-payment figure is the one worth sitting with, because it is not describing people in financial trouble. Default rates stay low. What it describes is a repayment schedule that does not line up with how anyone actually gets paid, running quietly in the background while three other schedules do the same thing. Miss one and the cost is a flat fee rather than interest, which sounds gentler and often is not, because a fixed fee on a small balance is a brutal effective rate.

What Each Payment Method Actually Protects

Below is the comparison nobody selling you a plan is going to put on screen. It covers the three ways most people pay for a device that costs real money, judged on what happens when the thing arrives broken, never arrives, or turns out to be nothing like the listing.

Read down the dispute-route row and the pattern is obvious. The instalment plan is the only column where the company you are complaining about and the company deciding your complaint answer to the same commercial pressure. That is not fraud. It is just a worse seat at the table, and it costs nothing at the moment of purchase, which is exactly why it is easy to miss.

Friction Points

The credit-file question is where honest people disagree, and I am not going to pretend it is settled. Putting short instalment plans into credit files could finally give thin-file borrowers a way to prove they repay things, which is the industry's argument and a decent one. It could equally turn a forgotten $40 payment into a score event that follows someone for years, on a product marketed as too small to matter. Both futures are plausible right now, and anyone claiming certainty is selling something.

The second friction is a design problem, not a policy one. These plans are approved in seconds, at the moment your resistance to spending is lowest, on a screen that shows the instalment and not the total. Stack three of them across three retailers and no single provider sees the whole picture. That is a familiar shape if you have ever compared subscription tiers and found the real cost buried two clicks deep, the way the family sharing fine print in Google One and OneDrive hides who is actually paying for what.

Watch for these specifically:

• The pre-regulation gap. A UK plan opened before the new rules took effect is not covered by them. Check the agreement date before assuming Section 75 applies.
• Refunds that go to the wrong place. Money can be returned to the provider while your instalments keep running. Confirm the plan is cancelled, not just that a refund was approved.
• The unfamiliar-seller trap. Instalment plans are heavily promoted on low-cost gear, which is precisely where quality disputes cluster, and where cheap televisions from brands you have never heard of tend to go wrong.
• Late fees that outrun interest. On a small balance, one flat fee can beat a month of card interest. Do that arithmetic before choosing.

Pick the payment method by what could go wrong, not by what the checkout screen nudges you toward. Expensive item, unfamiliar seller, shipped rather than carried home: use the card, take the dispute rights, clear it in full. Everything else is a cash-flow decision you can make on the merits. Before the next big purchase, open your instalment app and count how many plans are already running. That number is the answer to a question most people never ask themselves.

Related: what the new EU legal guarantee notice gets you from 27 September 2026

The agent bought the wrong size. Not the wrong item, not a scam, just a size 9 where you needed an 11, ordered at 2am while you slept, paid for with a token your card network minted specifically so software could spend without asking you first. You call the bank. The bank asks who authorised the transaction. And that is the moment you find out nobody has written the answer down.

Why It Matters

For thirty years, consumer payment protection has rested on a single question with a clean answer: did you authorise this charge? Say no, and a whole machinery of chargebacks, provisional credits and liability shifts spins up on your behalf. That machinery assumes a human at a keyboard. It has no category for a purchase you approved in principle, months ago, in a settings pane, executed by software you have never met on terms you did not read.

And the money is not waiting. Visa published its Trusted Agent Protocol on 14 October 2025, a cryptographic scheme letting a merchant tell a legitimate shopping agent apart from a scraper. Mastercard's Agent Pay binds a tokenised card credential to one specific agent, one merchant scope, one consent policy. Amex went further and shipped a developer kit with an actual promise attached. The rails are built, tested and open. The consumer-protection layer is a blog post from a payments vendor and a lot of hopeful language about "emerging frameworks."

This is a familiar shape if you have been reading along. It is the same trick as the switch from flat AI subscriptions to metered billing, where the pricing model changed underneath people who were still budgeting on last year's assumptions. It is the same omission as Apple Creator Studio shipping without the storage its own workflow requires. The capability arrives first, fully funded and beautifully marketed. The thing that protects you arrives later, if the complaints get loud enough.

Here is the scale, because the numbers explain why nobody is slowing down to sort out the liability question first.

That trust figure is the one worth sitting with. Forrester's survey found roughly a quarter of US online adults willing to let an agent buy on their behalf, which means the overwhelming majority looked at the pitch and declined. The rails were built anyway, because the forecast that actually moves boardrooms is the business one, and Gartner's projection of $15 trillion in agent-run B2B purchasing by 2028 does not care whether retail shoppers are comfortable yet. Consumer adoption is expected to follow the plumbing rather than lead it. That is a bet, not a finding, and it is being placed with your card as the chip. You already know how a cheap device with delegated credentials behaves once someone finds it: the credential is the whole attack surface, and now the credential can buy things.

What Actually Exists Right Now

Strip out the press releases and the picture is narrow but readable. There is one real, written promise on the consumer side, a set of identity plumbing that helps merchants more than it helps you, and a legal vacuum where the rest should be.

Read the Amex row against the Fraud Gap row and the shape of the promise gets clear. Covering agent error is a quality guarantee on their own software. It is not a fraud guarantee, and payments people have been saying so since the announcement, drawing the parallel to Apple Pay's 2014 launch, where tokenisation worked exactly as designed and criminals simply loaded stolen identities onto devices instead. The rails did their job. The gap moved upstream.

Fourteen months separates Mastercard's first Agent Pay announcement from always-on machine payments going live, with the two card networks joining Google's AP2 protocol in between and Amex adding the first error guarantee. No consumer-protection statute landed anywhere in that window.

Friction Points

The genuinely unsettled question, and I do not think anyone has a defensible answer yet, is whether an agent's mistaken purchase is legally an unauthorised transaction at all. You authorised the agent. You did not authorise that purchase. Existing law was drafted for a world where those two things were the same event, and reading a decades-old consent regime onto delegated software is going to produce results that satisfy nobody. My own view is that "unauthorised" will end up defined narrowly, in the card networks' favour, unless a regulator forces the issue early. But that is a prediction, not a finding, and I would not build a spending plan on it.

Meanwhile the practical failure modes are already visible, and none of them require a criminal. An agent misreads a variant. A price changes between the plan and the checkout. A subscription renews inside a delegated scope you forgot you granted, the same way a shared family plan quietly extends permissions past the person who set it up. Watch for these:

• Spending caps that apply per transaction rather than per month, so an agent can make forty compliant purchases and still empty the account.
• Merchant scopes granted broadly at setup, because the narrow option made the agent useless in testing and nobody went back to tighten it.
• Dispute windows counted from the transaction date, not from the day you noticed, which matters more when a machine is buying while you sleep.
• Return policies written for human buyers, where "changed my mind" is refused and "the agent picked wrong" is not a category the support script recognises.

Open your card issuer's app this week and find out, in writing, what it says about purchases made by an AI agent. If the answer is nothing, that is your answer: the protection you are relying on does not exist yet, and the rails that let software spend your money are already live. Delegate small amounts to a card you can afford to have go wrong, and let somebody else be the test case.

My GitHub Copilot bill read $10 for as long as I had used it. The first month after the meter switched on, it read $47. Nothing about how I worked changed. The pricing model underneath me did. This June, GitHub retired flat-rate Copilot plans and moved every tier to metered AI Credits, and I turned into one more person watching a predictable line item mutate into a variable one. That switch is not a Copilot quirk. It is the leading edge of how software companies plan to charge for anything with a model humming behind it.

Why It Matters

The cheap subscription you got used to was never the real price. It was a market-building exercise funded by venture money, not a reflection of what these models cost to run. OpenAI is projected to lose $14 billion by 2026 keeping the lights on at consumer rates. That math does not hold, and the industry knows it. So the meter arrives. Instead of one flat fee, you get a small bundle of included usage, and then the counter starts ticking on every request past it.

Google is playing the opposite hand to muddy the picture, cutting AI Plus and doubling its storage to look generous while the pay-per-use tiers climb around it. New assistant tools now launch at $30 to $50 a month rather than the old friendly anchor. And the reason is not greed alone. It is that a heavy user and a casual user cost the provider wildly different amounts, and one flat price cannot serve both without someone getting fleeced. Because a single number hides that gap, the meter is the honest correction. It is also the one that stings.

Here is what the shift looks like in raw figures, so you can size the exposure before it hits your card.

Look hard at that bundled allowance. It sounds comfortable until you realize a few dense afternoons of AI-assisted work can drain it, and once the included credits evaporate, every further prompt bills straight to your account at listed model rates. Code completions stay free, which softens the blow, but the model-heavy work you actually pay a subscription for is exactly the work that now runs the counter.

The New AI Pricing Menu At A Glance

Different vendors are pulling different levers, so the only way to plan is to lay the current terms side by side and read them cold.

Read across those rows and one thing lands: usage-based AI pricing is not a single company's experiment anymore, it is the direction the whole market is walking. The flat plans that survive, like the $20 anchor, are the exceptions being used as bait, and even those carry quiet caps you only discover when you hit them.

The top Copilot tier now stretches to a 20,000-credit ceiling, which shows just how far the meter is built to scale once your usage climbs past the bundle.

Where This Bites

The trap is not the meter itself. It is the gap between how you budgeted and how you actually work. Under a flat plan you never had to think about a single heavy prompt. Now a long refactor, a batch of image generations, or a research binge each carries a running cost, and most people have no instinct yet for what a token is worth. The bill arrives after the behavior, so you learn the price only once it is already charged.

There is no clean fix here, and anyone selling you one is guessing. Flat pricing overcharged the light user to subsidize the heavy one. Metering flips that unfairness in the other direction and hands the volatility to you. Both models are honest about something and dishonest about something else. Watch for these traps as the meter spreads:

• Bundled credits that look generous but drain inside a few intense sessions, then bill silently at full rate.
• Fallback to a cheaper model quietly removed, so hitting your cap now means paying up rather than downgrading.
• Storage bumps and price cuts dangled as goodwill while the real money moves to per-token charges you barely notice.

Set a hard budget cap inside every AI tool that offers one, check the usage dashboard weekly rather than monthly, and treat the included allowance as a floor you will blow past, not a ceiling you will coast under. Assume your quietest month is the exception and your busiest month is the invoice you should plan for.

Pull up your current AI subscriptions this week and find the usage meter on each one before your next billing date decides the number for you. The flat-fee era gave you a comfortable lie; the metered era gives you an uncomfortable truth, and the only people it wrecks are the ones who keep budgeting like it is still last year.

Your Network Is Currently An Open Floor Plan

The Bottom Line

Why Flat Networks Get Gutted And Segmented Ones Survive

What The Marketing Brochures Promise Versus What Actually Happens

Where Most Homeowners Sabotage Their Own Defenses

• Treating the guest network as an afterthought
  • Most routers ship with a guest SSID that still allows devices to talk to each other. That defeats the entire purpose of isolation.
  • Log into your router settings and toggle on “AP Isolation” or “Client Isolation.” This forces every connected gadget to communicate only with the internet, never with neighboring devices.
  • Test it by pinging one smart plug from another on the same guest band. If the ping succeeds, your isolation settings are broken.
• Hardcoding credentials into companion apps
  • People reuse their email password for three different smart lighting apps. One data breach at a cheap vendor hands attackers the keys to your primary accounts.
  • Generate a unique sixteen-character password for every single IoT service. Use a password manager to store them. Never type them manually.
  • Enable two-factor authentication on the vendor accounts themselves. The camera feed is useless if the attacker cannot bypass the login screen.
• Ignoring DNS-level filtering
  • Your router probably points to your ISP’s default DNS servers, which do absolutely nothing to block malicious domains.
  • Switch your primary and secondary DNS to a filtering provider like NextDNS or Cloudflare for Families. These services maintain real-time blocklists of known command-and-control servers.
  • When a compromised thermostat tries to phone home, the DNS filter returns a dead address. The attack chain breaks before any data leaves your house.
• Leaving UPnP enabled for convenience
  • Universal Plug and Play allows devices to automatically open ports on your router. It was designed for LAN parties in 2004, not for modern internet threats.
  • Disable UPnP in the router admin panel. Manually forward ports only when you absolutely must access a specific service from outside your house.
  • Accept the minor inconvenience of manual configuration. The tradeoff is a firewall that actually behaves like a firewall instead of a revolving door.

Your Next Move Before The Weekend Hits