Revolutionary Information

Here is the rule: when a support bot cannot settle a payment dispute, a person must review it, on request. No law makes ad platforms follow it, and the ad account refund below shows the cost. The objection is that humans cannot scale. But the rule bites only after the bot fails, a far narrower duty than staffing every chat.

Why does an ad account refund need a person?

A bot that can only close accounts cannot weigh an exception, and a closed account leaves the money with nobody to chase it, so a person has to review the dispute.

The owner of this site runs two Meta ad accounts and reports that a $75 top-up landed in the wrong one. Automated support said the only option was to close the account, with the balance refunded automatically. Only an AI assistant was reachable, so the owner closed it. Three months on, no refund has arrived, and a new AI ticket says the payment mode is non-refundable. That is the owner's account, unconfirmed by Meta; its own pages blocked our reader, so we could not check them.

In January 2026, PPC Land reported an advertiser whose Meta chat said 'We're connecting you with an agent who can continue to provide the help you need.' Per the report, no agent joined and Meta did not comment. One case is not a rate, but it shows the loop.

On 2 November 2026 a Meta Verified subscriber wrote on Meta's community forum that paid support gave them a chatbot, and asked for 'A real support representative, not another chatbot.' One voice, a consumer product, but the same company and failure.

Four figures size the gap: a wait, an interest cost, a rule count and a ratio. PPC Land supplied the wait; we did the rest. Statutes can write a clock when they want to, as the CRA reporting clock for vendors shows.

Take the interest figure. It is tiny, or rather tiny to everyone except the person it belongs to. Only an obligation with a date on it moves a balance that small, and we would keep our own paper trail, the logic behind a year of audit-log retention.

Is there a law that gives you the right to talk to a human?

Partly: EU law gives a right to a human on request for distance financial services, and a human check on complaint decisions about accounts, but no rule we read covers an advertiser's stuck balance.

We checked Directive (EU) 2023/2673, the Digital Services Act, Regulation (EU) 2019/1150, India's IT Rules 2021 and E-Commerce Rules 2020 on three tests: does the text force a human, cover a payment dispute, and reach a business buyer? This is our reading, not legal advice.

Each rule stops one step short of the balance: the EU gives a human for the closure, not the money left; India gives a clock, probably not to business buyers. The CFPB's June 2023 report on consumer-finance chatbots names customers left without an 'offramp to a human customer service representative', but it is a report, not a rule.

Worked example: take the owner's case on three assumptions: a $75 balance, three months counted as 91 days, and a 6% yearly rate for idle money. With simple interest on calendar days, 75 × 0.06 × 91 ÷ 365 = $1.12. That wait is 76 days past India's 15-day clock. Try your own balance and days below.

Does a human duty on payment disputes scale?

In our view the objection overreaches, because a duty that applies only to payment disputes the bot has already failed to settle, and only on request, is far narrower than staffing every chat.

The law already draws this line narrowly. Article 16d gives a consumer 'a right to request and to obtain human intervention' when a trader uses online tools; the Digital Services Act bars complaint decisions made 'solely on the basis of automated means'. Both trigger on request or complaint.

A second objection is fraud. But review is not payout: a person can still refuse. We made the compulsory-versus-voluntary case in our look at the default password ban and why labels fail.

One grey area, and it is opinion: should a business buyer get a consumer's redress? We think a prepaid balance deserves it.

• Closing on a bot's instruction can leave you with no account to complain from; ask in writing what happens to the balance first.
• Check a promised refund against your card statement; card issuers set their own dispute windows.
• Keep every transcript and screenshot yourself. A platform's retention is its choice.

The decision this week is how much money you leave sitting in any ad account. Keep it near what you will spend soon, and never close an account that holds a balance until a person confirms in writing where it goes. If a balance is already stuck, send one written complaint naming the amount and every ticket number, and ask for a human reviewer; if the platform closed your EU account, cite Article 20 of the Digital Services Act. This fails where a small top-up would stall a campaign, so check your billing threshold first. Next read: security.txt and who compels it.

Here is the rule: any company that sells phones in a country must also sell that country's owners the parts and manuals to repair them. Self service repair india shows why. An iPhone owner in Madurai with a cracked screen gets Apple's fee or a shop's guess at the right part.

Why does self service repair india need a law?

Because Apple sells repair parts, tools and manuals to individuals only in countries it picks, and India's Right to Repair portal relies on voluntary signing, so no Indian buyer holds a right to cite. India is also not the only market left out. Apple's release of 28 May 2025 placed Self Service Repair in Europe, the UK and the US, with Canada next, so Australia, Japan and every other market share the gap.

Apple built the other half. In March 2021 it said its Independent Repair Provider programme would reach more than 200 countries with genuine parts and manuals (or rather, for shops that qualify), and India TV reported that India was included. A qualifying shop in Salem can buy what its customer cannot, much like end-of-support dates hidden from buyers: facts that decide a phone's life stay with the maker.

India's answer so far is a portal. The India.gov.in Right to Repair page lists mobile phones and tablets among four initial sectors and states no duty to supply parts or manuals. The Press Information Bureau said on 29 August 2024 that the portal depends on voluntary onboarding, with 23 mobile and electronics firms then signed up. Compulsion is possible: the UK has made default passwords illegal since April 2024.

Four numbers show the thin footing: Apple's August 2025 statement, the ministry's 2022 plan as TechCrunch reported it, and Cashify's September 2026 report of Apple India's prices.

Where one seller controls the part, the fee is whatever it says and a buyer cannot test it. Abroad, Apple publishes the part price; in India it shows only the finished fee.

Which markets give owners an enforceable right?

Of the markets compared here, only the EU backs repair access with an enforceable duty on makers: its ecodesign rules require critical parts to stay on sale, while Apple's store and India's portal rest on voluntary participation.

The European Commission's smartphone page sets the benchmark: critical parts within 5 to 10 working days, from 20 June 2025.

Only the first row is a legal duty. Every other row depends on a company choosing to take part, which is exactly what a rule removes.

Worked example: an iPhone 18 Pro owner needs only a battery. Apple India charges ₹13,900 (reported 19 September 2026). Apple's US store charges $129 less a $61.92 old-battery credit (GSMArena, 20 October 2026), plus a $49 seven-day toolkit rental (MacRumors, October 2025), at ₹95 to the dollar, our assumption. So $129 minus $61.92 is $67.08, plus $49 is $116.08, times 95 is ₹11,028: a saving of ₹2,872. Add the screen in the same week (₹36,900 at Apple India per Trak.in; $329 less $16.45 abroad) and the kit is paid once, so the saving grows to ₹10,080. US prices exclude tax, duty and shipping.

What are the objections to a repair-access rule?

Three objections come up: low volume, safety and warranty, and each is answered by what Apple already does elsewhere, though the rule still needs limits because it guarantees access to parts, not a lower price.

Low volume is the weakest: Apple built a shop channel in India in 2021, so the supply chain exists. Safety is real for swollen batteries and argues for conditions. Apple's store credits the old battery, pulling used cells into a collection channel, and our call is that a law should require the same plus a manual that opens with the safety steps. Skip the manual and you get the alternative: an iPhone 13 owner on r/IndiaTech wrote in late 2025 that a local shop fitted an aftermarket battery for ₹3,000 and the phone then showed an Unknown Part message. One user's account, no survey.

Warranty is a drafting question: a rule can keep cover on the rest of the phone intact after a genuine-parts repair while excluding damage the repair caused. Makers can be bound on this front, as when several Gulf and Asian authorities made banks move logins off SMS codes.

Check this first: open Settings, Battery, Battery Health and read the capacity. Apple's India battery page, read on 31 October 2026, says a battery under 80% is replaced free with an Apple care plan.

• Parts access is not a price cap.
• A US price is a guide, not an Indian quote.
• Our view: publish part prices, do not cap them.

Decision: unless the Battery Health check shows your repair is free, pay Apple's fee for a phone you will keep and use a shop only for one you will soon replace, then write one line this week to the Department of Consumer Affairs, which runs the Right to Repair portal, asking for a legal duty on any phone seller in India to supply parts and manuals.

Related: ad account refund rules and the case for a human reviewer

Every cloud provider should keep its customers' security audit logs for twelve months, free, by default. Picture why. A responder opens the audit search on a breached tenant, scrolls back for the intruder's first sign-in and hits the end of the window. Nothing before it is hidden; it was deleted on schedule. Short default audit log retention does that every day, and the objection to fixing it, storage cost, collapses once you price the storage.

Why should audit log retention be a full year?

Because the average breach is noticed about six months after it starts, a free window shorter than a year deletes the attacker's first moves before anyone goes looking for them.

IBM's Cost of a Data Breach Report 2026, as summarised by Secureframe, puts the average time to identify a breach at 183 days. Free windows are shorter. Microsoft raised Purview Audit (Standard) retention to 180 days from October 2023; Premium keeps a year. AWS's CloudTrail event history shows 90 days of management events at no charge. On our arithmetic, an average breach is found three days after a Standard tenant's first entries expired, and 93 days after an AWS account's with no trail. The part you lose is the part showing how they got in.

Storm-0558 showed the cost. In mid-2023 the State Department caught Chinese intruders in its Microsoft 365 mail through MailItemsAccessed, a record The Hacker News reported was then typically Premium-only. Microsoft freed it after the fact. One breach fixed one vendor's tier and set no rule, the same gap as CISA's memory safety roadmap, a deadline nobody is bound by, while duties like the Cyber Resilience Act's 24-hour early warning assume the evidence still exists.

Four numbers settle whether a year is excessive, drawn from IBM's 2026 report via Secureframe, Google's observability pricing page (as of October 2026), Microsoft's 2023 expansion and our own division of AWS's window by IBM's detection time.

The zero should embarrass everyone else. Google keeps admin and login audit records past the one-year mark for every project and bills nothing, so free year-long retention is plainly not commercially impossible.

The federal rule moved too. OMB memo M-26-14, dated 22 May 2026, rescinded M-21-31, whose 12 months of active storage plus 18 months cold gave way to six months searchable and a year retrievable, per the memo's own appendix. Even trimmed, the government kept a year (retrievable, granted, not searchable), which makes a one-year vendor default look modest.

How long do Microsoft 365, AWS and Google keep audit logs for free?

Microsoft 365 Standard keeps six months, AWS's event history keeps three, and Google keeps admin activity for just over a year, so only one of the big three already meets the rule argued here.

The table sets those windows beside the two rules that already demand a year. PCI DSS v4.0.1 requirement 10.5.1 requires 12 months of audit log history, the latest three immediately available, as Microsoft's PCI guidance quotes it. Find your row and compare the last column with your own detection time.

Only Google clears the bar by default, and only for admin activity: Data Access logs keep 30 days, per Google's storage documentation. The grey area, in our opinion rather than any rule: logs needing a restore should not count as retained for the first three months of an incident.

Worked example: an AWS account with no trail keeps the 90-day event window and writes about 2 GB of audit events a day. Assumptions: S3 Standard at $0.023 per GB-month, the US East first-50-TB rate listed in October 2026; storage only, no compression, no ingest or query fees. Reaching 365 days means 275 more days, so 550 GB more at steady state. 550 × $0.023 = $12.65 a month, about $152 a year, or roughly 2.5 cents per person monthly at a 500-person firm, to close a 93-day blind spot. Your version is one subtraction, detection time minus window, and it belongs in your next renewal.

Where does a one-year default still fall short?

It falls short wherever the expensive part is search rather than storage, wherever logs hold personal data that privacy law says to delete, and wherever an intruder stays hidden for longer than a year.

Storage is the cheap part. SIEM ingest and hot search are where bills grow, and a vendor default changes neither. We would write the rule the PCI way: a year kept, a quarter searchable.

Privacy cuts the other way. Audit records carry user names and IP addresses, so the GDPR's storage limitation principle means a provider must justify the year and lock it down. Voluntary fixes have a poor record, as with default passwords, which lasted until the UK made banning them law.

• Microsoft's longer retention follows each user's licence, so mixed tenants keep mixed windows.
• AWS event history skips data events such as S3 object reads; only a trail records them.
• Exports need deletion protection, such as S3 Object Lock, or an admin-level intruder can erase them.
• Auditors wanting immediate access may reject logs that need a restore.

Make the rule yours before a regulator makes it everyone's. This week, find the oldest event your audit tool returns; if it is under a year old, export to locked cold storage and write a free one-year retention default into your next cloud contract.