Click-to-Cancel Rule Vacated: Subscription Rules That Still Apply

With the click to cancel rule vacated, ROSCA, state auto-renewal laws and Visa rules still govern subscription consent and cancellation. See what to fix.

Adrian ReyesSenior Payments & Fintech Editor

November 10, 2026 · 9 min read

Photo: Pixabay

On this page 6 sections

What Happened When the Click-to-Cancel Rule Was Vacated
ROSCA Compliance for Subscriptions Never Paused
California Automatic Renewal Law 2025: The Strictest Rules Most Merchants Face
Subscription Cancellation Requirements From Visa and Mastercard
Why an Easy Cancel Button Costs Less Than a Dispute
A Subscription Compliance Checklist for Monday

Key takeaways

The Eighth Circuit vacated the rule because the FTC skipped a required preliminary regulatory analysis. The FTC restarted rulemaking in March 2026, and no proposed rule had been published as of September 2026.
ROSCA still governs subscriptions sold online. The FTC is also bringing the vacated rule's core requirements as Section 5 complaints, without needing the rule.
For contracts from July 1, 2025, California requires separate consent to renewal terms and online cancellation for online sign-ups. Consent records must be kept at least three years.
A $1 intro week or a free first month brings in Visa's seven-day reminder and online cancellation rules, even when the member signed up in person.

With the FTC's click-to-cancel rule vacated before it took effect, subscription merchants still have to follow other rules on consent and cancellation. On July 8, 2025, the U.S. Court of Appeals for the Eighth Circuit struck down the FTC's amended Negative Option Rule, six days before most of it would have become enforceable. Because the ruling turned on procedure, the duties underneath it survived. The Restore Online Shoppers' Confidence Act (ROSCA) is federal law, and it still requires consent and a simple way to cancel. California and other states add their own requirements, and Visa and Mastercard enforce theirs through your merchant agreement. The FTC also restarted rulemaking in March 2026.

What Happened When the Click-to-Cancel Rule Was Vacated

The FTC finalized its amended Negative Option Rule in late 2024. At its center was a simple demand: cancelling had to be at least as easy as signing up. Sellers would also have had to disclose material terms and get express informed consent before billing, then keep consent records for three years. After the Commission voted to delay enforcement, most provisions were due to take effect on July 14, 2025.

Trade groups and businesses challenged the rule, and the cases were consolidated in the Eighth Circuit as Custom Communications, Inc. v. FTC. The panel decided the case on process. It did not rule on whether easy cancellation is good policy. Section 22 of the FTC Act requires a preliminary regulatory analysis for any rule with an estimated annual economic effect of $100 million or more.

The FTC had estimated its rule would fall below that line. An administrative law judge later found the impact would exceed it, yet the Commission still issued only a final analysis. In the court's view, skipping the preliminary step denied businesses a fair chance to comment on costs and alternatives, so it vacated the entire rule. The full Eighth Circuit opinion in Custom Communications v. FTC is on Justia.

Several law firms predicted at the time that the Republican-majority Commission would let the rule go. It didn't. On March 11, 2026, the FTC announced an advance notice of proposed rulemaking (ANPRM) on negative option plans, published in the Federal Register on March 13, 2026. That notice asks whether the agency should bring back provisions from the vacated rule.

Comments closed on April 13, 2026, and as of September 2026 no proposed rule had been published. Until a new rule clears the full process and any court challenge, no federal click-to-cancel rule is in force. What remains is the FTC's original 1973 rule. It covers only prenotification plans, where a seller ships goods to enrolled members and charges for them unless the member declines in advance.

ROSCA Compliance for Subscriptions Never Paused

When the FTC negative option rule was struck down, the statute it relied on was left untouched. ROSCA (15 U.S.C. §§ 8401–8405) is federal law covering subscriptions sold online. A seller must clearly and conspicuously disclose all material terms before collecting billing information. It then needs the customer's express informed consent before the first charge. On top of that, it has to give customers a simple way to stop recurring charges. Memberships signed on paper at a front desk fall outside ROSCA, though Section 5 of the FTC Act and state laws still reach them.

Most of the vacated rule spelled out those duties in more detail, and the FTC has kept enforcing the duties themselves. Its biggest case came on September 25, 2025, when the agency announced a $2.5 billion settlement with Amazon over Prime enrollment and cancellation. That total combined a $1 billion civil penalty for alleged ROSCA violations with $1.5 billion in consumer redress. In 2025 the FTC also sued Uber under ROSCA over its subscription program, and in early 2026 it brought a case against JustAnswer over enrollment practices.

For a small merchant, the NextMed complaint matters more than Amazon's headline number. According to Jones Day's analysis, the FTC alleged that the company failed to disclose material terms, charged without express informed consent and made cancellation deliberately difficult. The agency framed those as violations of Section 5 of the FTC Act. In other words, it enforced the vacated rule's core requirements without the rule. If your cancellation flow would have failed the 2024 standard, assume it can still draw an FTC complaint.

California Automatic Renewal Law 2025: The Strictest Rules Most Merchants Face

State law is where the detailed requirements live today. When the rule was vacated, Greenberg Traurig noted that more than half the states have automatic renewal laws, many of them as strict as the federal rule or stricter. For most national sellers, California's law matters most. It applies to any business making an automatic renewal offer to California consumers, wherever that business is based.

Assembly Bill 2863 amended California's Automatic Renewal Law (Business and Professions Code §§ 17600–17606). The changes reach any contract entered into on or after July 1, 2025, along with older contracts amended or extended after that date. They also make clear that a free period which rolls into a paid plan is covered. The new requirements:

Separate consent to renewal terms. You need express affirmative consent to the automatic renewal terms themselves, on top of agreement to your general terms of service.
Proof of consent. Keep verification for at least three years, or one year after the contract ends if that is longer.
Online cancellation. Customers who signed up online must be able to cancel "exclusively online, at will," with no steps that obstruct or delay it.
Reminders and notices. An annual reminder has to state the renewal frequency and the amount charged, plus how to cancel. Plans with an initial term of a year or longer need a renewal notice 15 to 45 days before they renew. Price increases need advance notice, which practitioners describe as 7 to 30 days ahead.
Save offers with the exit in view. A retention offer is still allowed, as long as the option to cancel appears at the same time.

Other states set their own rules on save offers and reminder timing, so the states your customers live in matter more than your own. For a state-by-state view, see our guide to what automatic renewal laws require subscription businesses to disclose. This is general information, not legal advice. Confirm your obligations with an attorney who handles consumer protection law.

Subscription Cancellation Requirements From Visa and Mastercard

Card network rules are a separate layer. You accept them through your merchant agreement, so they are contracts rather than laws, and they apply wherever your cardholder lives. A court ruling against the FTC doesn't touch them.

Visa's trial and subscription rules took effect on April 18, 2020. At enrollment, the cardholder must expressly consent to the ongoing subscription. If a trial or introductory price is about to end, or the recurring terms change, the merchant must send a reminder at least seven days before the charge, with a link to cancel online.

Visa also requires an easy online way to cancel, regardless of how the cardholder first signed up. Mastercard's own rules for recurring plans require the terms to appear at checkout and the cardholder to accept them affirmatively. A confirmation email and an online cancellation path are required as well. Mastercard's trial reminder window is shorter than Visa's, so a reminder sent seven days out satisfies both networks.

Your Intro Offer Probably Counts as a Trial

Many owners misread this rule. As Visa wrote it, the requirements are mandatory for merchants whose free trials or introductory offers roll into a subscription. For every other subscription merchant, Visa calls them strongly recommended. A boxing gym's "first week for $1" fits the mandatory category. So does a jiu-jitsu academy's free first month, or a software company's discounted first quarter. If your offer converts to full-price billing, plan on the reminder and online cancellation requirements applying, even when the member signed a paper agreement at the front desk.

Gyms and martial arts studios feel this most, because many still require members to cancel in person or by letter. A gym that sells on an intro offer needs an online cancellation path anyway. Our article on subscription cancellation flows that save customers legally shows how to build one while keeping a reasonable save attempt. If your billing runs on monthly dues and belt testing fees, see our page on payment processing for boxing, combat sports and fitness businesses.

Why an Easy Cancel Button Costs Less Than a Dispute

A member who can't cancel usually still leaves. They just leave through their bank. Visa files those disputes under condition 13.2, "Cancelled Recurring Transaction." Without proof that the customer had a working way to cancel, you have little to fight with. Our breakdown of why subscription renewals get disputed covers the other common triggers.

Here is an illustrative case. Every number in it is an assumption, not data. A martial arts studio bills 400 members $79 a month and requires an in-person visit to cancel. Each month, 5 members who want out stop showing up and dispute their next charge instead. Its processor charges $25 per chargeback. That fee is one processor's price, not a network fee, and yours may differ. Assume the studio loses every one of those disputes.

That adds up to $395 in reversed charges (5 × $79) plus $125 in fees (5 × $25) each month, or $520 a month and $6,240 a year. Those 5 disputes also equal 1.25% of the month's 400 transactions, and your acquirer watches that ratio closely. Our guide to chargeback ratio thresholds that put merchants at risk shows how a number like that compares with network and acquirer limits.

Now give the same 5 members a cancel link. The studio still loses $395 of monthly revenue, but it was never going to keep that money. What disappears is the $125 in fees and the damage to the dispute ratio, along with hours of staff time spent writing chargeback responses. A hard-to-cancel policy doesn't bring in a dollar. It changes only how the money leaves, and the dispute route costs more.

A Subscription Compliance Checklist for Monday

Put renewal terms beside the pay button. Above the card number field, show the price and billing frequency, the date of the first full charge, and how to cancel.
Collect renewal consent separately. Use an unchecked box or a distinct click, and log a timestamp with the exact version of the terms the customer saw. Keep that record at least three years, or one year after the customer leaves if that is later.
Build an online cancel path that works without a phone call or a visit, including for members who joined in person. Any save offer should sit next to one clear choice to leave.
Schedule reminders. Send a notice with a cancel link at least seven days before any trial or intro price converts. If you sell annual plans to Californians, add the state's annual reminder and its pre-renewal notice.
Confirm every cancellation in writing and stop the billing. Check that the stored card token is actually deactivated in your recurring billing software, not just flagged in your CRM.
Map your customers by state. The strictest state your customers live in sets your minimum standard.

If your processor has flagged rising recurring-billing disputes, or you want a second opinion on how your subscription setup is underwritten, request a free quote from MannyPay. A specialist will respond within one business day. After that, keep an eye on the FTC docket. The next formal step is a notice of proposed rulemaking, and when it appears, it will show how much of the 2024 rule is coming back.

Sources

About the author

Adrian Reyes

Adrian Reyes is Senior Payments & Fintech Editor for Beyond the Swipe, covering credit card processing, merchant accounts, payment technology and processing fees.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.