Click-To-Cancel: The Rule Was Vacated And The Rules Still Apply

Why This Article Exists

A rule getting vacated is a clean, quotable event. It produces headlines. The continuing applicability of a 2010 statute produces nothing, so it does not get written about, and the resulting information environment tells subscription operators half a story.

The half that gets told is true. The half that gets omitted is the half that can cost you money, because the FTC has kept bringing cases throughout and the underlying authorities never went anywhere.

If you run subscriptions, replenishment programs, free trials that convert to paid, or any arrangement where a customer's silence results in a charge, the practical standard you are held to in late 2026 is close to what the vacated rule described. Not because the rule survived, but because it largely restated obligations that already existed elsewhere.

What The Court Actually Held

Precision matters here because the reason for the vacatur determines what it implies.

In October 2024 the FTC finalised amendments to its Negative Option Rule, commonly called the click-to-cancel rule, extending it across marketing channels and requiring clear disclosure of material terms, express informed consent before charging, and a cancellation mechanism at least as simple as enrollment. Those amendments were scheduled to take effect in 2025.

In July 2025 the Eighth Circuit vacated them in their entirety. The holding was that the FTC failed to comply with procedural requirements of its Magnuson-Moss rulemaking authority, specifically that it did not conduct a required preliminary regulatory analysis because it had assessed the rule's economic impact as below the statutory threshold. The court held a later analysis could not cure the earlier omission.

Procedural vacaturs are readily curable. An agency can redo the process correctly, which is precisely what the FTC began doing months later. That is why treating the vacatur as the end of the story was always a misreading.

Enforcement Never Stopped

The single strongest counter to the relaxation narrative is the enforcement record, and it comes from the FTC's own rulemaking notice.

Coverage of the ANPRM indicates that since January 2025 alone, the FTC initiated five cases and approved six settlements related to alleged negative option misconduct. That period spans the vacatur. The agency did not pause and it did not need the rule.

Reporting also describes those settlements requiring payments of millions of dollars in consumer redress alongside commitments to implement clear upfront disclosures and simple, easy-to-find cancellation mechanisms. In other words, the remedies negotiated in enforcement look like the requirements in the vacated rule.

The enforcement theories are the ones that always existed: inadequate disclosure of material terms, failure to obtain express consumer consent, and cancellation processes that are difficult or impossible to complete. None of those depended on the 2024 amendments.

What The 1973 Rule Covers

A widespread misunderstanding worth clearing, because it cuts the other way and matters for how you read everything else.

The Negative Option Rule that survived the vacatur is the original from 1973, available at 16 CFR Part 425. It applies only to prenotification plans, the book-of-the-month club model where a seller periodically sends notices and bills for merchandise unless the consumer declines within a set period.

It does not cover continuity programs. It does not cover automatic renewals. It does not cover free-to-pay trial conversions. Which means for most modern subscription businesses, the rule that survived does not apply to you in the first place, and the rule that would have applied is the one that was vacated.

That gap is exactly why the FTC has been operating through other authorities, and it is the gap the current rulemaking is trying to close. Understanding it prevents two opposite errors: assuming the surviving rule governs your subscription when it does not, and assuming that because it does not, nothing does.

The Patchwork You Are Governed By

The FTC's own notice describes negative option marketing as governed by a patchwork rather than a uniform framework, which means different requirements may apply depending on your marketing channel and where your customer lives.

For an online subscription business the two that matter most are ROSCA and Section 5, with state law frequently setting the practical ceiling on what you can get away with. None of the three was touched by the Eighth Circuit.

ROSCA In Practical Terms

The Restore Online Shoppers' Confidence Act, at 15 U.S.C. chapter 110, is the statute doing most of the work. The FTC's own page for it is worth a read because it is short.

ROSCA's requirements for online negative option offers reduce to three obligations that have not changed:

• Clear and conspicuous disclosure of material terms before obtaining billing information. What the customer will be charged, how often, and what happens at the end of any trial.
• Express informed consent before charging. Consent to the recurring charge specifically, not consent buried in general terms.
• A simple mechanism to stop recurring charges. The statute's language is not as detailed as the vacated rule's, and the enforcement interpretation has consistently been that difficult cancellation is the problem.

Read those next to what the vacated rule required and the overlap is substantial. That is the core point of this article. The rule made explicit what ROSCA implies, and losing the explicit version did not remove the implication.

State Auto-Renewal Laws

The dimension most likely to catch a brand that has focused only on federal developments.

State automatic renewal laws exist across many states, they vary in their requirements, and reporting through the vacatur period consistently described them as expanding alongside increased state-level enforcement. Because you sell nationally, you are subject to the law of the state where your customer resides, which in practice means complying with the strictest one you are exposed to.

California's regime is commonly described as the effective national floor, on the familiar logic that a compliance standard built for the strictest jurisdiction satisfies the others. That is a planning heuristic rather than a legal conclusion, and the specific requirements are exactly the kind of detail to confirm with counsel rather than from an article.

The operational implication is that building to a single national standard is simpler than attempting state-by-state variation, and the standard worth building to is roughly the one the vacated rule described.

The 2026 Rulemaking

The FTC restarted the process, and the document is public.

On March 11, 2026 the Commission announced an advance notice of proposed rulemaking on the Negative Option Rule, published in the Federal Register on March 13, 2026, with comments due by April 13, 2026. It asks whether to amend the rule, what regulatory alternatives exist, whether to revive provisions of the vacated rule, how to handle exemption requests, and whether deceptive practices are prevalent in business-to-business negative option transactions.

What happens next is genuinely uncertain, and the honest description is that the Commission may proceed to a notice of proposed rulemaking, propose specific amendments, or take no further action at all. Anyone telling you confidently what the final rule will require is guessing.

Auditing Your Signup Flow

Enforcement theories cluster around disclosure and consent at least as much as cancellation, which surprises brands that have focused entirely on the cancel button.

The last line is the one operators consistently miss. If your signup page has changed six times this year and you cannot reconstruct what a customer saw in March, defending a disclosure allegation becomes considerably harder. Version your flows and retain the evidence.

Free trials deserve particular scrutiny because the harm the FTC describes, customers charged for things they did not intend to buy, is most acute where a free offer converts silently to a paid one.

Auditing Your Cancellation Flow

The headline issue, and the useful test is simple: could a customer who wants to stop paying do so easily through the channel they signed up in?

1. Is cancellation available in the same medium as signup? If they subscribed online, online cancellation should exist. Requiring a phone call to exit an online signup is the pattern that attracts cases.
2. How many steps from logged in to canceled? Count them. Then count the steps to subscribe. A large asymmetry is the thing being complained about.
3. Is it findable? Cancellation buried under unrelated menu headings is a friction complaint even if the button exists.
4. Does it actually cancel? Pausing, downgrading, or scheduling a callback are not cancelling. If the customer believes they canceled and a charge follows, that is the worst version of this.
5. Is confirmation immediate and in writing? Both for the customer and for your own records.
6. Do retention offers block the exit? Offering an alternative is fine. Requiring the customer to decline several before reaching cancellation is friction.
7. Does phone cancellation have real capacity? Where phone is offered, hold times and limited hours become the friction complaint.

Run this as a mystery shop rather than a design review. Have someone unfamiliar with the product try to cancel while you time it. The gap between how a team believes its flow works and how it behaves is routinely large.

If you are choosing or reviewing subscription infrastructure, cancellation handling is worth weighing alongside the commercial features, and our comparison of subscription platforms covers the wider evaluation.

Save Offers And Retention

This is where compliance and commercial incentives genuinely conflict, and pretending otherwise is unhelpful.

Retention offers work. A discount or a pause presented at the moment of cancellation genuinely retains customers, and that revenue is real. The vacated rule's treatment of save offers drew significant industry criticism precisely because the practice is valuable.

The distinction that matters is between offering and obstructing. A single clearly-presented alternative, with an unambiguous continue-to-cancel option of equal prominence, is an offer. A sequence of screens each requiring a decline, with the cancel option progressively less visible, is obstruction dressed as an offer.

The workable standard, which also happens to be better product design, is that a customer who ignores every offer and clicks the plainest path should reach cancellation quickly. Retention should win on the strength of the offer rather than on the exhaustion of the customer.

The commercial argument for restraint is stronger than it looks. Customers who cancel angrily after a difficult exit do not return, and they tell people. Our guides to subscription and recurring revenue and post-purchase offers cover retention approaches that do not depend on friction.

What To Do This Quarter

Practical, in order, and none of it requires waiting for the rulemaking to conclude.

1. Mystery shop your own cancellation. Someone unfamiliar, timed, documented. This takes an afternoon and tells you where you stand.
2. Audit disclosure and consent at signup using section nine. Disclosure failures are at least as common in enforcement as cancellation failures.
3. Fix the asymmetry. If subscribing takes two clicks and cancelling takes nine, close the gap. This is the single most protective change available.
4. Version and retain your flows. Screenshots and dated records of what customers saw. Cheap now, valuable later.
5. Check state exposure. You sell nationally, so you are exposed to the strictest applicable regime rather than the most convenient one.
6. Review save offers for obstruction. Keep the offer, remove the maze.
7. Have counsel review it once. An hour of specialist time on a flow you have already tightened is far cheaper than defending it later.
8. Set a review date. The rulemaking will move. Diarise a check rather than relying on noticing.

If You Are Going To Ignore All Of This

Do one thing: make sure a customer who wants to stop paying can, online, in a small number of clicks, with written confirmation. That single property addresses the largest share of enforcement risk, satisfies the most likely shape of any future rule, and is defensible under the authorities that apply today. Everything else in this post is refinement on top of it.

And if your business model depends on customers being unable to cancel easily, the regulatory exposure is the smaller problem. That is a retention strategy with a fixed expiry date, being pursued by an agency that has brought cases throughout a period when commentators declared the rules dead.