Subscription Cancellation Law: Rules, Enforcement and What Actually Applies

The FTC's click-to-cancel rule is gone. Enforcement is not. Conflating the two is the most common mistake in this area, and it's expensive in both directions. Businesses that read the vacatur as permission have walked into nine-figure penalties, and businesses that assume the vacated rule still binds them are designing against a text that no longer exists.

The Eighth Circuit vacated the 2024 Negative Option Rule on 8 July 2025, in Custom Communications, Inc. v. FTC (Nos. 24-3137 and 24-3388), on procedural grounds: the Commission had skipped a required preliminary regulatory analysis. That much is widely reported. What's usually missed is what happened next.

On 12 February 2026 the FTC issued a final rule at 91 FR 6507, implementing the vacatur by recodifying 16 CFR 425 as it read before the 2024 amendments (FTC Negative Option Rule revision, 2026). The rule's title reverted to the Rule Concerning the Use of Prenotification Negative Option Plans. The 2024 requirements were not left in limbo. They were removed from the CFR.

The agency then reopened the process from the beginning. An advance notice of proposed rulemaking, 91 FR 12318, followed on 13 March 2026, with comments closing 13 April (FTC Prenotification Negative Option ANPRM, 2026). Nothing has followed: the Unified Agenda entry for the rulemaking, RIN 3084-AB84, still shows it at the prerule stage, with staff review of public comments as the next step and no proposed rule scheduled (Unified Agenda RIN 3084-AB84, 2026).

Throughout all of it, ROSCA and Section 5 of the FTC Act applied unchanged. ROSCA requires clear and conspicuous disclosure of material terms before billing information is collected, express informed consent before charging, and a simple mechanism to stop recurring charges. Note what ROSCA does not say: the requirement that cancellation be at least as easy as signup and offered through the same medium was a provision of the vacated rule, not of the statute. It survives in state law and in negotiated consent orders, including Amazon's, but it is not currently a federal rule of general application.

This is the part of the March 2026 notice that has gone largely unremarked, and it's the one that matters most if you run a cancellation flow (FTC Prenotification Negative Option ANPRM, 2026). The Commission asks directly: "Is it unfair or deceptive to offer discounts or other incentives to remain enrolled in a negative option program ('Saves') instead of promptly honoring a consumer's request to cancel? Why or why not?"

The sub-questions are more revealing than the question. The notice asks for data on how often save offers are accepted, what consumers save on average, and how much longer cancellation takes after a save offer is declined. It also asks what effect state laws regulating save attempts have had. That is a regulator building a record on delay as a harm, not on the offer itself.

A separate question in the same notice asks what role subscription management providers and third-party service providers have in ensuring compliance (FTC Prenotification Negative Option ANPRM, 2026). Tools like ours are named in the record. Whatever emerges will land on the software as much as on the merchant.

None of this is law yet, and it may never become law, since the rulemaking hasn't advanced past prerule in five months (Unified Agenda RIN 3084-AB84, 2026). One state has already legislated it, though, which makes this a direction to design for now rather than to wait out.

The list matters less than what the entries have in common. Nearly every action turns on one of three defects: the cancellation channel didn't match the signup channel, material terms weren't disclosed before billing information was collected, or the path was engineered to exhaust rather than to enable. LA Fitness is the clearest example of the first, Adobe and JustAnswer of the second, Amazon and Uber of the third. A flow that avoids all three is defensible regardless of what the rule says this quarter.

Adobe repays a close reading, because the order is a compliance checklist as much as a penalty. The Justice Department filed a proposed stipulated order on 13 March 2026: $75 million in civil penalties plus $75 million in services (DOJ settlement with Adobe, 2026). It resolves the case once a court enters it, and the announcement does not report entry. Going forward Adobe must disclose any early termination fee and how it is calculated before enrolling a customer. It must also remind customers before converting any free trial longer than seven days into a paid subscription carrying such a fee, and must provide easy ways to cancel. If you sell an annual plan billed monthly, those three obligations are a reasonable specification to design against.

Amazon is the strongest available argument against friction. The flow was known internally as the "Iliad Flow," and it did suppress cancellations, which is presumably why it survived as long as it did. It also produced $2.5 billion in penalties and refunds, a ten-year injunction and a rebuilt flow (FTC settlement with Amazon, 2025). Model any friction-based gain against that.

The FTC's own notice (FTC Prenotification Negative Option ANPRM, 2026) names four state auto-renewal statutes: California, Colorado (§ 6-1-732), Vermont (tit. 9, § 2454a) and Virginia (§ 59.1-207.46). Two of them are worth designing against specifically.

California is the strictest in force anywhere, and it is the one that constrains save offers directly. Business and Professions Code § 17602, as amended by AB 2863 (Chapter 515, Statutes of 2024), applies to contracts entered, amended or extended on or after 1 July 2025. A consumer who accepted online must be able to terminate exclusively online, at will, without steps that obstruct or delay. A business may display a discount, a retention benefit, or information about the consequences of canceling only if it simultaneously displays a prominently located, continuously and proximately displayed link or button that cancels. If the consumer uses that button, the business must promptly process the cancellation. A save offer without that control is not a save offer in California; it is a violation (California Automatic Renewal Law section 17602, 2024).

New York is stricter on a different axis, and it's the one most often missed by a business that believes it is compliant because it built a good online flow. General Business Law § 527-a requires a mechanism as easy as signup in the same medium, but it goes further and requires cancellation be available through all mediums by which the business allows a consumer to provide affirmative consent. Not the same medium: every medium. If you accept signups by phone or in person, an excellent web flow does not discharge the obligation (New York General Business Law section 527-a, 2025).

The exposure is asymmetric, which is worth knowing before you decide where to spend the effort. New York's statutory penalties are small, and the pressure there comes from Attorney General injunctive action and restitution. California's exposure runs through the Unfair Competition Law and private suits, which is a different order of magnitude.

The UK is the near-term forcing function. The Department for Business and Trade published its response on the subscription contracts regime on 2 April 2026, stating that it will legislate when parliamentary time allows and that the regime is anticipated to commence in spring 2027 (UK Government response on subscription contracts, 2026). The duties it switches on are concrete: clear pre-contract information, reminder notices before trials and long contracts auto-renew, and contracts that are straightforward to exit. They also require an online exit route if the consumer signed up online, and a 14-day cooling-off period after a contract auto-renews.

The Competition and Markets Authority is already acting under its direct consumer enforcement powers, which let it decide breach itself rather than going to court, and order redress directly. It opened an investigation into Adobe on 19 March 2026 over early-cancellation fees on the annual-billed-monthly plan (CMA investigation into Adobe, 2026). A second followed into Microsoft on 29 July 2026, over Microsoft 365 customers being rolled onto higher-priced plans at renewal with a time-limited, cheaper opt-out (CMA investigation into Microsoft, 2026).

There is no EU click-to-cancel law, and no proposal for one. The Digital Fairness Act is a Commission initiative still under preparation. What binds a US business selling into the EU today is the existing stack: the Consumer Rights Directive's withdrawal right and order-with-obligation-to-pay requirement, and the Unfair Commercial Practices Directive, not the Act that has yet to be tabled.

Most of what a subscription business earns comes from customers who are getting what they pay for and simply have no reason to leave. Some of it does not, and that share is what regulators are looking at. The experimental evidence is blunt about how much of it is design rather than preference. In a randomized study of sign-up flows, acceptance of a paid service ran 11.3% under a plain interface, 25.8% under mild dark patterns and 41.9% under aggressive ones (Luguri and Strahilevitz on Dark Patterns, 2021). Tripling the price changed acceptance by no significant amount (Luguri and Strahilevitz on Dark Patterns, 2021). When interface design moves a decision several times more than price does, friction at the exit is commercially tempting and regulatorily interesting for the same reason.

A body of empirical work sits behind the term "dark patterns", and it's more concrete than the phrase suggests. Luguri and Strahilevitz quantified how much manipulative design moves acceptance rates, in the Journal of Legal Analysis in 2021. Mathur and colleagues measured prevalence across 11,000 shopping sites with a reproducible method. Sheil and colleagues published a cross-country analysis of real subscription and cancellation flows at CHI in 2024, which is the closest thing to a direct academic study of the thing this page is about.

The enforcement pattern isn't arbitrary, and it isn't going to reverse because one rule was vacated on procedural grounds. Design for the three defects and you're building against the pattern rather than against whichever rule happens to be in force.