Subscription Cancellation Law in 2026: What the Click-to-Cancel Rule Means for SaaS Now
Federal click-to-cancel enforcement collapsed in 2025, leaving ROSCA and state auto-renewal laws in California, New York, and Colorado as the active requirements, and a five-item Compliant Cancel Path checklist satisfies all of them at once.
When I built the cancellation flow for a B2B fintech client, the hardest part wasn't the offer logic. It was making sure the cancel path would hold up if a regulator looked at it.
There is no federal click-to-cancel rule in force. The FTC's rule was struck down in July 2025 and never took effect. What's enforceable today is ROSCA plus state auto-renewal laws in California, New York, Colorado, and roughly 30 other states.
The checklist below satisfies all of them.
Key takeaways
- The FTC Negative Option Rule was canceled on July 8, 2025.
- ROSCA is the active federal law requiring a simple way to cancel.
- California, New York, and Colorado each require online cancellation for subscriptions sold online.
- 30 US states have auto-renewal laws.
- A retention offer shown during cancellation is legal, but one that delays or blocks the cancel path crosses the obstruction line.
- The Compliant Cancel Path checklist satisfies ROSCA and the three state laws at once.
Is the FTC click-to-cancel rule in effect?
No. There is no federal click-to-cancel rule in force. The FTC rule was voided on July 8, 2025, days before its compliance deadline. It never took effect.
What's enforceable today is ROSCA plus state auto-renewal laws in California, New York, Colorado, and roughly 30 other states.
The court rejected it on a procedural ground. An Administrative Law Judge found the rule's compliance costs would exceed $100 million a year, which triggered a legal requirement for a preliminary cost review.
The agency skipped that step, so the Eighth Circuit struck it down. The substance was never evaluated on the merits.
The FTC filed a new rulemaking notice on January 30, 2026. A future federal rule is possible, but nothing is in force and no compliance date has been set.
What replaced it: the laws that actually apply to your cancel flow
Getting rid of the FTC rule changed nothing about the two layers of law that were always doing the real work: federal ROSCA and state auto-renewal laws.
ROSCA has been on the books since 2010 and never needed the Negative Option Rule to support it. State ARLs (auto-renewal laws) have been adding online-cancellation requirements for years. Without the federal rule, the layers below still apply.
If you sell subscriptions online into multiple US states, you almost certainly have at least one customer in California, New York, or Colorado. Each of those states has its own online-cancellation mandate.
Your cancel flow must meet it regardless of what happens at the federal level.
ROSCA and the state ARLs apply to online auto-renewing subscriptions, also called negative-option plans. A one-time purchase or a contract signed entirely in person sits outside most of these mandates.
ROSCA: the federal floor that never went away
ROSCA, the Restore Online Shoppers' Confidence Act, passed in 2010 and is enforced under Section 5 of the FTC Act. It sets three rules for any online negative-option plan:
- Disclose material terms clearly before billing
- Obtain express informed consent
- Provide a "simple mechanism" to stop recurring charges
The FTC interprets "simple mechanism" as meaning at least as easy as the sign-up process.
That standard isn't spelled out word for word in the statute, but the FTC has consistently applied it in legal cases. The Eighth Circuit getting rid of the Negative Option Rule didn't change ROSCA or the FTC's authority to bring Section 5 cases.
What ROSCA doesn't specify is the medium. It doesn't say customers who signed up online must be able to cancel online, only that the mechanism must be simple. That gap is where state ARLs become load-bearing.
State auto-renewal laws: California, New York, and Colorado
California's amended Automatic Renewal Law (SB 313) took effect July 1, 2025. It requires that a plan sold through an online sign-up must offer online cancel, at will, without any steps that obstruct or delay.
New York's ARL (General Business Law 527-a) took effect November 5, 2025. It adds two requirements:
- For subscriptions with an initial paid term of six months or longer, notify the customer 15 to 45 days before the cancellation deadline.
- The cancel path must also be "as easy to use as the mechanism that the consumer used to provide consent."
Colorado's SB25-145 took effect August 6, 2025. It requires one-step online cancellation for any subscription the customer signed up for online. If the customer consented online, you have to let them leave online. The path can't take more than one step.
Approximately 30 states have auto-renewal laws with requirements that overlap with the voided federal rule. Massachusetts, Connecticut, Arkansas, Maryland, Minnesota, and Utah all also updated or enacted ARLs in 2025.
Rules vary by state and the details matter, so don't assume meeting California's rules covers you everywhere.
How to build a compliant cancel flow
A cancel flow that meets the Compliant Cancel Path checklist satisfies ROSCA and the California, New York, and Colorado laws at once.
The common thread across all the statutes is equal access and clarity. A customer who signed up online must be able to leave online in roughly the same number of steps. Price and renewal terms must be disclosed before billing. Consent must be captured at signup.
No statute requires you to make cancellation easy in a way that hurts your save rate. They require you to make it possible without obstruction.
New York requires the cancel path be as easy as sign-up. California requires no steps that obstruct or delay. Colorado requires one step. Different phrasings, same rule: the cancel path must match the sign-up path.
Our cancel flow tool enforces same-medium cancellation by default. A customer who signed up inside the app cancels in the same number of clicks. That's what makes the Churn.io cancel flow compliant across all three state laws without custom per-state configuration.
The Compliant Cancel Path checklist
Meeting all five satisfies ROSCA plus the California, New York, and Colorado ARLs:
- Disclose price and renewal terms before billing: show the full price, billing frequency, and recurrence before the card is charged, not buried in terms-of-service.
- Capture express consent at signup: the customer must opt in to the recurring charge, not merely fail to decline it.
- Let customers cancel through the same medium they signed up in: online sign-up means online cancellation, not a phone number or email address.
- No steps that obstruct or delay the cancellation: a single confirmation screen is fine, but a multi-screen obstacle course requiring phrases, videos, or timed delays is not.
- Send a pre-renewal notice where state law requires it: New York (six-month-plus contracts) and California (price increases or trial conversions) each mandate advance notice to customers.
Where retention offers stop being legal and start being friction
If your offer adds a step but doesn't block the cancel button, you're on the right side. If clicking decline routes the customer to the home screen instead of canceling, you're not.
Show one offer screen, and if the customer declines, complete the cancellation. An exit survey after the offer is fine. An exit survey that loops back to an offer after a decline is where regulators start asking questions.
Our cancel flow best practices guide covers which offer types convert well without crossing into obstruction. Understanding what a cancel flow is clarifies the line between persuasion steps and the final cancel confirm itself.
When this doesn't apply to you (and what's still coming)
These rules target online auto-renewing subscriptions, so a few business models sit partly outside them, and the regulatory picture is still moving.
Scope turns on whether the offer is a negative-option plan sold online. A one-time purchase doesn't trigger ROSCA's cancel-path requirement. A contract signed entirely in person falls outside the online-cancel mandates in California, New York, and Colorado.
Some B2B deals structured as custom contracts may sit outside the ARL language. ROSCA's disclosure scope is broad, though, and Section 5 legal action extends beyond ARL-shaped businesses.
The FTC's January 2026 rulemaking notice is the forward signal. The ANPRM is a notice of intent to start a rulemaking, not a draft rule. There's no compliance deadline and the process takes years.
The UK's Competition and Markets Authority subscription rules are expected in Spring 2027 and apply to UK consumers only.
Building to the Compliant Cancel Path now means you're ahead of the likely federal scope. The direction of travel is clear: same-medium, no obstruction, clear disclosure. Any future rule will tighten around those requirements.
This is operator guidance based on the statutes, not legal advice. Check the rules for your specific states with a qualified attorney.
For a full treatment of how these legal requirements connect to cancel-flow design, see the complete guide to cancel flows.
FAQ
With the click-to-cancel rule now vacated, what's next for the FTC?
The FTC submitted a new rulemaking notice on January 30, 2026, restarting the process of writing a federal negative-option rule. No draft rule exists yet, and no compliance date has been set.
What was the FTC click-to-cancel rule?
The FTC Negative Option Rule was a federal rule finalized in October 2024 that would have required a single-step online cancel path for any subscription sold online. It never took effect.
Does ROSCA require a cancel button?
It doesn't use the phrase "cancel button," but the practical requirement is an accessible, low-friction cancel path.