The Federal Trade Commission’s click-to-cancel rule was struck down in July 2025. That sentence is true. The conclusion some businesses have drawn from it – that making people fight to cancel is safe again – is not.
If you run a website that charges people on a recurring basis you’ve probably seen “click to cancel” cited somewhere in the last year, be that in trade press, a compliance webinar, or a vendor’s marketing email. Half the time it’s cited as live law you must follow. The other half it’s cited as a rule that got killed, so relax.
Both versions make the same mistake: they treat one famous federal rule as though it settled the whole question of how hard a company can make it to cancel. It didn’t, and it isn’t settled. It’s being enforced through older laws, tightened by states, and reconsidered through a fresh round of federal rulemaking – just not under the name you remember.
Here’s what actually happened, and what it means for the cancellation flow you’re responsible for.
What happened – and why “technicality” is the wrong word
In July 2025, the Eighth Circuit vacated the Federal Trade Commission (FTC)’s amended Negative Option Rule – the one everyone called “click to cancel.” So far, so accurate.
The reason it was vacated is where people stop reading, and it’s the part that matters most.
The court didn’t decide that hard-to-cancel practices are lawful. It didn’t rule on the substance of the rule at all. It threw the rule out on procedure: the FTC was legally required to produce a preliminary regulatory analysis once the rule’s projected economic impact crossed a statutory threshold, and it skipped that step. The court found the omission prejudicial, and vacated the entire rule as a result (Custom Communications, Inc. v. FTC, 8th Cir., July 8, 2025).
It sounds like a technicality. It wasn’t one. The FTC skipped an analysis the law requires, and the court treated that as fatal. But notice what the ruling is not: It is not a finding that a five-screen, three-chatbot, “call us between 11:42 and 11:47 on alternate Tuesdays” cancellation flow is fine. The court never reached that question. The famous rule died on how it was made, not on what it said.
The floor never moved
Here’s the thing almost nobody citing the vacatur mentions. The rule that died was an amendment. It was bolted onto a statute that has been on the books since 2010 – the Restore Online Shoppers’ Confidence Act, or ROSCA – and ROSCA was never touched. It still requires clear disclosure, informed consent, and a simple mechanism to stop recurring charges. It remains fully enforceable – and since the vacatur, federal enforcers have used it to devastating effect.
Look at what landed after the rule was struck down.
In September 2025, Amazon agreed to a $2.5 billion settlement over how it enrolled people in Prime and how it handled their attempts to cancel – $1 billion in civil penalties and $1.5 billion returned to consumers (FTC, September 25, 2025). Six months later, in March 2026, Adobe agreed to a proposed $150 million resolution – $75 million in penalties and $75 million in services – over allegations that it buried a hefty early-termination fee in fine print and ran subscribers through an obstructive cancellation process built from unnecessary steps, delays, and unsolicited offers (Department of Justice, March 13, 2026).
Both actions invoke the supposedly unimportant law that survived. Both happened while the “click to cancel” rule was, supposedly, dead. If the vacatur eased the pressure on companies that make cancellation hard, someone forgot to tell the enforcers.
The gap is closing
Suppose you decide to bet on the vacatur anyway – that federal rules are in flux, so this is a good moment to make cancellation quietly harder. The ground is already shifting under that bet, from two directions at once.
States are filling the space. California now requires cancellation through the same medium you used to sign up – or the one you normally use to deal with the business. If someone can subscribe online, they have to be able to cancel entirely online, without being herded through steps built to obstruct or delay them. Those requirements apply to contracts entered into, amended, or extended on or after July 1, 2025 (California AB 2863). Sell recurring subscriptions to consumers in California, and the federal vacatur does nothing to make those obligations disappear.
And the FTC has reopened the question. In March 2026 it issued a new advance notice of proposed rulemaking, asking whether the Negative Option Rule should be amended and how federal regulation should address deceptive subscription practices – including, explicitly, whether to re-adopt provisions of the vacated 2024 rule (FTC, March 11, 2026). It hasn’t promised to recreate the rule the court struck down. But it plainly hasn’t treated the vacatur as the end of the problem – and anyone who has is closing the book while the next chapter is still being written.
This isn’t just an American problem
If your audience reaches beyond the US, the direction of travel is the same everywhere. In the UK, the Digital Markets, Competition and Consumers Act brought drip-pricing and fake-review rules into force on April 6, 2025, with a dedicated subscription-contracts regime expected to follow around Spring 2027 (DMCC Act 2024). In the EU, the Digital Services Act makes the direction even more explicit for online platforms: Article 25 identifies making a service “more difficult to terminate… than to subscribe to it” as a manipulative interface practice (EU DSA, Article 25). Different statutes, same expectation: leaving should not be engineered to be harder than joining.
What the vacatur means for you
Put the two true statements side by side. “The click-to-cancel rule was vacated” – true. “Hard-to-cancel design is safe now” – false, and potentially very expensive.
The famous rule bundled a set of expectations – clear disclosures, informed consent, an accessible way out, limits on obstructive design – into one memorable package. Vacating the package didn’t erase the federal statute, the state laws, or the overseas rules that still carry many of those same obligations; it just scattered them across a patchwork instead of one catchy name. If you built your cancellation flow – or your plan to make it worse – around the belief that the rule dying let you off the hook, you built on the one part of this story that was never holding anything up.
What to do about your cancellation flow
A cancellation process isn’t honest just because cancellation is technically possible somewhere inside it. Across these laws and enforcement actions, the direction is remarkably consistent: getting out should be no harder than getting in. So apply that standard yourself, honestly:
- Make canceling as easy as signing up was – same channel, comparable number of steps.
- Disclose recurring charges and any termination fees before someone consents, not in fine print or behind an inconspicuous link.
- Don’t force people into phone calls, retention scripts, or dead-end screens to do something they have every right to do in a couple of clicks.
- Stop reading your own flowchart and try it as a real person would. Count the steps. Count the screens. Read the button labels and notice whether the obvious ones continue the cancellation or divert people into an offer.
Legal compliance is only half of whether the route actually works. A flow can be short on paper and still shut people out through inaccessible design. Try it with a keyboard instead of a mouse, at 400% zoom, and with a screen reader. A cancellation path that only works for an unhurried user with a mouse and perfect vision is a path a lot of your customers can’t actually use – and “you can technically cancel” has never impressed a regulator whose test is whether people could. If any of that is harder than signing up was, you’ve found your work.
Click to Cancel is gone. The legal and ethical problem it addressed is not. Federal enforcement kept going, state requirements tightened, and regulators elsewhere are converging on the same basic expectation: leaving should not be engineered to be harder than joining. The cheapest time to make your cancellation flow honest is before a regulator, a state attorney general, or a class action makes you do it.
Take ten minutes this week and try to cancel one of your own subscriptions the way a tired customer would. If leaving is harder than joining was, you already know what to fix – and now you know it was never really about the rule.
This is an explainer, not legal advice. For a specific compliance decision, talk to a lawyer who knows your setup.
