The federal click-to-cancel rule was vacated in July 2025. Your protections now come from state auto-renewal laws, ROSCA, and an aggressive new wave of attorney general enforcement.
Last updated: May 18, 2026
If you read about the federal "click-to-cancel" rule when it was announced in 2024, set it aside. The rule no longer exists.
On July 8, 2025, the U.S. Court of Appeals for the Eighth Circuit issued its decision in Custom Communications, Inc. v. Federal Trade Commission, No. 24-2691, and vacated the FTC's amended Negative Option Rule (16 CFR Part 425) in its entirety. The vacatur came six days before the rule's scheduled July 14, 2025 compliance date. The rule never went into operative effect.
The court did not reach the merits. It ruled on procedural grounds: the FTC was required to prepare a preliminary regulatory analysis once an administrative law judge concluded the rule's expected annual impact exceeded $100 million. The Commission did not do so. The Eighth Circuit found that omission prejudicial and ordered the rule vacated rather than remanded.
The practical result
There is no federal rule that says cancellation must be as easy as sign-up. Your enforceable rights now come from three places: (1) state auto-renewal laws, (2) ROSCA (15 U.S.C. §§ 8401-8405), and (3) Section 5 of the FTC Act, which lets the FTC and state AGs sue specific companies for deceptive practices. The 1973 Negative Option Rule, governing "pre-notification" mail and phone plans, also remains in force.
The vacatur left the FTC's deceptive-practices authority untouched, and the agency used it. On September 25, 2025, Amazon agreed to a $2.5 billion settlement with the FTC over Prime enrollment and cancellation: a $1 billion civil penalty (the largest ever in an FTC rule-violation case) and $1.5 billion in consumer refunds. The complaint alleged dark-pattern enrollment and a cancellation flow internally nicknamed "Iliad." Amazon began sending automatic refunds in late 2025 and claim notices in January 2026. The Prime case was brought under ROSCA and Section 5, not the vacated rule, which is the model for federal action you should expect going forward.
Meanwhile, state legislatures filled the gap. California, New York, Minnesota, and Colorado all enacted or amended click-to-cancel statutes that took effect in 2025. Arkansas, Utah, Massachusetts, Connecticut, Maryland, and Tennessee added or strengthened their own. Colorado expands its rule to business-to-business contracts on February 16, 2026.
The vacated rule got the headlines, but several older federal statutes survived and remain the baseline floor for every consumer in every state.
ROSCA is the federal statute that still does real work. Enacted in 2010, it makes it unlawful for any online seller to charge a consumer on a negative-option basis unless the seller does three things: (1) clearly and conspicuously discloses all material terms before obtaining billing information, (2) obtains the consumer's express informed consent before charging, and (3) provides "simple mechanisms" to stop recurring charges. ROSCA is enforced by the FTC and by state attorneys general. The Amazon Prime case was a ROSCA case at its core.
ROSCA is narrower than the vacated rule. It does not, for example, mandate that a cancellation method match the sign-up method medium-for-medium. State laws below close that gap.
The original Negative Option Rule, which the 2024 amendments tried to replace, is back to its pre-amendment form. It covers "pre-notification" subscription plans for goods shipped by mail or telephone order: the Book-of-the-Month-Club model. It does not cover most modern app or SaaS subscriptions. It exists, it is enforceable, but it is not the rule consumers usually need.
Section 5 prohibits "unfair or deceptive acts or practices in or affecting commerce." It is the source of the FTC's authority to sue specific companies for dark-pattern enrollment, drip-cancellation flows, and undisclosed renewals. Vacating the rule did not touch Section 5. The FTC's January 2026 enforcement priorities, restated under the new commission, still list subscription dark patterns and undisclosed auto-renewals.
The FCBA gives you 60 days from the date of the first statement on which a disputed charge appears to write to your credit card issuer and demand a chargeback. The issuer must investigate and may not charge interest on the disputed amount during the investigation. This is the fastest practical remedy when a company will not stop billing you. See our guide on disputing subscription charges for step-by-step language.
The strongest protections are now found at the state level. Here are the statutes a consumer lawyer would cite, what each one requires, and where each one bites hardest.
| State | Statute | Effective | Notable requirements |
|---|---|---|---|
| California | Bus. & Prof. Code §§ 17600-17606 (amended by AB 2863) | July 1, 2025 | Online cancellation must match the sign-up medium. Express affirmative consent required. Free trials now in scope. Annual reminder for yearly subs (renewal date, price, cancel instructions). Price-change notice 7-30 days before increase. Non-compliant charges treated as "unconditional gift" under § 17604. |
| New York | GBL § 527-a (click-to-cancel amendments) | Nov. 5, 2025 | Cancellation must be available in every medium the business accepts consent through and must be as easy as sign-up. Renewal reminder 15-45 days before deadline for annual or longer terms. AG James has prioritized enforcement. |
| Minnesota | Minn. Stat. §§ 325G.56-.59 | Jan. 1, 2025 | Online cancellation required if the business has any online account management. Bans save offers during cancellation without separate, affirmative consent. Annual reminder for every ongoing subscription regardless of term. |
| Vermont | 9 V.S.A. § 2454a | July 1, 2019 (still strictest by some measures) | Auto-renewal requires separate opt-in beyond contract acceptance. Bold-face disclosure mandated. 30-60 day pre-renewal notice required for one-year-plus contracts. Online sign-up must allow online cancellation. Covers B2B. |
| Colorado | HB 24-1230 (Colo. Rev. Stat. § 6-1-732) | Jan. 1, 2025 (B2B: Feb. 16, 2026) | Annual renewal reminders. Cancellation by same method as enrollment. Price-change notice required. February 2026 expansion brings business-to-business contracts in scope. |
| Illinois | 815 ILCS 601 (Automatic Contract Renewal Act) | 2000, amended 2004 | Clear-and-conspicuous disclosure of auto-renewal and cancellation procedure. For 12-month-plus contracts, 30-60 day pre-renewal written notice. Violation is a deceptive practice under 815 ILCS 505; AG can seek civil penalties up to $50,000. |
| Massachusetts | 940 CMR 31.00 (AG regulation under Ch. 93A) | 2025 | Disclosure, consent, and reasonable cancellation methods. Violation actionable under Ch. 93A § 9 with private right of action, treble damages, and attorney fees. |
| Virginia | Va. Code § 59.1-207.46 (amended by HB 744) | July 1, 2024 | Affirmative consent required. Electronic cancellation confirmation. Renewal notice 30-60 days before deadline for renewals over 12 months with terms over 30 days. |
| Oregon | ORS § 646A.295 | 2020 | Online cancellation method required for online sign-ups. Clear disclosure of auto-renewal terms. Enforced by AG under Unlawful Trade Practices Act. |
| Connecticut | Conn. Gen. Stat. § 42-126b (2025 amendments) | Oct. 1, 2025 | Online cancel for online sign-up. Renewal reminders. Free trial conversions require separate notice. |
| Maryland | Md. Code Com. Law § 14-1212.1 (as amended 2025) | Oct. 1, 2025 | Affirmative consent, clear disclosure, easy cancellation. AG enforcement under Maryland Consumer Protection Act. |
| Tennessee | Tenn. Code § 47-18-5402 (Consumer Protection and Subscription Renewal Act, amended 2025) | July 1, 2025 | Clear-and-conspicuous disclosure pre-purchase. Free-trial card capture restricted until consumer opts in to continued service. |
| Utah / Arkansas | Utah Code § 13-42-101 et seq.; Ark. Code § 4-115-101 et seq. | Late 2025 | Both states adopted FTC-style click-to-cancel mechanics through state legislation after the federal rule fell. |
| Florida, Georgia, others | State UDAP statutes (FDUTPA, GFBPA, etc.) | Varies | No dedicated auto-renewal statute, but unfair-and-deceptive-practices laws can reach dark-pattern cancellation. ROSCA still applies federally. |
If your state is not listed with a dedicated statute, that does not mean you have no protections. Every state has a general unfair-and-deceptive-practices (UDAP) statute that state AGs use to pursue subscription companies, and ROSCA applies in all 50 states.
California's Automatic Renewal Law was already the most-cited consumer statute in the country. AB 2863, signed September 24, 2024 and effective July 1, 2025, made it the de facto national standard once the federal rule fell. The amendments expanded "automatic renewal offer" to include free trials, required express affirmative consent (no pre-checked boxes), mandated cancellation in the same medium used to sign up, and required annual reminders for any subscription renewing on a yearly cycle.
The teeth are in Bus. & Prof. Code § 17604: products or services delivered without compliant disclosure and consent are deemed "an unconditional gift" to the consumer. That is statutory permission to keep what you got and demand a full refund. The California AG and DA offices secured a $7.5 million settlement with HelloFresh in 2025 on this theory.
New York's amended auto-renewal law took effect November 5, 2025. Under GBL § 527-a as amended, a business must let you cancel through every channel it accepts to take your consent (and a price increase counts as a new consent moment). Cancellation must be as easy as the sign-up. AG Letitia James's office has flagged subscription dark patterns as a 2026 enforcement priority and runs a dedicated intake at ag.ny.gov.
Minn. Stat. §§ 325G.56-.59, effective January 1, 2025, did something California did not. It banned mid-cancellation "save" offers (the discount-pop-up, the "are you sure?" interstitial) unless the consumer affirmatively consents to receive them. The business may still ask why you are leaving and may inform you of pause or downgrade options, but it cannot block your path with a retention pitch. The annual reminder rule applies to every ongoing subscription, not just yearly ones.
Vermont's 2019 auto-renewal statute remains arguably the strictest in the country on a literal-reading basis. It requires that the auto-renewal clause be opted into separately from the contract itself, in bold-face type. Vermont covers business-to-business contracts. Violations are per se unfair and deceptive under § 2453 of the Vermont Consumer Protection Act, which carries a private right of action and treble damages.
A vacated rule is not a green light. Enforcement under existing laws accelerated in 2025 and the early months of 2026. The cases below are the ones a working consumer-protection lawyer points to first.
$2.5 billion total: $1 billion civil penalty, $1.5 billion in refunds to Prime subscribers. Brought under ROSCA and Section 5. Cap on per-consumer refund: $51. Independent monitor required. Refund claim portal at subscriptionmembershipsettlement.com opened January 2026.
$7.5 million settlement with the California AG and four district attorneys. Allegations: enrollment without clear consent, inadequate disclosure of recurring charges, hard-to-cancel flow. Settlement required cancellation-flow redesign and ongoing compliance reporting.
34 state AGs reached a coordinated settlement with the online apparel and accessories company over unlawful negative-option enrollment and obstructive cancellation. The settlement is the post-July-2025 template: state AGs working in coalition under their own UDAP statutes, with ROSCA hooks where useful.
Approximately $750,000 in penalties plus enrollment and cancellation reforms. Smaller dollar figure than HelloFresh, but the case shows AGs are willing to take subscription-dark-pattern cases against mid-size companies, not just platform giants.
The statutes above do not enforce themselves. The mechanics below are what actually move a company from "we'll get back to you" to a refund.
Screenshot every step of the cancellation flow with timestamps visible. Save the email confirming you signed up. Save every chat transcript. Note the exact URL of the cancellation page and any pop-ups or "save" offers shown. A subscription tracker like Subcut keeps the billing dates and amounts in one place so you can cite specifics.
Email customer service (or use the in-product cancellation if available) and include language like: "I am canceling under [your state] auto-renewal law [e.g., Cal. Bus. & Prof. Code § 17602; N.Y. GBL § 527-a; Minn. Stat. § 325G.57]. Please confirm cancellation in writing within 5 business days and refund all charges billed without compliant disclosure and consent." Citing the statute changes the conversation. Many compliance teams will route the email out of the standard retention queue.
Every state AG has a consumer protection division and a complaint intake. New York and California in particular have subscription-specific portals. State AGs do read these and frequently use the volume of complaints to choose targets. Include your evidence package from Step 1.
Under the FCBA (15 U.S.C. § 1666), you have 60 days from the statement date to dispute a charge. Use that window. Many issuers also honor "merchandise or services not as agreed" disputes for subscription matters beyond the strict FCBA window. See our chargeback walkthrough for the exact letter format.
Report at ReportFraud.ftc.gov. The FTC does not resolve individual complaints, but pattern data is what drives the Section 5 and ROSCA cases. Your single complaint is one data point. The Amazon Prime case grew out of years of those data points.
Mass. Gen. Laws Ch. 93A § 9 and the Vermont Consumer Protection Act both create private rights of action with treble damages and attorney fee shifting. Small-claims is a realistic venue for individual subscription disputes in those states.
For a longer walkthrough including federal channels, see our companion guide on how to report subscription fraud.
Prevention is cheaper than enforcement. Four habits do most of the work.
Use Subcut to keep a running list of active subscriptions, renewal dates, and costs. Half of all auto-renewal harm comes from subscriptions the consumer simply forgot.
Screenshot the confirmation page and save the confirmation email. Without it, a company can credibly claim you did not actually complete cancellation.
If the auto-renewal terms are not clear and conspicuous, that itself is a violation under most state laws. Note the missing disclosure (a screenshot is enough); it becomes evidence later.
Review card statements monthly for charges from services you thought were canceled. These zombie subscriptions are the single most common consumer complaint category at most state AG offices.
No. The Eighth Circuit vacated the rule on July 8, 2025 in Custom Communications, Inc. v. FTC, No. 24-2691, on procedural grounds. The rule never reached its July 14, 2025 compliance date. ROSCA, the 1973 Negative Option Rule, and Section 5 of the FTC Act all remain in force.
California (Bus. & Prof. Code §§ 17600-17606, as amended by AB 2863), New York (GBL § 527-a, amended November 5, 2025), Minnesota (§§ 325G.56-.59), Vermont (9 V.S.A. § 2454a), and Colorado (HB 24-1230) are at the top. Minnesota and California both forbid mid-cancellation save offers without separate consent; Vermont requires a separate opt-in to auto-renewal itself.
File with your state AG's consumer protection division, report to the FTC at ReportFraud.ftc.gov, and dispute the charge with your card issuer under the FCBA (15 U.S.C. § 1666) within 60 days of the first statement showing the charge. Keep screenshots and confirmation emails. In Massachusetts and Vermont, a private lawsuit under the state consumer protection act with treble damages is also a realistic option.
No. Post-cancellation charges violate ROSCA (15 U.S.C. § 8403) and every state auto-renewal statute. Under California's § 17604, charges made without compliant disclosure or consent are treated as an unconditional gift, giving you a statutory basis to keep the product and demand a full refund. Dispute the charge with your bank within the FCBA's 60-day window.
The Commission could re-propose the rule with a proper preliminary regulatory analysis. As of May 2026, no formal re-proposal has been published. The current FTC has signaled it will rely on case-by-case ROSCA and Section 5 enforcement, which is what produced the $2.5 billion Amazon Prime settlement. A future Congress could also legislate, several federal bills have been introduced.
No. ROSCA applies in all 50 states. Every state has a general unfair-and-deceptive-practices (UDAP) statute. State AGs in non-ARL states regularly bring subscription cases under their UDAP authority, and the multistate TFG Holdings settlement in 2025 included 34 states.
Track, manage, and optimize all your subscriptions in one place.
Download Subcut Free