If you sell a subscription online and you have heard that the "click to cancel" rule was struck down, here is the part that got lost: the federal rule died, the obligation did not. The Eighth Circuit vacated the FTC's Negative Option Rule in its entirety on 8 July 2025. What remains federally is ROSCA, which requires "simple mechanisms for a consumer to stop recurring charges" without defining the phrase. What remains at state level is much more specific. California's automatic renewal law says that if a customer signed up online, you must let them cancel exclusively online, at will, and without engaging any further steps that obstruct or delay, through a prominently located direct link or button. One California subscriber is enough to make that your spec.
Three things people now believe that are not true
"The court said the rule was bad policy." It did not. Custom Communications, Inc. v. FTC, No. 24-3137 (8th Cir., filed 8 July 2025, opened 27 July 2026), turned on procedure. The FTC skipped the preliminary regulatory analysis required by section 22 of the FTC Act, 15 U.S.C. section 57b-3(b)(1), after an administrative law judge found the rule would cross the $100 million annual economic effect threshold that the Commission had originally estimated it would not cross. The court's closing words: "While we certainly do not endorse the use of unfair and deceptive practices in negative option marketing, the procedural deficiencies of the Commission's rulemaking process are fatal here."
"Nothing federal applies now." 15 U.S.C. section 8403 (opened 27 July 2026) still makes it unlawful to charge for anything sold online through a negative option feature unless you clearly and conspicuously disclose all material terms before obtaining billing information, obtain express informed consent before charging, and provide simple mechanisms to stop recurring charges. That is a live statute with FTC enforcement behind it, and it is deliberately open-textured, which means your flow gets judged after the fact rather than against a checklist.
"This is settled for a while." The FTC sent a draft Advance Notice of Proposed Rulemaking on the Negative Option Rule to the Office of Information and Regulatory Affairs on 30 January 2026 and took public comment through 13 April 2026, per Gibson Dunn's tracking of the docket (opened 27 July 2026). A replacement rule is being written. Building to the strict state standard now means you do not rebuild later.
The build spec, line by line
Every row below comes from the text of California Business and Professions Code sections 17600 to 17606, read on the state legislature's own site on 27 July 2026. The right-hand column is what it means in a product, which is our translation rather than statutory language.
| Section | Requirement | What you build |
|---|---|---|
| 17602(a)(1) | Renewal terms clear and conspicuous before fulfilment and in visual proximity to the request for consent | Price, interval and "renews automatically" text next to the pay button, not in a linked terms page |
| 17602(a)(2) | Affirmative consent to the agreement containing the automatic renewal offer terms | An unchecked box or an explicit action tied to the renewal terms, logged with a timestamp |
| 17602(a)(3) | A retainable acknowledgment with the terms, cancellation policy and how to cancel | The receipt email, expanded. Most Stripe or Paddle default receipts do not carry cancellation instructions |
| 17602(d)(1) and (d)(1)(A) | Online signup means online cancellation, at will, via a prominently located direct link or button in the account or settings | A visible Cancel control in account settings. Not an email address, not a chat widget, not a phone number |
| 17602(b)(1) | Free trial or gift longer than 31 days, or promotional pricing lasting 31 days or more: notice at least 3 and at most 21 days before it expires | A scheduled job keyed to trial end date, not a marketing campaign |
| 17602(b)(2) | Terms of one year or longer: notice at least 15 and not more than 45 days before renewal | An annual-plan renewal warning. This is the one most SaaS companies skip |
| 17602(h)(1) and (h)(2) | Annual reminder in the same medium used at activation, stating the product, the frequency and amount of charges, and how to cancel | A yearly email for email signups, with the price in the body |
| 17603 | Goods sent without the required consent are deemed an unconditional gift | The consequence of getting consent wrong: the customer owes nothing |
Does your save flow break the rule?
This is the question every founder actually asks, and the statutory phrase decides it: cancellation must happen "without engaging any further steps that obstruct or delay." The test is not whether you show a retention offer. It is whether the offer is a step the customer must pass through to reach cancellation.
- Passes. Settings shows a Cancel subscription button. Clicking it opens a confirmation screen that also displays a 50 percent discount offer, with two equally visible buttons: "Keep discount" and "Cancel anyway." One click each way.
- Passes, narrowly. A single optional question ("Why are you leaving?") with a Skip control that is as prominent as the Submit control, on the same screen as the final Cancel button.
- Fails. Cancel opens a three-screen sequence: survey, then offer, then a "Are you sure? Call us to finish" panel. Each screen is a step that obstructs, and the phone requirement alone violates 17602(d)(1) for an online signup.
- Fails. The Cancel control exists but is a plain-text link at the bottom of a billing page below the fold while Upgrade is a coloured button at the top. "Prominently located" in 17602(d)(1)(A) is doing work here.
- Fails. Cancellation is available online but takes effect only after a support agent confirms within two business days. That is delay.
A caveat worth stating plainly: no California appellate decision has drawn the line between one screen and three, so these are readings of the statutory text rather than settled law. The exposure runs through section 17604(a), which makes all ordinary civil remedies available, and California's automatic renewal law has been a reliable source of class actions for a decade. The defensive position is the boring one: fewer screens than you think you need.
What this costs you, honestly
Making cancellation one click raises voluntary churn. That is real and worth pricing. But run the comparison before assuming the friction is paying for itself: a customer who cannot find the cancel button files a chargeback instead, and a chargeback costs the disputed amount plus a fee, damages your dispute ratio, and can push you toward the processor thresholds we covered in the small store dispute defence plan. Retention that produces disputes is not retention. The churn that is genuinely worth attacking is the involuntary kind, where cards expire and payments fail silently, which we broke down in the churn you did not earn, and which no legal exposure attaches to.
The audit, in order
- Sign up for your own product from an incognito window with a real card. Screenshot the checkout page and check whether renewal terms sit next to the pay button.
- Open the receipt email. Does it state the cancellation policy and how to cancel? If not, add it to the template today. This is the fastest fix on the list.
- Log in and time yourself cancelling. Count the screens between the account page and the cancellation taking effect. Anything above two needs a reason you would be willing to explain to a regulator.
- Check whether the Cancel control is visually weaker than Upgrade on the same page. If it is, level them.
- Search your codebase for the annual reminder job. If it does not exist, write it: same channel as signup, product name, amount, frequency, cancellation instructions.
- If you sell annual plans, add the 15 to 45 day pre-renewal notice. Set it at 30 days so a late send still lands inside the window.
- If you run trials longer than 31 days, add the 3 to 21 day pre-conversion notice, and store the send timestamp where support can see it.
- Write down which of these you have and when you shipped it. If a claim ever arrives, the record of the flow at the time of signup is the evidence, and it needs to be per-customer, not a screenshot of today's page. Our note on who owns your subscriber billing covers why exporting that history matters if you ever change platforms.
The rule that was vacated would have given you a safe harbour: comply with the checklist, sleep at night. Without it you are back to a standard ("simple mechanisms") that gets interpreted after someone complains. Building to California's text is the closest thing to a safe harbour still available, and it is a week of work at most.
Discussion
Sign in with Google or just a name. No email link, no password to remember.