In 2024, the FTC finalized the Click-to-Cancel Rule: if a customer can sign up for a subscription online, they have to be able to cancel online too. Simple concept.
In 2025, a federal appeals court threw it out - not because the rule was wrong, but because the FTC made a procedural error during the rulemaking process.
The FTC kept enforcing the core principles anyway, under existing authority. And in March 2026, the agency launched a formal Advance Notice of Proposed Rulemaking to bring the rule back - this time with the paperwork done right.
If you run a subscription-based business of any kind, you're already living inside the enforcement environment this rule is trying to codify. The question is whether your cancellation flow reflects that.
What the Rule Actually Requires
The reinstated version is expected to cover the same ground as the original:
- Cancellation must be as easy as sign-up. If someone can subscribe in two clicks, they have to be able to cancel in two clicks. Not "call us between 9 and 5." Not "submit a request and we'll process it in 5-7 business days."
- Material terms must be disclosed clearly before billing. What it costs, how it renews, how to cancel - all of that has to be visible before you take the card number.
- Express informed consent is required. A pre-checked checkbox doesn't count. The customer has to affirmatively agree to the recurring charge.
- No misrepresentations about any subscription terms - price, trial period, or how to stop it.
Violations of the underlying law - ROSCA, the Restore Online Shoppers' Confidence Act - can run to $51,744 per violation. Civil penalties under a finalized FTC rule would be similar.
Why "It's Not Finalized Yet" Is Not a Safe Posture
Here's the problem with waiting for the formal rule: you're already exposed.
The FTC has been actively enforcing Click-to-Cancel principles since the 2025 court ruling - using Section 5 of the FTC Act and ROSCA, which have been on the books for years. The agency has secured major settlements against companies with cancellation flows the FTC found deceptive. None of those settlements required the 2024 rule to be in force.
On top of that, Jones Day's analysis found that roughly 30 states have passed their own automatic-renewal laws. California's is among the strictest, requiring online cancellation if the sign-up happened online - a requirement that was updated in July 2025. If you have customers in California and your cancellation process requires a phone call, you may already have a state compliance problem.
The FTC's rule, when finalized, would create a federal floor. You'd still need to comply with stricter state laws on top of it.
The Three Things to Audit Right Now
You don't need to wait for a finalized rule to get your house in order. Here's where to start:
1. Map your cancellation flow end-to-end. Click through it yourself, like a customer who wants out. Count the steps. Count the screens. Count the friction. If it's harder to cancel than it was to sign up, you have a problem that exists under current law - not just pending rules.
2. Check your sign-up disclosures. Is the price clearly stated? The renewal cadence? The cancellation process? Run the "grandmother test" - if someone who doesn't read terms of service would be surprised by the charge six months later, your disclosures aren't clear enough.
3. Look at your retention scripts. If your cancellation process routes through a "save" conversation, that's not inherently illegal - but the way it's structured matters. Misleading customers about what they're agreeing to stay enrolled in is exactly what ROSCA targets.
Who Should Be Most Concerned
The FTC enforcement history to date has focused on companies with obviously predatory cancellation practices - gym memberships, subscription boxes, digital services that made cancellation a labyrinth.
But the March 2026 ANPRM explicitly signals that the agency wants broader coverage. The FTC Bureau of Consumer Protection's director said in a March 5 speech that the agency is "committed to combating deceptive negative option subscriptions" - language that covers a lot of small business subscription models that don't think of themselves as "negative option" businesses.
Practically, any business where a customer continues being charged month over month is in scope. That includes:
- SaaS and software tools
- Retainer-based service businesses
- Membership communities
- Subscription boxes
- Recurring maintenance or cleaning contracts
The rule isn't final. It may take another year or more to finalize. But the enforcement environment around subscription practices is already tight, the state patchwork is already live in dozens of states, and the FTC is actively securing settlements right now.
The smart move isn't waiting. It's auditing your cancellation flow this week and fixing anything that would embarrass you in front of a regulator.
Source reading: Jones Day analysis of FTC's March 2026 ANPRM - FTC.gov - Bureau of Consumer Protection, March 2026 - commlawgroup.com summary
Sam Torres covers policy and regulatory news for The Useful Daily.