FTC Revives Click-to-Cancel Rule: New Risks for Subscription Businesses
In Short
The Situation: The Federal Trade Commission's ("FTC") 2024 Click-to-Cancel Rule ("the Rule"), which required subscription services to disclose clearly material terms, obtain express informed consent, and provide simple cancellation methods, was vacated in 2025 by the Eighth Circuit on procedural grounds. But the FTC never stopped enforcing the core principles of the Rule under Section 5 of the FTC Act and the Restore Online Shoppers' Confidence Act ("ROSCA").
The Result: The FTC has secured major settlements against subscription services perceived as unfair, and in March 2026 launched an Advance Notice of Proposed Rulemaking ("ANPRM") to revive the Rule. Meanwhile, roughly 30 states have enacted their own automatic-renewal laws, some of which are stricter than the vacated federal rule.
Looking Ahead: Companies should proactively review every stage of the consumer journey, from sign-up and consent flows to cancellation mechanisms, in order to align with the anticipated federal rule and the patchwork of existing federal and state laws and precedent already in force.
Introduction
The FTC's 2024 Negative Option Rule, known as the "Click-to-Cancel" Rule, required sellers to disclose clearly the material terms of their services, obtain consumers' express informed consent before charging them, and provide a cancellation mechanism at least as simple as the enrollment process. In 2025, a federal court of appeals vacated the Rule due to violations of the Administrative Procedure Act during the rulemaking process. The FTC has continued to challenge subscription practices under Section 5 of the FTC Act, which empowers the FTC to take action against "unfair or deceptive acts or practices" in commerce, and which addresses negative-option practices in online transactions.
The FTC has since looked to revive the Click-to Cancel Rule. Perhaps as a foreshadowing, FTC Bureau of Consumer Protection Director Christopher Mufarrige in a March 5, 2026, speech emphasized the agency's commitment to "combating deceptive negative option subscriptions." Less than a week later, the FTC announced an ANPRM and initiated the process of reintroducing a version of the Click-to-Cancel Rule. The agency noted in its ANPRM announcement that it remains focused on the same core concerns that animated the 2024 Rule. Absent a formal rule, the FTC continues to take action against certain subscription practices under Section 5 of the FTC Act and ROSCA, while state legislatures and attorneys general are also proactively putting up guardrails against certain subscription-model practices. Therefore, these practices continue to be under the microscope and subject to enforcement action, even without a formal rule.
Background
The FTC adopted its original Negative Option Rule in 1973, but the original rule addressed only prenotification plans—a category of negative option where a seller periodically notifies consumers of upcoming merchandise shipments, and the consumer's failure to decline is treated as acceptance of the shipment and an agreement to pay. A negative option, more broadly, is when a seller treats a consumer's silence, failure to opt out, or failure to cancel as acceptance of an offer or of continued charges to the consumer's account. As subscription commerce expanded to the internet and e-commerce, the gap between the narrow 1973 Rule and modern business models became increasingly apparent. Online vendors increasingly structured payment options as automatic renewals (subscriptions that renew for additional periods unless the consumer affirmatively cancels), continuity plans (arrangements where consumers receive periodic shipments of products until they cancel), and free-to-pay conversions (offers that begin with a free trial and automatically convert to a paid subscription unless the consumer opts out), that were not otherwise covered by the rule.
The FTC spent years addressing negative-option practices through enforcement actions under Section 5, guidance, and the 2024 Click-to-Cancel Rulemaking. The Click-to-Cancel Rule was designed to encompass automatic renewals, continuity plans, free-to-pay conversions, and prenotification plans, and to put a spotlight on three critical concerns: (i) "clear and conspicuous disclosure," which requires that consumers be informed of the material terms of a recurring offer in a manner they can actually notice and understand before they are charged; (ii) "express informed consent," which requires that the seller obtain an affirmative agreement to the recurring charge, rather than relying on consumer inertia or confusion; and (iii) "simple cancellation," the rule's namesake requirement, which requires that terminating a subscription be no more difficult than initiating one.
Current Status
The 2024 Click-to-Cancel Rule is not in effect because the U.S. Court of Appeals for the Eighth Circuit vacated the Rule in full, finding the FTC had not completed the preliminary regulatory analysis required by law for new rules that will have a sufficiently large effect on the economy. Since that time, the FTC continued to challenge negative option practices under two principal sources of authority: Section 5 of the FTC Act and ROSCA. Enacted in 2010, ROSCA prohibits the use of negative options in online transactions unless the seller clearly and conspicuously discloses all material terms before obtaining the consumer's billing information, obtains express informed consent before charging a consumer's account, and provides "simple mechanisms" for the consumer to stop recurring charges. Compared to the Click-to-Cancel Rule, however, ROSCA is more limited in scope and is less specific in its terms. It applies only to transactions effected on the internet, and it does not define "material terms" or what constitutes a "simple mechanism" for cancelling recurring charges.
Recent enforcement actions demonstrate the FTC's willingness to pursue substantial penalties under these authorities. For example, in Care.com (2024), the FTC invoked Section 5 and ROSCA to secure an $8.5 million settlement against a company it accused of failing to disclose material terms before billing customers and making it nearly impossible to cancel subscriptions. More recently, the FTC used Section 5 and ROSCA to obtain a record $2.5 billion settlement from Amazon, resolving allegations that the company enrolled millions of consumers in Amazon Prime without their informed consent and deliberately complicated the cancellation process. The FTC has also demonstrated its willingness to allege that violations of the now-vacated Click-to-Cancel Rule are also violations of Section 5. The FTC did this explicitly in its NextMed complaint, where it essentially applied the Click-to-Cancel Rule after it was vacated by alleging that those actions were simply violations of Section 5. Specifically, the complaint alleged that NextMed failed to disclose material terms, charged consumers without express informed consent, and made cancellation deliberately difficult—mirroring the Click-to-Cancel Rule's three core requirements. These cases underscore that the FTC views subscription-related deception and obstruction as serious violations warranting aggressive enforcement.
Beyond these enforcement actions, the FTC is seeking to bolster its regulatory toolkit. A reenacted rule would give the FTC a clearer pathway to universal consumer redress under Section 19 of the FTC Act, which authorizes restitution and damages for rule violations without requiring proof that the conduct was "dishonest or fraudulent." In March 2026, the FTC announced an ANPRM, soliciting public comment whether the current 1973 rule should be amended, whether provisions from the vacated rule should be revived, whether alternative approaches would be preferable, and whether a new rule should provide differential treatment for certain industries. Comments were due on April 13, 2026. Approximately 100 comments were submitted for review.
Federal regulations are only part of the relevant legal landscape. Approximately 30 states have enacted their own automatic-renewal or negative-option laws. Some of these laws already mirror or exceed key elements of the vacated 2024 federal rule. California's Automatic Renewal Law, for instance, requires any business serving customers under automatic-renewal or continuous-service agreements to provide customers an annual reminder that discloses their upcoming renewal, the price to be charged, and the available cancellation mechanisms.
Practical Implications
Businesses offering services under what could be characterized as a negative-option model should consider reviewing the full consumer journey, from advertising and checkout screens to reminder notices, customer-service scripts, cancellation processes, and complaint handling under the terms of the renewed Click-to-Cancel Rule and recent enforcement actions. Because of the evolving regulatory landscape at both the federal and state levels, the substantial penalties at stake, and the aggressive posture regulators have taken in recent enforcement actions, there are risks associated with noncompliance. Companies should consider assessing their subscription practices to safeguard against consumer complaints and potential investigation.
Four Key Takeaways
- The Click-to-Cancel Rule was vacated on procedural grounds, not on the merits, and the FTC views the underlying consumer-protection issues as a continuing enforcement priority.
- The FTC's recent actions signal that unfair subscription-related violations are a major priority. The FTC is willing to enforce the substance of the vacated rule by reframing its requirements as standalone Section 5 violations. Businesses should expect continued scrutiny in this area.
- A new federal rule is likely on the horizon. Businesses should monitor developments of the FTC's March 2026 Advance Notice of Proposed Rulemaking closely and begin preparing now for requirements that may be broader or more prescriptive than the 2024 version.
- State laws create independent and immediate compliance obligations. Approximately 30 states have their own automatic-renewal or negative-option statutes. Some of these, such as California's Automatic Renewal Law, already match or exceed the requirements of the vacated federal rule. For companies operating across state lines, this patchwork means compliance cannot wait for federal action. A compliance-by-design approach that meets the most demanding state standards is far more practical than a jurisdiction-by-jurisdiction reaction.
