If you run a subscription business, you have probably heard two contradictory things this year. One: the FTC's "click to cancel" rule was struck down, so the pressure is off. Two: companies are still being fined enormous sums over exactly the practices that rule targeted. Both are true, and the space between them is where a lot of businesses are about to make an expensive mistake.
This is the question we keep seeing asked, in slightly different words, across search, Reddit, and founder communities: "The FTC click to cancel rule was vacated, so do I still need to make cancellation easy?" The short answer is yes, and this article explains precisely why, what actually changed in 2025 and 2026, and what a defensible subscription flow looks like now. Getting this right is not just legal hygiene. In a market where trust is a growth lever, a cancellation flow that treats people fairly is a competitive advantage.
What actually happened to the click to cancel rule
Let's be exact, because the imprecision is where businesses get into trouble. On July 8, 2025, the US Court of Appeals for the Eighth Circuit vacated the FTC's amended Negative Option Rule, the rule popularly called "click to cancel," just days before it was set to take full effect on July 14, 2025. According to the law firm Latham & Watkins, the court vacated the rule in its entirety, which the FTC had been poised to start enforcing in full on July 14, 2025.
Here is the detail that matters most, and that the "the rule is dead" takes leave out. The rule was struck down on procedural grounds, not because the court decided its substance was wrong. According to Latham & Watkins, the fatal flaw was that the FTC failed to conduct a required preliminary regulatory analysis for a rule with an estimated annual economic effect of at least $100 million, a procedural error that necessitated complete vacatur. The same court, in the same opinion, acknowledged support for the FTC's effort to root out unfair and deceptive practices in negative option marketing. The rule fell on paperwork, not principle.
And the story did not stop there. According to the law firm Gibson Dunn, on January 30, 2026 the FTC submitted a draft Advance Notice of Proposed Rulemaking to begin a new rulemaking process, with public comments due April 13, 2026. In other words, the agency is already rebuilding the rule the right way. Treating the vacatur as a permanent reprieve is a bet against a regulator that has openly restarted the clock.
So is "click to cancel" still enforced? Yes, through other law
This is the core misunderstanding, so it deserves a direct answer. The specific rule is gone for now. The obligations behind it are not. The FTC did not lose its underlying authority when it lost this one rule.
According to Latham & Watkins, online businesses with automatic renewal and other covered practices remain subject to the FTC's broader authority under Section 5 of the FTC Act to police unfair and deceptive practices. Section 5 is the agency's general-purpose tool against deceptive conduct, and it long predates the vacated rule. The manipulative cancellation flow that would have violated "click to cancel" can still be an unfair or deceptive practice under Section 5.
There is a second layer that never went anywhere. According to the law firm Mayer Brown, the original FTC negative option rule and the Restore Online Shoppers' Confidence Act, known as ROSCA, remain on the books, still requiring businesses to make certain disclosures and obtain consent before completing a transaction with an automatic-renewal program. ROSCA is a federal statute, not a rule the FTC can lose in a procedural challenge.
And then there are the states. According to the law firm Gibson Dunn, companies should expect cancellation design, consent flows, and subscription disclosures to remain under close scrutiny, including active enforcement under both ROSCA and Section 5. On top of that, according to Mayer Brown, states including California and New York already have comprehensive automatic-renewal laws on the books, several of which mirror the very requirements the federal rule would have imposed. If you serve customers nationwide, the vacatur of one federal rule does not exempt you from a patchwork of state laws that say much the same thing.
So the honest summary is this. One specific federal rule is paused. Section 5, ROSCA, and a growing set of state laws are all still live, and the FTC is actively rebuilding the rule. The precise answer to "do I still need easy cancellation?" is yes.
The enforcement is not theoretical, and the numbers are large
If you are tempted to treat this as a risk on paper only, the recent settlements should recalibrate that. Regulators have kept moving against manipulative subscription design straight through the period when the rule itself was in limbo.
The headline case is Amazon. According to The Regulatory Review, the FTC secured a historic $2.5 billion settlement against Amazon in September 2025, including the largest ever civil penalty in a case involving an FTC rule violation, over allegations that the company used deceptive methods to enroll consumers in Prime while making cancellation exceedingly difficult. That settlement landed after the rule was vacated, which tells you how little the vacatur changed the agency's appetite.
It is not an isolated example. According to the same Regulatory Review analysis, FTC v. Care.com resulted in an $8 million settlement in the summer of 2025, where the complaint used the term "dark pattern" to describe a difficult-to-navigate cancellation page. Earlier actions set the pattern: according to the law firm Koley Jessen, the FTC required Publishers Clearing House to pay $18.5 million in 2023 over deceptive purchase-related claims, and Credit Karma to pay $3 million over "pre-approved" misrepresentations that were distributed to more than 50,000 affected consumers.
Two trends in this enforcement should worry any subscription operator specifically. First, the FTC is increasingly naming individual executives as defendants, not just companies, which pushes liability onto the people who approve these designs. According to the law firm Duane Morris, the FTC's dark-patterns complaint against Adobe named two executives responsible for digital sales and marketing, continuing a trend of holding responsible individuals personally accountable. Second, regulators frame these cases around intent. The agency treats a hard-to-cancel flow not as a harmless UX quirk but as deliberate conduct, which is a far more dangerous posture to be on the wrong side of.
What counts as a problem cancellation flow
If the standard is no longer a single tidy rule but "is this unfair or deceptive," you need a working definition of the designs that draw fire. These are the patterns regulators have repeatedly flagged, described plainly.
The most cited is asymmetry: sign-up takes one click online, but cancellation requires a phone call, a chat agent, or a mailed letter. When leaving is structurally harder than joining, that gap is exactly what enforcers point to. Related is the maze: a cancellation path buried several screens deep, behind ambiguous menu labels, so the user has to hunt for the exit. Then there is manipulative friction at the moment of cancellation, the guilt-worded confirmations and repeated "are you sure you want to lose everything" interstitials designed to wear the user down rather than inform them.
There are also the entry-side problems. Pre-checked boxes that assume consent to an auto-renewal instead of asking for it, free trials that silently convert to paid without clear disclosure, and renewal terms hidden in fine print rather than disclosed clearly and conspicuously before the charge. If any of these describe your funnel, the vacatur of the click to cancel rule does not protect you, because each can be characterized as unfair or deceptive under authority that is very much still in force. This is the same underlying problem our writing keeps returning to: an interface engineered to look acceptable while quietly working against the user. Our guide to accessibility overlays makes the point in a different domain, and the wider Sitejar blog covers the deceptive-design and consent topics behind these cancellation cases in plain English.
Turn compliance into trust: a practical standard
Here is the reframe worth sitting with. The businesses that will do best are not the ones asking "what is the minimum I can get away with now that the rule is gone." They are the ones treating easy, honest cancellation as a feature. Subscription customers who know they can leave without a fight are more likely to sign up in the first place, and more likely to come back. Precision here builds trust, and trust converts.
A defensible and customer-respecting standard looks like this in practice. Make cancellation at least as easy as sign-up, so if a customer can subscribe online in a couple of clicks, they can cancel online in a couple of clicks, through the same channel. Get genuine consent up front, with clear and conspicuous disclosure of price, renewal cadence, and terms before the charge, and no pre-checked boxes. Keep the cancellation flow honest, allowing a retention offer if you like, but never trapping the user in loops or shaming them into staying. And treat this as ongoing, because a redesign, a new vendor, or an A/B test can quietly reintroduce a dark pattern that was not there last quarter.
That last point is where continuous checking earns its place, and it is exactly what Sitejar is built to surface. Deceptive-design issues sit right alongside accessibility, privacy, and security as things a scan can catch on the live page. If you are not sure whether your own sign-up or cancellation flow crosses a line, this is the moment to look: you can scan your site with Sitejar for free, up to five pages, no signup, and see the deceptive-design findings mapped to the concern they raise. It is a fast way to replace "we think we are fine" with something you can actually check, and to catch the accidental dark pattern before a regulator or a frustrated customer does.
The bottom line
The FTC click to cancel rule was vacated in July 2025, but that is the beginning of the answer, not the end of it. The rule fell on a procedural technicality, the FTC restarted the rulemaking in early 2026, and in the meantime Section 5 of the FTC Act, the original negative option rule, ROSCA, and a growing list of state laws all still require honest disclosure, real consent, and cancellation that is as easy as sign-up. The record-setting settlements of 2025, led by Amazon's $2.5 billion, landed in exactly this "no rule" period, and increasingly they name executives personally. The precise, trust-building move is to stop asking whether you can get away with a harder cancellation flow, and to make leaving as easy as joining. That precision is what earns customer trust, and it is the version of compliance that also happens to be good business.
Sources
Latham & Watkins, Eighth Circuit Vacates FTC's Click-to-Cancel Rule
Gibson Dunn, FTC Restarts Negative Option Rulemaking After Eighth Circuit Vacatur
Mayer Brown, Eighth Circuit Vacates FTC's Revised Negative Option Rule
The Regulatory Review, Regulating Dark Patterns
Koley Jessen, What Are Dark Patterns
Duane Morris, FTC Brings Dark Patterns Complaint Against Company and Two Executives
This article is educational and reflects Sitejar's point of view. It is not legal advice. For your specific situation, consult a qualified attorney.