The Rule Was Struck Down. The Enforcement Wasn't.

What subscription businesses need to know about cancellation compliance right now, regardless of the FTC's Click-to-Cancel rule status

The rule requiring cancellation to be as easy as signing up got struck down by a federal court last year. The enforcement didn't stop. Here's what's actually still in effect for subscription businesses.

The Rule Was Vacated, Not The Law It Was Based On

The FTC's "Click-to-Cancel" rule, formally an amendment to the Negative Option Rule, was struck down by a federal appeals court in July 2025 on procedural grounds, not on the merits of what it required. Importantly, the underlying law it was built on, the Restore Online Shoppers' Confidence Act (ROSCA), was never touched by that ruling. ROSCA already requires clear disclosure of subscription terms, informed consent before charging a customer, and a simple mechanism to stop recurring charges.

Enforcement Never Paused

Recent ROSCA enforcement actions have hit Uber, Amazon, and JustAnswer, and Instacart settled for $60 million in December 2025. None of these cases required the vacated Click-to-Cancel rule to happen; they were brought under ROSCA directly, which has been enforceable the entire time.

The FTC Is Already Trying To Bring The Rule Back

A formal rulemaking notice issued earlier this year signaled the FTC's intent to reissue a version of the Click-to-Cancel rule. Waiting to see whether or when it returns misses the more important point: the underlying disclosure and cancellation obligations are enforceable right now, independent of that rule's status.

The Core Standard Is Simple To State, Harder To Audit

Cancellation can't require meaningfully more effort than signup did. If signing up takes a single click online and canceling requires a phone call, a retention conversation, or a mailed form, that asymmetry is exactly what recent enforcement actions have targeted.

The Takeaway

Could your customer actually cancel your subscription as easily as they signed up for it? This is worth testing directly, walking through the flow the way an actual customer would, rather than assuming it's compliant because no one has raised it yet.