There is no federal click-to-cancel rule in force. The FTC finalized the rule in October 2024, the Eighth Circuit vacated it in full on July 8, 2025, in Custom Communications v. FTC, and the FTC formally restored the 1973 Negative Option Rule in February 2026. What still binds sellers is ROSCA, the 2010 statute requiring clear disclosure, express consent, and a simple cancellation path for online subscriptions, plus state auto-renewal laws that have only tightened since the vacatur. The FTC proved it means this by settling with Amazon for $2.5 billion over Prime enrollment and cancellation in September 2025.
Sellers who built their cancellation flows around the FTC's click-to-cancel rule spent 2025 in a strange position: the rule they were preparing for was struck down six days before it was supposed to take effect, and the compliance work they did was suddenly voluntary. The headlines said the rule was dead. The headlines were right about the rule and wrong about what it meant, because the obligations never went away, they just changed address.
The rule's history is short and sharp. The FTC finalized its amended Negative Option Rule in October 2024, requiring cancellation as easy as signup. The Eighth Circuit vacated it in full on July 8, 2025, on procedural grounds: the Commission had skipped a required preliminary regulatory analysis for a rule with an annual effect over $100 million. On February 12, 2026, the FTC restored the 1973 version of the rule, which covers only prenotification plans like book-of-the-month clubs and almost nothing a modern online merchant sells.
ROSCA, the Restore Online Shoppers' Confidence Act, is the law that actually governs online subscriptions, and the Eighth Circuit ruling did not touch it. Since 2010 it has required sellers to disclose all material terms clearly before taking billing information, obtain the consumer's express informed consent before charging, and provide simple mechanisms to stop recurring charges. Section 5 of the FTC Act sits alongside it as a general ban on unfair practices. Together they cover everything the vacated rule was going to cover, just without the rule's specific mechanics.
The FTC showed how seriously it takes those statutes on September 25, 2025, when it settled with Amazon over Prime enrollment and cancellation for $2.5 billion: a $1 billion civil penalty and $1.5 billion in refunds to an estimated 35 million customers. The case was brought under ROSCA and Section 5, not under the vacated rule. A seller who treats the vacatur as permission to make cancellation hard is reading the wrong lesson from the Amazon settlement.
While the federal rule was dying, state auto-renewal laws were multiplying. California's AB 2863 tightened its rules for contracts entered into, amended, or extended on or after July 1, 2025, and eight states have added or tightened their own laws since July 2025. State laws vary in detail, but they converge on the same requirements: clear disclosure before signup, a reminder before renewal, and a cancellation path that does not require a phone call when signup took a click.
The practical effect is that a national seller cannot run one cancellation flow anymore. The strictest state in your customer base sets the floor, and the floor is close to what the vacated federal rule required. Building to the strictest state is cheaper than building fifty flows, and it is the only approach that survives a state attorney general's review.
Do not rip out the click-to-cancel flow you built. The work is still the right standard, and it is still what ROSCA, the state laws, and the Amazon settlement all point toward. Keep the self-service cancellation in the same medium as signup, keep it as easy as signup, and keep the confirmation immediate. The vacatur changed which document requires those things. It did not change whether customers and regulators expect them.
On March 11, 2026, the FTC opened a new rulemaking with an Advance Notice of Proposed Rulemaking, asking whether the rule should be amended and whether the vacated provisions should be revived. That is the first step of a rulemaking, not a rule, and as of now there is no proposed rule on the table. Watch it, but do not wait for it. The obligations in force today are enough to build to, and they are not going away.
Readers working through “The FTC Click-to-Cancel Rule Is Dead. The Obligations Are Not” often find these earlier guides useful as well: Fake Ticket Listings: The Resale Checks That Catch Most Scams, Fake Charity Scams After a Disaster: How to Check Before You Give, and Counterfeit Listings on Marketplaces: How to Report Them, and What Actually Gets Taken Down.
No. The Eighth Circuit vacated it in full on July 8, 2025, in Custom Communications v. FTC, days before its July 14 compliance date. In February 2026 the FTC formally restored the 1973 Negative Option Rule, which covers only prenotification plans and almost nothing a modern online merchant sells.
ROSCA, the Restore Online Shoppers' Confidence Act of 2010, requires clear disclosure of material terms, express informed consent before charging, and simple mechanisms to stop recurring charges. Section 5 of the FTC Act and state auto-renewal laws apply alongside it, and the FTC enforced them against Amazon for $2.5 billion in September 2025.
Yes, and they have tightened since the federal rule was vacated. California's AB 2863 applies to contracts entered into, amended, or extended on or after July 1, 2025, and eight states have added or tightened their own laws since July 2025. The strictest state in your customer base effectively sets your floor.
Yes. The work is still the right standard under ROSCA and state law, and the FTC's new rulemaking, opened March 11, 2026, may revive the vacated provisions anyway. Keep self-service cancellation in the same medium as signup, as easy as signup, with immediate confirmation.