A vacated rule is not a lifted obligation.
For most of a year the industry prepared for one date. The FTC's click-to-cancel rule was going to reach every negative option program in any medium, compliance was due July 14, 2025, and brands selling subscribe-and-save were rewriting their cancel flows. On July 8, six days out, the Eighth Circuit vacated the rule in full.
Many teams read that as a reprieve and stopped work. It was the wrong read. The rule fell on a procedural ground, not because the conduct it targeted turned out to be lawful, and none of the laws that already governed subscription selling moved.
What actually happened to the rule?
In Custom Communications, Inc. v. FTC, decided July 8, 2025, the court held that the FTC had skipped a required step: a preliminary regulatory analysis, owed once its own administrative law judge found the rule would cost the economy more than $100 million a year. The court called that deficiency fatal, declined to reach the substantive challenges, and vacated the entire rule, while saying plainly that it was not endorsing unfair or deceptive practices in negative option marketing.
The text on the books reverted to the 1973 Rule Concerning the Use of Prenotification Negative Option Plans at 16 CFR Part 425, which reaches one narrow thing: book-of-the-month style plans where a seller ships unless the buyer declines. The FTC published a conforming notice on February 12, 2026, and on March 11, 2026 opened an advance notice of proposed rulemaking asking whether and how to amend the rule, including whether to re-adopt provisions of the vacated 2024 version.
Read that sequence the way an operator should. The FTC says it has taken more than 100,000 complaints about negative options in the past five years, and its Bureau of Consumer Protection is on record that hard cancellations and unlawful retention tactics are still showing up. This is a gap in one rule, not an exit from the subject.
So what governs a subscription flow right now?
Two bodies of law that the vacatur never touched.
ROSCA, the federal floor
The Restore Online Shoppers' Confidence Act, 15 U.S.C. 8403, makes it unlawful to charge a consumer for anything sold online through a negative option feature unless the seller does three things: discloses all material terms clearly and conspicuously before obtaining billing information, obtains express informed consent before charging the card, and provides simple mechanisms for the consumer to stop the recurring charges. One sentence, and it is the shape of every subscription enforcement action you will read about.
State automatic renewal laws, the real specification
This is the part teams underestimate. California and New York each require more detail than ROSCA, and each applies to a business making an automatic renewal offer to a consumer in that state. For a national DTC brand, both apply to the same checkout.
California's law sits at Business and Professions Code 17602, amended by AB 2863 effective January 1, 2025, with the amendments reaching contracts entered into, amended or extended on or after July 1, 2025. It requires:
- Offer terms clear and conspicuous before the agreement is fulfilled, in visual proximity to the request for consent, with the post-trial price explained if there is a trial.
- Express affirmative consent to the renewal terms specifically, with nothing in the contract that undermines it.
- An acknowledgment the customer can retain, carrying the terms, the cancellation policy and how to cancel.
- Verification of that consent kept for at least three years, or one year after the contract is terminated, whichever is longer.
- Online termination for anyone who signed up online: exclusively online, at will, with no steps that obstruct or delay it, through a prominently located link or button or a prewritten termination email the customer sends as it stands.
- Cancellation in the same medium the customer used, or the one they are accustomed to using with the business.
New York General Business Law 527-a runs parallel and adds its own teeth. Cancellation must be as easy to use as the mechanism the customer used to consent, and available through every medium in which the business accepts consent. Obstruction is named rather than implied: hanging up on a customer who calls to cancel, giving false information about how to cancel, misrepresenting what cancellation costs. And goods shipped under a continuous service or automatic renewal without first obtaining affirmative consent are deemed an unconditional gift. The customer keeps them, owes nothing, and is not responsible for shipping them back.
What has to be on the product page before you take a card?
Everything material, next to the control that records consent, not in a policy page linked from the footer. For a supplement or wellness brand selling subscribe-and-save, the spot where the customer chooses the subscription has to show:
- what ships, and how often
- what it costs per shipment, and what it costs once any introductory price ends
- when the first renewal charge lands
- how to cancel
- a consent control that is about the subscription, not just about the order
The pattern that fails is a preselected radio button reading "Subscribe and save 15%" with the terms three scrolls down or behind a tooltip. California asks for visual proximity to the request for consent. A tooltip is not proximity, and a preselected option is not affirmative consent.
What does a working cancel path look like?
- Signed up online means cancellable online. Not by support ticket, not by phone, not by replying to an email and waiting.
- One obvious control in the account area, or a prewritten termination email.
- Authentication is allowed, but a customer who cannot or will not log in still needs an offline route.
- One confirmation step, then done, with billing actually stopped in the subscription record.
- Whatever your refund policy says about the period already paid for, said where the customer reads it before confirming.
If the only way out of your program is a conversation with a person, you do not have a cancel path. You have a retention funnel with the exit taken out.
Can you still run a save offer?
Yes, and the statute describes the build. California says a discount offer, a retention benefit or an explanation of what cancellation means is not an obstruction, provided that online the business simultaneously displays a prominently located, continuously and proximately displayed click to cancel link or button. New York permits the offer and separately forbids obstructing or unreasonably delaying the cancellation.
In practice: the save offer and the cancel button belong on the same screen, the button does not move or wait on an animation, and pressing it cancels. One screen, two choices, no sequence.
Which notices does the system owe, and when?
These get missed, because they live in an email or SMS platform rather than the storefront and nobody owns both.
- A free trial or promotional price lasting more than 31 days, California: notice 3 to 21 days before it expires.
- A free gift or trial longer than a month, New York: notice 3 to 21 days before the cancellation deadline for the first chargeable period.
- An initial term of a year or longer, California: notice 15 to 45 days before it renews.
- An annual plan, California: an annual reminder naming the product, the frequency and amount of the charges, and the means to cancel.
- A fee change, California: notice 7 to 30 days before it takes effect, with how to cancel, including for a price change the customer already consented to inside an existing plan.
- A material change including a price increase, New York: notice 5 business days to 30 days before the change.
Every one of those is an automated message triggered by a subscription event. If the email and SMS platform is not reading real events out of the store, they do not send, and nobody finds out until a chargeback or a complaint arrives.
Does Shopify or WordPress handle this for you?
No, and it is worth being exact about where the line falls.
Shopify gives you the mechanics. Subscriptions are a purchase option delivered through selling plans, using either the free first-party Shopify Subscriptions app or a third-party subscription app, with card details held by Shopify and subscription management, including cancellation, exposed inside customer accounts. That covers the billing engine and a baseline self-serve cancel. WooCommerce reaches the same place through an extension, with more left to you.
What neither covers is the product page disclosure, the consent record, the notice schedule, the cancel copy, the refund language, or whether the route a real customer walks holds together end to end. One Shopify detail worth knowing before you switch vendors: uninstall a third-party subscription app and the data it created is deleted after 48 hours, apart from the subscription contracts and payment information.
Two more pieces are yours on either platform. Tracking, because if cancellations, pauses and failed payments are not events in your analytics you are steering on gross new subscribers alone. And the support handoff, because whoever answers a cancellation message has to be able to action it that day.
Five things to check on your own storefront
- Subscribe to your own product with a real card, then write down what the page told you before you consented.
- Find the cancel control while logged in, and time it.
- Cancel, and confirm the next charge is gone in the subscription record, not only in a banner.
- Check whether the trial, renewal, fee change and annual reminder messages exist at all.
- Pull the consent record for that order. If you cannot produce it, the three year retention requirement is unmet by definition.
When one of those turns up nothing, the repair is almost always in the plumbing between the storefront, the subscription app, the email platform and whoever handles support. That is the work in CPG and ecommerce website development, and Shopify and WordPress development when the platform itself is the open question. The same handoff discipline applies on the clinical side, which we walk through in telehealth intake, booking, checkout and follow-up.
This is operational guidance, not legal advice. Automatic renewal law varies by state and keeps moving, and the federal rulemaking is open again. Have qualified counsel review your specific offer, your disclosures and your cancellation flow before you launch or change them.
Common questions
Is the FTC click-to-cancel rule still in effect?
No. The Eighth Circuit vacated it in full on July 8, 2025 in Custom Communications, Inc. v. FTC, on the procedural ground that the FTC skipped a required preliminary regulatory analysis. The rule on the books reverted to the 1973 Rule Concerning the Use of Prenotification Negative Option Plans at 16 CFR Part 425. In March 2026 the FTC opened an advance notice of proposed rulemaking asking whether and how to amend it.
Do I still have to let customers cancel a subscription online?
In practice, yes. ROSCA requires a simple mechanism to stop recurring charges, and state automatic renewal laws are more specific. California requires a business that accepts an online signup to let the customer terminate exclusively online, at will, through either a prominently located link or button or a prewritten termination email the customer can send without adding anything.
Can I show a save offer when someone tries to cancel?
Yes, within limits. California treats a discount offer or retention benefit as something other than an obstruction only if, online, a prominently located click to cancel link or button is displayed at the same time and stays visible beside the offer. New York permits a retention offer and separately forbids obstructing or unreasonably delaying the cancellation.
Does Shopify handle subscription compliance for me?
No. Shopify provides the mechanics: selling plans through the first-party Shopify Subscriptions app or a third-party app, stored payment methods, and subscription management inside customer accounts. The product page disclosure, the consent record, the renewal and trial notices, the cancel copy and the support handoff are yours to build and keep.
What happens if I ship a subscription order without consent?
Under New York General Business Law 527-a, goods sent under a continuous service or automatic renewal without the consumer's affirmative consent are deemed an unconditional gift. The customer may keep them, owes nothing, and is not responsible for return shipping. California separately requires keeping verification of affirmative consent for at least three years, or one year after the contract ends, whichever is longer.
Which notices does a free trial owe, and when?
California requires notice 3 to 21 days before a free trial or promotional price lasting more than 31 days expires. New York requires notice 3 to 21 days before the cancellation deadline for the first chargeable period when a free gift or trial runs longer than a month. Both notices must say how to cancel.
Sources
- Custom Communications, Inc. v. FTC, No. 24-3137 (8th Cir. July 8, 2025) checked 2026-10-02
- FTC, Negative Option Rule, rulemaking record and Federal Register notices checked 2026-10-02
- FTC seeks public comment on an advance notice of proposed rulemaking, March 11, 2026 checked 2026-10-02
- Restore Online Shoppers' Confidence Act, 15 U.S.C. 8403 checked 2026-10-02
- California Business and Professions Code 17602, as amended by AB 2863 checked 2026-10-02
- New York General Business Law 527-a, unlawful practices checked 2026-10-02
- Shopify Help Center, Subscriptions checked 2026-10-02