Key points

• The Eighth Circuit vacated the Federal Trade Commission's amended Negative Option Rule in 2025, so the rule's cancellation, disclosure and consent provisions are not in force.
• The underlying risk has not gone away. The Restore Online Shoppers' Confidence Act (ROSCA), the FTC Act and state automatic renewal laws still require clear disclosure, express consent and simple cancellation.
• Enforcement now comes from the FTC under ROSCA, state attorneys general, and class action plaintiffs relying on state statutes. Several state laws were tightened recently.
• The practices that draw the most scrutiny are familiar: free trials that convert silently, cancellation paths longer than the sign-up path, and save offers that function as obstacles.
• A retailer with a membership, replenishment or loyalty subscription program should audit its flows now, because each one can be tested by a regulator or plaintiff in minutes.

Where the law stands

The FTC's amendments to its Negative Option Rule, often called the click-to-cancel rule, were finalized in late 2024 and would have required sellers to make cancellation as easy as sign-up, to disclose material terms before collecting billing information, and to obtain express informed consent to the negative option feature. In 2025 the United States Court of Appeals for the Eighth Circuit vacated the rule on procedural grounds, finding that the agency had not completed a required preliminary regulatory analysis. The court did not hold that the practices the rule targeted are lawful.

For a general counsel, the practical takeaway is that the substantive standard the FTC wanted still has a legal home elsewhere. ROSCA makes it unlawful to charge consumers for goods or services sold online through a negative option feature unless the seller clearly and conspicuously discloses all material terms before obtaining billing information, obtains the consumer's express informed consent, and provides a simple mechanism to stop recurring charges. The FTC has continued to bring ROSCA cases, including against large online platforms, and has signaled that it may restart rulemaking.

State automatic renewal laws carry more weight now

Most states have an automatic renewal statute, and many have been amended in recent years to add click-to-cancel style requirements. California's law, for example, now requires that consumers be able to cancel using the same medium they used to sign up, requires an acknowledgment that includes cancellation instructions, and requires notice before the end of a long free trial or before a price change. Other states have adopted similar or stricter requirements, including mandatory reminders for annual renewals and limits on retention offers.

These statutes are enforced by attorneys general and, in several states, by private plaintiffs who can recover statutory damages or restitution. That is why the class action docket for subscription programs has remained busy even without the federal rule. Retailers with a national customer base are subject to the most demanding state requirement in practice, because a single checkout flow rarely varies by state.

Five practices to fix first

In our experience advising retailers, the same issues appear in most programs reviewed:

• Free trials that convert without a clear reminder. Disclose the price and date of conversion next to the call to action, and send a reminder where state law requires one.
• Asymmetric cancellation. If a customer can join in two taps in an app, cancellation should not require a phone call or chat session. Online cancellation should be reachable from the account page without a search.
• Retention offers that block exit. A single, easily declined save offer is generally defensible. Repeated screens, confirmation shaming or hidden decline buttons are not.
• Bundled consent. Agreeing to terms of sale is not express consent to recurring billing. Use a separate affirmative action, record it, and keep the record.
• Partner and marketplace enrollment. Offers presented at checkout by a third party, often with pre-filled payment details, are a repeated source of complaints. Retailers are exposed when their checkout carries the offer.

Building a defensible program

Documentation matters as much as design. We recommend maintaining a record of every version of each enrollment and cancellation flow, with dates, screenshots and the legal review that approved it. When a regulator or plaintiff challenges a flow, the first question is what a consumer saw on a specific date. A retailer that can answer that precisely is in a far better position to resolve the matter early.

Customer service scripts and agent behavior are part of the same risk. Cancellation requests made by phone or chat should be honored without unnecessary delay, and complaint data should be reviewed regularly for patterns. The FTC and state regulators routinely start from complaint volumes, and a rising number of cancellation complaints is often the earliest signal that a flow is causing harm.

Contracts with payment processors and marketing partners deserve attention as well. Card networks have their own rules on recurring billing and free trials, and chargeback ratios can trigger processor intervention before any regulator calls. Agreements with partners who market or enroll customers on the retailer's behalf should require compliance with the retailer's disclosure standards and give the retailer audit and termination rights.

Looking ahead

Expect continued state legislative activity, further FTC enforcement under ROSCA, and possibly a renewed federal rulemaking. Retailers operating in the United Kingdom should also prepare for the new subscription contracts regime, which brings its own pre-contract information, reminder and cooling-off requirements. Treating the vacated federal rule as a design benchmark rather than a repealed obligation is the safest course.