For a few months in early 2025, subscription businesses had one federal rule to follow. The FTC's Click-to-Cancel rule, formally the Negative Option Rule, gave every online seller in America a single national standard for how consumers had to be able to sign up for and cancel a recurring charge. Then, in July 2025, the Eighth Circuit vacated it on procedural grounds. The rule is gone.
Many merchants read the headlines and assumed the regulatory pressure eased. It didn't. In the absence of a federal floor, the state statutes that were always there stepped into the foreground, and several states have amended their laws or issued new enforcement guidance in the year since. The result is a patchwork with real teeth: California can treat charges collected under a non-compliant flow as an unconditional gift to the consumer. Colorado penalties reach $20,000 per violation. Virginia's "as easy as sign-up" cancellation requirement took effect on July 1, 2026.
This guide walks through what changed, which states matter most, and what a subscription business selling nationally should check first.
Not legal advice
This article is compliance information for subscription business operators. CancelCheck is not a law firm, does not provide legal advice, and nothing here creates an attorney-client relationship. For legal advice on your specific situation, consult a licensed attorney.
What happened to Click-to-Cancel
The FTC finalized the Click-to-Cancel rule in October 2024. It required that any seller offering a negative-option feature (a subscription that automatically renews, a free trial that converts to paid, a bundled add-on that continues until cancelled) had to disclose the material terms clearly, obtain the consumer's express informed consent to those terms separately from anything else, and offer a simple cancellation mechanism at least as easy as the one used to sign up.
Industry groups challenged the rule in the Eighth Circuit. On July 8, 2025, the court vacated it. The court did not rule on whether the substance was good or bad regulation. It ruled that the FTC failed to complete a required preliminary regulatory analysis before finalizing. The rule was struck down in full.
What that means for your subscription business is precise: the federal ceiling is gone, and the state floors are what apply. State auto-renewal laws ("ARLs") and general consumer-protection statutes still govern every subscription sold to every consumer in every state where you have customers. The FTC itself has continued bringing enforcement actions under existing law, and on January 30, 2026, it took a preliminary step toward new subscription rulemaking. But for today, the answer to "what rules apply to my subscription" is: fifty different answers, plus DC.
Which states matter most
About 15 states have dedicated automatic renewal statutes. The rest cover subscription practices through their general consumer-protection or deceptive-trade-practices statutes. Both categories carry enforcement risk. Here is how we group them:
| Tier | What it means | States |
|---|---|---|
| Tier 1 | Dedicated ARL with distinctive requirements and active enforcement | California, New York, Virginia, Colorado, Minnesota, Massachusetts, Illinois, Florida, Texas, Oregon, Tennessee, DC |
| Tier 2 | Dedicated ARL exists but enforcement has been lighter to date | Hawaii, Louisiana, Maryland, North Carolina, North Dakota, Utah, Vermont, Washington |
| Tier 3 | General consumer-protection statute (UDAP) with no dedicated ARL; deceptive-practice claims still available | All remaining states |
If you sell nationally, you have exposure everywhere. But the highest-probability enforcement (from state AGs and from private plaintiffs where a private right of action exists) sits in Tier 1. Below are the five that matter most for a subscription business shipping products or services to consumers online.
California: the toughest single-state exposure
California's Automatic Renewal Law lives at Bus. & Prof. Code Sec. 17600 through 17606. Amendments enacted through AB 2863 took effect in phases through 2025. California requires:
- Clear and conspicuous disclosure of the auto-renewal terms in visual proximity to the request for consent.
- Separate affirmative consent to the auto-renewal terms, distinct from consent to Terms of Service.
- A written acknowledgment, capable of being kept and retrieved, with all ARL terms and cancellation information.
- Notice before conversion of a free trial to paid; notice before renewal of a term longer than a year.
- Online cancellation for online sign-ups, without a mandatory support-contact step.
The remedy provisions are what make California the highest-exposure state. Charges collected without compliant consent can be treated as unconditional gifts the consumer keeps, with statutory damages and attorneys' fees available under the CLRA. Class actions in this space are active.
Virginia: new "as easy as sign-up" standard effective July 1, 2026
Virginia amended its ARL in the 2025 session, effective July 1, 2026. The amendment added a "cancellation as easy as sign-up" requirement and a conspicuous online cancel option. If your sign-up is one screen and your cancel is four screens with a survey, you are almost certainly out of compliance in Virginia. This is the single most common gap we see across scans.
Colorado: penalties per violation, one-step cancel
Colorado's ARL at Colo. Rev. Stat. Sec. 6-1-732 requires one-step online cancellation for online sign-ups and permits per-violation penalties up to $20,000. Retention offers are permitted but cannot obstruct the one-step cancellation path.
Minnesota: save-offer restrictions
Minnesota's 2024 amendments introduced a distinctive requirement: retention offers presented during cancellation are restricted unless the consumer has consented to see them. Most default subscription-app cancel flows drop a discount screen in front of the consumer without asking, and most of those flows fail Minnesota. The fix is an interstitial step: "Would you like to see options before you cancel?"
Massachusetts: AG regulation, September 2025
Massachusetts moved through the Attorney General's regulatory authority rather than a new statute. 940 CMR 38.00 took effect in September 2025, requiring same-medium cancellation and restricting retention obstacles. Enforcement in Massachusetts also runs through Chapter 93A, which allows treble damages and attorneys' fees.
The five things to check first
If you run a subscription business and want to know where you likely stand right now without a full state-by-state review, here are the five checks that catch the most exposure.
- Cancel path length. Count the clicks and screens from log-in to cancellation confirmed. If sign-up is one screen and cancel is more than two, you likely fail Virginia and probably California and Colorado.
- Support-contact requirement. If cancelling requires emailing or calling support, you fail California's online-cancel standard for anything a customer signed up for online. This is the single most-cited defect.
- Retention-offer consent. If a discount or save offer appears during cancellation without the consumer choosing to see it, you likely fail Minnesota and are exposed under general UDAP statutes elsewhere.
- Renewal-notice timing. For any subscription term longer than a year, California and several other states require notice before renewal. Fifteen to forty-five days is the typical statutory window. If you send nothing before an annual renewal charge, that's exposure.
- Proof of consent. Can you produce, for a specific customer, the timestamp and content of the auto-renewal consent they gave? If not, defending an enforcement action gets much harder. This is a database question as much as a UX one.
A note on what your subscription app does and doesn't do
Recharge, Loop, Skio, Bold and their peers handle the checkout consent box well. Where merchants get exposed is the parts that live outside the subscription app: post-purchase confirmation email contents, pre-renewal notice timing, cancel-flow screen count, retention-offer sequencing, and the proof-of-consent record. Those are your responsibility, not your app vendor's.
What "compliant" actually looks like
A subscription business that would pass a reasonable state-by-state review generally has all of the following in place:
- A checkout page that discloses price, frequency, renewal terms and cancellation method above or immediately adjacent to the buy button, and asks for a separate affirmative consent to auto-renewal beyond ToS acceptance.
- An order confirmation email that repeats those terms and names the cancellation method.
- A pre-renewal reminder email sent 15 to 45 days before annual renewals, and before any free-to-paid trial conversion, that names the date, price and cancellation method.
- A self-serve cancellation control accessible from the customer account in the same or fewer clicks than sign-up required, with no mandatory support-contact step for anything the customer signed up for online.
- A consent step before any retention offer, and a persistent one-click cancel option on every screen of the cancel flow.
- A record of every customer's consent (timestamp, terms shown, mechanism used) retrievable on demand.
None of the above requires expensive technology. It requires deliberate choices about disclosures, sequences and records. Most subscription businesses can close 80% of their exposure with a two-week engineering sprint once they know exactly what to change.
Find out where you stand, free
Send us your checkout URL and a description of your cancel flow. Within two business days we'll return a written state-by-state gap list with the citation next to each finding. No calls, no obligation.
What may change next
Two things are worth watching. First, the FTC is expected to restart negative-option rulemaking, this time following the procedural steps the Eighth Circuit found lacking. If a new federal rule takes effect, it will add a national floor without preempting state protections that go further. Second, several state legislatures have subscription-related bills active in the 2026 session. California is likely to further amend its ARL. Colorado and Illinois are considering expanded private rights of action.
The direction of travel is clear: more disclosure, more explicit consent, easier cancellation, and more record-keeping. Businesses that build to the California standard today will need the least work to comply with whatever comes next.
Getting started
If you run a subscription business and haven't audited your flow since the Click-to-Cancel rule was vacated, do that first. The self-check list above catches the highest-frequency defects. For a written state-by-state gap analysis with citations, request a free CancelCheck scan. If your scan flags material gaps, our Compliance Kit ships state-by-state templates for the disclosures, consent language, renewal notices and cancel-flow spec.
Above all, don't wait for a demand letter or a chargeback wave to be the thing that tells you where you stand.