The FTC's Click-to-Cancel Rule Is Back (Sort Of): What It Means for Your Subscription Box's Cancel Flow

The federal click-to-cancel rule isn't law right now, and it might not be for a while. That doesn't mean your subscription box can wait to fix its cancel flow.

What actually happened to the rule

The FTC's original click-to-cancel rule, which would have required businesses to let customers cancel a subscription as easily as they signed up, was vacated by the Eighth Circuit Court of Appeals in July 2025. The court didn't rule on the merits of the policy. It threw the rule out on procedure, because the FTC skipped a legally required economic-impact analysis before finalizing it.

That's an important distinction. The rule didn't lose on substance. It lost on process, which is why the FTC has been able to pick the effort back up rather than start from scratch on the underlying idea.

The rulemaking is back, but it's not a rule yet

In March 2026, the FTC reopened the process with an Advance Notice of Proposed Rulemaking, or ANPRM. Public comments are due April 13, 2026.

An ANPRM is the earliest stage of rulemaking. It's the FTC asking for input before it drafts a new proposed rule, which then goes through its own comment period before anything is finalized. Realistically, a new binding federal rule is a long way off, and there's no guarantee the final version looks like the vacated one.

If you've seen headlines saying click-to-cancel is "back," read them carefully. The process is back. The binding federal rule is not, and treating this as settled law would be a mistake in either direction, whether you're assuming it's in force or assuming you can ignore it until it is.

What's actually binding today

Here's what operators miss in the back-and-forth over the federal rule: the underlying obligation to make cancellation reasonably easy never went away.

The FTC has continued enforcing Section 5 of the FTC Act, which prohibits unfair and deceptive practices, and ROSCA, the Restore Online Shoppers' Confidence Act. ROSCA already requires clear disclosure of negative-option terms, express informed consent before charging a customer, and a simple mechanism to stop recurring charges. None of that depended on the vacated rule, and none of it went anywhere when the rule did.

On top of federal law, roughly 30 U.S. states have their own auto-renewal and negative-option statutes. Several of these, including California's and a handful of others, are stricter than the vacated federal rule ever was. A subscription brand selling nationally is already subject to the toughest state standard in whatever states it ships to, regardless of what happens in DC.

Put together, "cancellation as easy as signup" is not a future requirement pending federal action. It's close to the compliance floor already, enforced through existing law and existing state statutes, with or without a new federal rule.

Why waiting for the federal rule is the expensive path

Building an easy-cancel flow now, while there's no active enforcement deadline, is a design and engineering project. Building it after a state attorney general or the FTC opens an inquiry into your cancellation practices is a legal project, and legal projects cost more, move slower, and come with downside you can't engineer your way out of.

Retrofitting a cancel flow under enforcement pressure usually means doing it fast, with legal counsel reviewing every screen, while also responding to whatever prompted the inquiry in the first place. That's a worse version of the same work you could do now on your own timeline.

Treat the compliance floor as current, not pending. The federal rulemaking might raise the bar further, or it might not, but the floor set by ROSCA and state law is real today and it's the one your cancel flow needs to clear regardless.

What an easy-cancel flow actually looks like

A handful of concrete features separate a compliant cancel flow from a risky one:

Self-service, no phone call required. If a customer can subscribe online with a few clicks, they need to be able to cancel online with a few clicks. Routing cancellation through a phone line that signup never required is exactly the asymmetry regulators have targeted.

No dark patterns. No forced multi-step retention gauntlet before the cancel button appears, no pre-selected "pause instead" option disguised as the cancel action, no hiding the cancel link behind account settings three menus deep.

A clear confirmation. The customer should get an unambiguous confirmation that the subscription is canceled, when the cancellation takes effect, and whether anything is still owed or shipping.

Retention offers, if you use them, presented honestly. You can still offer a discount or a pause option to a customer trying to cancel. The line is whether the customer can decline the offer and complete the cancellation in the same flow, versus being forced through it to find the exit.

How this connects to subscription order editing and pausing

Cancellation doesn't happen in a vacuum. Most of the customers who end up canceling a subscription box do it after a frustrating experience with an order they couldn't adjust themselves: the wrong flavor, a delivery date that didn't fit, a shipment that arrived while they were traveling.

Self-service order editing and pausing intercept a chunk of those cancellations before they happen. A customer who can skip a shipment, swap a variant, or shift a delivery date on their own often does that instead of canceling outright, because the actual problem was never the subscription itself. It was a single order that didn't fit their week.

That matters for compliance too. A cancel flow evaluated in isolation looks compliant if it's easy to use. But if pausing and editing are locked behind a support ticket while canceling is one click, you've built an incentive structure that looks a lot like the dark pattern regulators are watching for: friction concentrated everywhere except the exit that costs you the least in the short term.

The fix is the same self-service logic applied consistently: easy to edit, easy to pause, easy to cancel, all without a human in the loop.

What to check right now

Run your own cancel flow through a short audit before the next planning cycle:

Can a customer cancel from their account without contacting anyone, in roughly the same number of steps it took to subscribe? Is there any point where a phone call, live chat, or email is required to complete a cancellation that started online? Does the flow disclose renewal terms and pricing clearly before the first charge, not just in a footer link? Can a customer decline a retention offer and still finish canceling in the same session, or does declining loop them back to the start?

If any of those checks fail, you have a state-law and ROSCA exposure today, independent of anything the FTC does with the ANPRM. That exposure doesn't scale gently. It scales the moment a customer complaint, a state attorney general inquiry, or a plaintiff's firm decides your flow is worth testing in court.

Where to put your attention now

Don't wait on the April 2026 comment period or whatever rule eventually comes out of it. Audit your current cancel flow against the ROSCA and state-law floor: is it self-service, is it free of dark patterns, does it confirm clearly, and can a customer decline a retention offer and still cancel.

Fix what fails that audit now, while it's a product decision instead of a legal one. A subscription brand that builds to this standard voluntarily also gets a better business outcome out of it: customers who trust that canceling is genuinely easy are more willing to resubscribe later, because they were never trapped the first time.

ShipAid's Smart Returns gives subscription brands self-service order editing, pausing, and cancellation in one flow, so customers can adjust or exit on their own instead of generating a support ticket or a compliance risk.