New York City's click-to-cancel rule took effect on October 1, 2026. It says that if a customer signed up online, they must be able to cancel online. Most coverage is written by lawyers for lawyers, and it ends at "review your terms of service."
This article is for the people who own the screens. It argues that the real compliance work is a design audit of every path into your subscription, and that the federal rule being dead does not take you off the hook. It helps SaaS founders, product managers and designers who sell to individuals or small teams.
The federal rule died, the obligation did not
A lot of product teams relaxed in 2025. The Eighth Circuit vacated the FTC's click-to-cancel amendments in July of that year on procedural grounds, which put the old 1973 Negative Option Rule back in place. According to a summary of the current federal position, the FTC opened a new rulemaking in March 2026, comments closed in April, and nothing has replaced the vacated rule.
That is true and mostly irrelevant. The same summary points out that the Restore Online Shoppers' Confidence Act (ROSCA) was never affected. It still requires clear disclosure, informed consent to charges and a simple way to stop recurring charges. Section 5 of the FTC Act still bans unfair and deceptive practices. State auto-renewal laws, with California's the most developed, apply whatever Washington does.
The enforcement record shows how seriously this is taken. In September 2025 Amazon agreed to pay $2.5 billion to settle FTC claims over Prime: a $1 billion civil penalty plus $1.5 billion in refunds. The complaint described a cancellation path of four pages, six clicks and fifteen options. The order requires a cancellation method that matches how the customer signed up and is not difficult, costly or time-consuming.
Now add a city. On October 1, 2026 the NYC Department of Consumer and Worker Protection rule took effect. The city's own page says businesses must offer a "straightforward cancellation process in the same method as sign up", with civil penalties starting at $525 per violation and possible refund liability. One city, one rule, and it is the first municipal version in the country according to the National Law Review.
What "same method as sign up" means on a screen
Read that sentence as a designer, not a lawyer. It is a parity test between two flows. If a customer needed three steps and a card form to start, they should not need a phone call and a support ticket to leave.
The part the legal write-ups skip is that most SaaS products have more than one front door. A customer can start a trial on the marketing site, from inside the product, through a sales-assisted checkout, through an app store, or through a partner marketplace. Each door is a "method". Each one needs a matching exit, or a clear and visible route to wherever the exit lives.
This is where teams get caught. Self-serve signup works beautifully. Cancellation lives in a billing portal that only the original purchaser can see. Annual plans bought through a reseller can only be cancelled by emailing an account manager. None of these were designed as dark patterns. They are the residue of how billing was wired, and a regulator reads the outcome, not the intent.
My advice is to map it as a table. Rows are every way a person can become a paying customer. Columns are the number of steps to start, the number of steps to stop, the channel for each, and who can do it. Any row where stop is longer than start, or sits in a different channel, is a defect. It takes an afternoon, and I would run it before reading a single clause of the rule.
Where the rule stops and your exposure starts
Be honest about scope. The rule covers automatic renewal and continuous service offers sold to consumers in New York City. Pure enterprise contracts negotiated by procurement are a different animal. The National Law Review's account of the proposal describes it as applying to any subscription that qualifies as an automatic renewal or continuous service offer, and the public sources I could read do not say how it treats self-serve plans bought by a freelancer on a company card. I do not know, and I would not bet the answer is favorable.
That ambiguity is the argument for designing to the strictest reading. Self-serve SaaS with a monthly card plan sits closest to the consumer line. Prosumer tools, creator software and small-team plans all live there. If you bill people with a credit card and a pricing page, assume you are in scope somewhere.
Two facts make the cost of getting this wrong higher than the $525 headline. First, the city's page says liability can include refunding the customer. A refund exposure scales with your customer base, not with a per-violation fine. Second, a flow that is clean in New York but painful elsewhere is a flow you still have to defend under ROSCA and your state law. Building a second, hidden "New York version" is more work than fixing the original.
And do not treat a phone number as a fix. A support line is a separate channel. If signup was a web form, a call centre is not parity.
Save offers and the line between persuasion and obstruction
Retention teams will ask whether the exit survey, the pause option and the discount offer all have to go. The sources I found do not address retention offers directly, so this is judgment, not law. My view is that offers are fine and obstruction is not.
The test I would use is whether the customer can finish cancelling without engaging with the offer. A discount shown on the confirmation screen, with a clear "Cancel anyway" button of equal weight, is a choice. A discount that must be declined across three modals, or a "Are you sure?" that moves the real button, is friction by design. The Amazon order is explicit that declining must be possible without manipulative phrasing, and that standard is a good proxy for where regulators look.
Pause and downgrade are the most useful saves because they are real alternatives. A customer who cancels because of a budget freeze may take a three-month pause. A customer who uses one feature may take the cheaper plan. Offer them once, on one screen, in plain language, and let the primary action stay cancellation.
One more measurable point. Do not bill after the first cancellation attempt. Charges that land after a customer has tried to leave are the clearest way to turn a clumsy flow into a violation. Show an unambiguous confirmation on screen, send the same by email with the date access ends, and make the end date match what billing will actually do.
A one-week plan
Day one, build the entry-and-exit table described above and mark every mismatch. Include app store and reseller channels, even when you do not control the billing, because you control what your product tells the customer about them.
Day two, walk the cancel flow with a stopwatch and a fresh account, on mobile as well as desktop. Count taps and screens. If the path to "Cancel subscription" is more than two clicks from account settings, or the word "cancel" is not on the first screen, rewrite the labels before you rewrite anything else.
Day three, strip the flow down to its legally necessary parts: terms of the cancellation, the end date, a final confirm. Then add back at most one save offer and one optional reason question. The reason question must be skippable. Your churn data is more honest when it is.
Day four, fix the account-ownership gaps. If only the billing owner can cancel, say so at the point of need and give a self-serve way to request transfer. Remove every "contact sales to cancel" on plans that were bought without talking to sales.
Day five, test the confirmations. Cancel, wait, and check that the email arrives, the access end date is correct and no invoice is generated afterward. Write the findings down and put the table in a place where whoever changes billing next will see it.
Then repeat it each time you add a plan, a marketplace listing or a new way to buy. Parity is not a one-time audit. It is a property you have to keep, and the cheapest moment to keep it is when the new door is being built.
Originally published on kireev.us.
Top comments (0)