Click-to-cancel requirements: how to build a cancel flow that passes
Click-to-cancel requirements in NYC, New York State and California, plus how to build the cancel flow, state machine and notices that pass them.

Table of contents
Last updated: 2026-10-25
Click-to-cancel rules are designed to make ending a subscription as easy as starting one. If customers can sign up online, they should be able to cancel online without unnecessary steps or obstacles. New York City's rule took effect on October 1, 2026, and California requires businesses that accept online subscriptions to offer an online cancellation option. The FTC's amended federal rule was vacated in July 2025, but federal law still requires a simple way to stop recurring charges.
For product teams, the practical approach is to build a cancellation flow that meets the strictest applicable requirements. That means making cancellation easy to find, keeping the process in the same medium as sign-up where required, and ensuring that retention offers do not delay or obstruct the customer's decision.
Key facts
| Fact | What the source says | Source |
|---|---|---|
| New York City rule | Took effect on October 1, 2026. It applies to a subscription for any type of goods or services that is an automatic renewal or continuous service offer. | NYC DCWP rule |
| Same-medium cancellation | Cancellation must use a simple mechanism that is as easy to use as the method the customer used to give consent, and must use the same medium. | NYC DCWP rule, 5-110.1(c) |
| New York State | General Business Law section 527-a contains a similar requirement. Its amended version has been in force since November 5, 2025. | GBL 527-a |
| California | Businesses that accept subscriptions online must allow customers to terminate them exclusively online, at will, without obstructive steps. | AB 2863 |
| Retention offers | Save offers are permitted in New York and California, provided they do not obstruct or delay cancellation. California also requires a click-to-cancel button alongside an online retention offer. | GBL 527-a, AB 2863 |
| Consent records | California requires businesses to retain proof of consent for at least three years, or one year after the contract ends, whichever period is longer. | AB 2863 |
| Federal requirements | The Eighth Circuit vacated the FTC's amended rule in an opinion filed on July 8, 2025. However, the Restore Online Shoppers' Confidence Act still requires simple mechanisms for stopping recurring charges. | Eighth Circuit, 15 U.S.C. 8403 |
| New York City penalties | Penalties are $525 for a first violation, $1,050 for a second, and $3,500 for a third or subsequent violation. A violator is also liable for the amount charged after the customer's first cancellation attempt. | NYC DCWP rule |
In this article
- What are the click-to-cancel requirements in 2026?
- What is the status of the federal click-to-cancel rule?
- Does click-to-cancel apply to a B2B SaaS product?
- What does a click-to-cancel flow need to do, step by step?
- Can you still show a save offer when someone cancels?
- How should the cancellation state machine work?
- What do Stripe, Paddle and Chargebee give you, and what is left to build?
- What does an easy cancel cost in retention?
- What does enforcement look like, and what does it cost?
- What should you ship first?
- Where RocketDevs fits
- Conclusion: make cancellation a feature, not a fight
- Frequently asked questions
This is not legal advice. It is a build brief based on the statutes, rules and court opinion themselves, describing the position as of October 25, 2026. Which requirements apply depends on where your customers live, whether they buy for personal or business use, and what you sell. Before launching your cancellation flow, ask a lawyer who practises in your customers' states to review it.
If you run a consumer subscription or SaaS product and designed your cancellation flow to retain customers, this guide is for you. For years, adding friction to cancellation was a common retention tactic. In some major markets, it is now a compliance risk. The good news is that much of the fix comes down to engineering: make cancellation easy to find, remove unnecessary steps, and ensure retention offers never get in the way.
What are the click-to-cancel requirements in 2026?
Click-to-cancel laws share three main goals: disclose subscription terms before billing, obtain clear consent, and make cancellation straightforward. The exact requirements vary by jurisdiction, but the direction is clear: businesses should not make it harder to leave a subscription than it was to join.
New York City's rule states that businesses must provide "a simple cancellation mechanism that is as easy to use as the mechanism that the consumer used to provide consent" and use "the same medium," per the NYC Department of Consumer and Worker Protection (DCWP) rule.
Similar requirements now appear in laws across the United States. New York State's General Business Law section 527-a contains comparable language, California requires online cancellation for subscriptions accepted online, and Virginia's 2026 amendments prohibit requiring customers to interact with a live or virtual agent to cancel in most cases. Legal analysis from Skadden identifies approximately 30 states with some form of automatic-renewal or click-to-cancel law.
The table below compares five important frameworks. These are summaries, not substitutes for checking each law's scope, exemptions and effective dates.
How do New York City and New York State fit together?
New York City's rule largely mirrors the state statute but introduces a separate local enforcement and penalty regime. The mayor's office announced the adopted rule on July 10, 2026, following a DCWP proposal in April and a public hearing in May. The rule's statement of basis says it is consistent with the existing state approach, with differences involving penalties, restitution and the cancellation methods available.
Legal analysis from DLA Piper similarly describes the core requirements as largely mirroring statewide law. For businesses already complying with New York State's requirements, the city rule may require fewer changes to the cancellation interface than businesses starting from scratch. However, local enforcement and penalty exposure still need to be assessed separately.
The state amendments were enacted through the 2025 budget. New York Senate bill A.3008-C, Part W provides for the changes to take effect 180 days after enactment. Legal analyses from Olshan and Ashurst identify November 5, 2025, as the effective date.
What does California require?
California's amended Automatic Renewal Law is particularly specific about the cancellation interface. Assembly Bill 2863 was approved on September 24, 2024, as Chapter 515. Its changes apply to contracts entered into, amended or extended on or after July 1, 2025, according to the chaptered bill text.
The words "amended or extended" matter because the requirements can apply when an existing subscription is amended or extended after the effective date, even if the customer first signed up earlier. Kilpatrick Townsend summarises the changes as covering consent, reminders, pricing disclosures and click-to-cancel functionality.
Section 17602(d) requires businesses that allow consumers to accept an offer online to let them terminate the automatic renewal or continuous service exclusively online, at will, and without further steps that obstruct or delay immediate cancellation. The law specifies a prominently located direct link or button in the consumer's account, profile or settings, or an immediately accessible termination email.
There are qualifications. A business may require a logged-in account holder to authenticate before cancelling online, but a customer who cannot authenticate must still be able to cancel offline. Product teams should implement the precise statutory requirements rather than assume that a single generic cancellation button covers every situation.
What about Virginia, Minnesota and the rest?
Virginia and Minnesota illustrate why a single cancellation design cannot be assumed to satisfy every jurisdiction.
Virginia's Code section 59.1-207.46 requires a cancellation mechanism at least as easy to use as the one used to initiate the offer, through each applicable sign-up channel. It also says customers generally cannot be required to interact with a live or virtual agent to cancel, unless the seller only initiates offers through an agent. Greenberg Traurig reports that the 2026 amendments took effect on July 1, 2026, and removed a protection previously available for good-faith compliance efforts.
Minnesota's statute section 325G.59 takes a different approach to continuous services. It states that termination must take effect no later than 31 days after a verified consumer gives notice, unless the consumer specifies a later date.
The NYC rule lists several other states with click-to-cancel laws, including Utah, Idaho, California, Massachusetts, Georgia, Minnesota, Colorado, Illinois and Arkansas. Skadden also identifies new or amended laws taking effect in 2026 in Colorado, Connecticut, Maine, Maryland and Virginia. Notice periods vary: for example, Skadden notes a 15-to-45-day window in New York compared with 30 to 60 days in Florida.
For engineering teams, the key lesson is that there is no single state statute to treat as the universal specification. You need to identify the jurisdictions that apply to your customers and build a flow that satisfies the relevant combination of requirements.
What happens outside the United States?
Two other regimes are relevant to products with international customers, although neither should be treated as identical to US click-to-cancel laws.
In the European Union, Article 11a of Directive (EU) 2023/2673 introduces a dedicated withdrawal-button requirement for online contracts within the relevant withdrawal period. K&L Gates reports that the requirement took effect on June 19, 2026. This is a withdrawal right, which is distinct from cancelling an ongoing subscription. Treat it as a related obligation, not a replacement for subscription-cancellation requirements.
In the United Kingdom, Chapter 2 of the Digital Markets, Competition and Consumers Act 2024 establishes subscription-contract requirements that include renewal reminders and cooling-off cancellation rights. The legislation.gov.uk text is marked prospective, and the commencement date has changed. Lewis Silkin reported a delay to spring 2027, while TLT subsequently reported that the start had been brought forward to January 2027. Treat the commencement date as unconfirmed until the relevant regulations are made.
The practical takeaway is straightforward: map the rules that apply to your customers, separate cancellation from withdrawal rights, and make the cancellation flow easy to use without assuming that compliance in one jurisdiction guarantees compliance in another.
What is the status of the federal click-to-cancel rule?
The FTC's amended federal click-to-cancel rule is not in force. On July 8, 2025, the Eighth Circuit vacated the amendments to the Negative Option Rule because the FTC had failed to follow required procedures under section 22 of the FTC Act. In March 2026, the FTC reopened the question of whether to develop a replacement. As of October 25, 2026, it has not published a proposed replacement rule.
The original amendments were finalised in October 2024. The FTC said they would require sellers to make cancelling an enrolment as easy as signing up. But the court's decision turned on the rulemaking process, not a finding that difficult cancellation practices were acceptable.
The court explained that the Commission had preliminarily determined the amendments would not have an effect of $100 million or more on the national economy, which would trigger a preliminary regulatory analysis. The panel concluded that the procedural deficiencies were fatal, vacated the entire rule, and did not need to address the petitioners' other substantive challenges. It also noted that vacating the whole rule was appropriate despite its severability provision, given the prejudice to the petitioners.
The court put its position plainly: "While we certainly do not endorse the use of unfair and deceptive practices in negative option marketing, the procedural deficiencies of the Commission's rulemaking process are fatal here." The court's opinion and Manatt's analysis explain the decision.
What did the FTC do next?
The FTC began a new rulemaking process, but that process has not yet produced a replacement rule. On March 13, 2026, the Commission published an advance notice of proposed rulemaking in the Federal Register, with comments due by April 13, 2026. Cooley and Covington both date the announcement to March 11, and Covington calls it the start of a new rulemaking.
The FTC invited comments on how to improve existing requirements and whether to use its rulemaking authority to modernise the Negative Option Rule. The notice also reported that complaints about negative-option marketing had risen from at least 33 per day in late 2020 to more than 90 per day in 2025.
In the meantime, the amended 2024 text was removed from the current regulations. The Electronic Code of Federal Regulations, 16 CFR Part 425, up to date as of October 22, 2026, again reflects the older rule, which focuses on the sale, offering for sale or distribution of goods and merchandise.
As of October 25, 2026, Skadden reports that the FTC has not announced a replacement rule or timetable. The Commission's August 2026 regulatory agenda lists the removal of the vacated amendments. That is an administrative correction, not a new click-to-cancel rule. The FTC's February 2026 conforming rule describes the task as bringing the regulations into line with the courts' decisions.
A rapid return of the 2024 requirements was never guaranteed. Kelley Drye notes that FTC Chairman Andrew Ferguson dissented from the original rule.
Is there anything federal left?
Yes. The Restore Online Shoppers' Confidence Act (ROSCA), enacted in 2010, remains in force and is enforceable. Under 15 U.S.C. section 8403, sellers using negative-option features for goods or services sold online must:
- Clearly and conspicuously disclose all material transaction terms before obtaining the consumer's billing information.
- Obtain the consumer's express informed consent.
- Provide simple mechanisms for consumers to stop recurring charges.
The same requirements appear in the Government Publishing Office's authenticated 2023 edition of the US Code. ROSCA establishes a federal baseline, but it does not provide all the interface-specific detail found in newer state and local laws.
Enforcement shows that the remaining federal requirements are not merely theoretical. In September 2025, the FTC announced a settlement with Amazon involving a $1 billion civil penalty and $1.5 billion in consumer refunds. The FTC described the penalty as the largest ever in a case involving an FTC rule violation. The order also requires an easy way to cancel Prime using the same method consumers used to sign up, per the FTC's announcement.
For product teams, the practical conclusion is that the vacated FTC amendments are not the current federal specification. ROSCA remains the federal baseline, while applicable state and city laws provide additional requirements for the cancellation flow. Build for the jurisdictions your customers are in, and do not treat the absence of the amended federal rule as permission to make cancellation difficult.
Does click-to-cancel apply to a B2B SaaS product?
It depends on the jurisdiction, who buys the service and how the law defines a consumer. California and New York generally define consumers as individuals who acquire goods or services for personal, family or household purposes. Virginia's definition is broader: it also covers certain small businesses buying services for business purposes. These distinctions appear in the California statute, the New York legislation and Virginia's definitions.
That means you should not assume that a B2B label automatically exempts your product. A company purchasing a team plan for its employees is making a business purchase. A freelancer buying a solo subscription for personal use may fall under a different definition. A product that offers free access and lets individuals upgrade themselves may also have consumer subscribers, even if it primarily targets businesses. Virginia's small-business definition includes certain owner-controlled businesses with 250 or fewer employees or average annual gross receipts of $10 million or less over three years, subject to the statute's other conditions.
Three further points matter when assessing coverage.
First, exemptions are specific to each law. The New York City rule exempts certain regulated entities and sectors, including entities regulated by the Department of Financial Services, banks and credit unions, licensed security alarm operators, franchised services and service-contract sellers. The city also declined to grant a telecommunications exemption, noting that commenters had not identified a federal law or regulation imposing a click-to-cancel requirement. Do not assume an exemption applies simply because your industry is regulated or your contracts are business-to-business.
Second, consumer definitions are not interchangeable. The California, New York and Virginia definitions are only part of the analysis. The NYC rule and the federal Restore Online Shoppers' Confidence Act (ROSCA) have their own wording and scope. You need to assess each applicable law rather than transfer one state's definition to another.
Third, a single cancellation flow may be simpler to maintain than separate consumer and business flows. If customers change plans, switch from personal to company billing, or move between self-serve and sales-led purchasing, separate logic can become difficult to test and maintain. One consistent flow can reduce that complexity, provided it meets the requirements applicable to your customer base.
For a SaaS product with a mixed customer base, the practical starting point is to build an easy-to-use cancellation flow across all self-serve plans. Then ask counsel whether sales-led annual contracts negotiated through signed order forms can be handled differently under the laws that apply. Do not make that decision based on a law firm's headline or the assumption that every B2B subscription is exempt.
What does a click-to-cancel flow need to do, step by step?
A compliant cancellation flow starts before the customer subscribes. Under the New York and California rules, you must clearly disclose the key terms, obtain affirmative consent, and provide an acknowledgment the customer can keep. Once they subscribe, cancellation must be easy to find, straightforward to complete, and processed promptly. The exact requirements vary by jurisdiction, but New York City's rule is explicit about timing: material terms must appear before the business requests consent or billing information, and close to the consent request itself. See the NYC DCWP rule.
Think of this as a six-step engineering specification:
What counts as disclosure and consent before billing details?
New York City's rule lists the material terms that customers must see: a description of the product or service, the amount and frequency of charges, the deadline for preventing or stopping further charges, and the available cancellation methods. New York State's General Business Law section 527-a sets out a similar list and requires the information to appear in visual proximity to the consent request.
Under the NYC rule, an offer that includes a free trial or a temporary price must clearly explain how and when the price will change and what the customer will be charged afterwards. California's AB 2863 also addresses free-to-paid conversions, where a customer receives a product or service for an initial period without charge but must cancel affirmatively to avoid later payment. It prohibits contract information that interferes with or undermines the customer's affirmative consent.
After consent, New York requires a prompt acknowledgment that the customer can retain, including the terms, charges, relevant deadlines and cancellation methods. California also requires a retainable acknowledgment that explains the cancellation policy and how to cancel. In practice, this is the confirmation email or message customers can refer back to later.
For the product team, that means three things. Put the material terms near the payment form rather than hiding them behind a link to the terms of service. Use a clear, affirmative consent control rather than a preselected box. And state trial-to-paid pricing with specific amounts and dates so customers can understand when charges begin and how much they will pay.
Where should the cancel control go, and how many ways in must there be?
Put cancellation where customers manage their accounts, and make it available through the channels required by the applicable law. New York City's rule requires cancellation through the same mediums customers can use to provide affirmative consent to the offer or a price increase. If consent was obtained in person, the business must also offer an online cancellation method. New York State's General Business Law provides an online or telephone option for the in-person case.
California requires cancellation through the same medium used for the transaction or a medium in which the customer is accustomed to interacting with the business. Where activation occurred by telephone, a telephone cancellation option must be available. Virginia generally prohibits requiring a customer to interact with a live or virtual agent to cancel, unless the seller only initiates offers through an agent.
Two details are easy to overlook. California allows a business to require an authenticated customer to log in before cancelling online, but customers who are unwilling or unable to authenticate must still have an offline cancellation route. Also, subscriptions purchased through an app store may need to be cancelled through that store. For example, Apple's instructions direct customers to manage eligible App Store subscriptions through Apple. Your product should guide customers to the correct cancellation destination and ensure your own access and billing records reflect the store's updates.
What should happen the moment someone cancels?
Record the request, stop future charges as required, and confirm the outcome. New York City's rule makes the first cancellation attempt especially important: a violator is liable for the amount charged after the consumer's first attempt at cancellation. California requires businesses to process cancellation promptly when customers use the click-to-cancel button. Minnesota's continuous-service law sets an outer limit of 31 days after a verified termination notice, unless the customer specifies a later date.
A robust implementation should record the request and timestamp before attempting downstream actions, then ensure the subscription is marked for cancellation and the next charge is prevented. Send confirmation through an appropriate channel and, where the subscription has already been paid for, preserve access until the end of the paid period when the applicable contract and law require it.
Do not treat a failed billing-provider request as something to retry indefinitely without monitoring. If the customer has cancelled but the system charges them again, you may have a compliance and refund problem. Log failures, alert the responsible team, and reconcile subscription status against billing records.
Which notices must you send, and when?
Renewal and pricing notices depend on the jurisdiction, subscription type and event that triggers the notice. Do not hard-code a single reminder schedule for every customer. Use a configurable rules table based on the customer's location and the terms of their subscription.
| Trigger | New York State and NYC | California | Virginia |
|---|---|---|---|
| Trial or promotional price ends | Generally 3 to 21 days before the deadline for the first chargeable period, for qualifying trials longer than one month | Generally 3 to 21 days before the end of qualifying trials or promotions lasting more than 31 days | For a trial longer than 30 days, notice within 30 days of the end of the trial |
| Annual or longer-term renewal | Generally 15 to 45 days before the cancellation deadline for qualifying renewals | Generally 15 to 45 days before renewal for qualifying contracts with an initial term of one year or longer | Generally 30 to 60 days before the cancellation deadline for qualifying offers extending beyond 12 months |
| Price or fee change | At least 5 business days and no more than 30 days before the change | Generally 7 to 30 days before a fee change takes effect | Notice is required before the change is implemented; verify the applicable statutory requirements |
These are high-level summaries, not universal deadlines for every subscription. Check the exact statutory trigger, duration threshold and any exceptions before configuring the scheduler.
Each required notice should include cancellation instructions. New York requires notices to be sent through the notification method selected by the customer, where applicable, including channels such as text, email or app notifications. California's annual reminder requirements also tie the delivery method to the medium used to activate the renewal. Wilson Sonsini's analysis notes that an emailed acknowledgment means emailed reminders. Different state deadlines, such as Florida's 30-to-60-day renewal-notice window, are another reason to keep timing in configuration rather than scattering fixed values throughout the code.
New York has an additional requirement for certain price increases. Under General Business Law section 527-a, when a business charges a higher price without obtaining new affirmative consent, the customer must be allowed to cancel within at least 14 days after the charge, with a prorated refund for the remaining term. For annual subscriptions, that can turn a pricing change into a refund obligation, so model the cancellation window and potential liability before announcing the increase.
Can you still show a save offer when someone cancels?
Yes, in New York and California. You can offer a discount, a retention benefit or information about what the customer will lose by cancelling. The offer must not obstruct or unreasonably delay the cancellation.
New York State's General Business Law section 527-a expressly permits retention offers, provided the business does not impose unreasonable or unlawful conditions on the customer's ability to cancel.
New York City's rule follows the same principle. During consultation, some industry commenters interpreted the proposed wording as discouraging or prohibiting retention offers. The Department of Consumer and Worker Protection clarified that the provision was intended to be consistent with state law. The final rule prohibits offers that impose unreasonable or unlawful conditions, fail to acknowledge a cancellation request, or obstruct or unreasonably delay it. See the NYC click-to-cancel rule.
What does California add for online offers?
Under AB 2863, California requires the cancellation control to remain clearly visible and accessible while an online retention offer is displayed. If a consumer requests cancellation through an online system, the business may present an offer only if it simultaneously displays a prominent, continuously visible and nearby direct link or button labelled "click to cancel", or similar wording.
Once the customer selects that control, the business must promptly process the cancellation without obstructing or delaying the process. For cancellations initiated by telephone, the business must tell the caller that they can complete the cancellation at any time by stating that they want to cancel.
The practical requirement is simple: the offer can sit beside the cancellation control, but it cannot replace it or make the customer work through another sales pitch to leave.
What cancellation practices are out of bounds?
New York's statute identifies several prohibited practices, including hanging up on callers, giving false information about how to cancel, misrepresenting the consequences or costs of cancellation, and misrepresenting the reasons for a delay.
Recent Federal Trade Commission (FTC) actions highlight similar concerns with online cancellation. In September 2025, the FTC announced a settlement with Chegg following allegations that its cancellation processes were difficult to find and required multiple clicks to locate. In June 2026, the FTC sued a network of 15 corporations and eight individuals, alleging that the defendants operated unlawful subscription schemes by omitting cancellation options from websites and apps and requiring consumers to explain why they wanted to cancel. These are allegations, not findings of liability. However, they illustrate the kinds of practices the agency has challenged.
The Norwegian Consumer Council documented another example in its 2021 review of Amazon Prime's cancellation process. The cancellation button changed labels at successive stages, moving from "End Membership" to "Cancel My Benefits", then "Continue to Cancel" and finally "End Now". Meanwhile, the "Keep My Benefits" button stayed put. The FTC later secured a settlement with Amazon in September 2025 that included requirements for a cancellation process using the same method as sign-up.
The FTC's rulemaking history is also relevant. Its 2024 final Negative Option Rule omitted proposed provisions addressing retention offers, double consent and certain annual reminders. The rule was subsequently vacated by the Eighth Circuit in July 2025, so it binds nobody, but it shows that even the federal agency at its most aggressive did not carry a save-offer rule into its final text.
How should you build a compliant save offer?
Treat the offer as an optional choice, not a gate customers must pass through to cancel. Display the retention offer, an accurate explanation of what the customer will lose, and a clearly visible cancellation button together. The cancellation control should be just as easy to use as the offer. Do not hide it, make the customer provide a reason before proceeding, or require repeated confirmation that they really want to leave.
A final confirmation screen may be common, but it still needs careful review. California prohibits further steps that obstruct or delay cancellation, so ask legal counsel whether an additional screen is appropriate for your particular flow and customer base.
You can collect cancellation feedback through an optional survey, but avoid making the customer explain their decision before the cancellation can proceed. The FTC has specifically identified mandatory explanations as part of the conduct alleged in its 2026 subscription-scheme lawsuit.
Finally, test retention offers without experimenting on customers' ability to cancel. Do not run a deliberately obstructive variant in jurisdictions where it may violate the law simply to measure whether it improves retention. A compliant save offer should help customers make an informed choice, not make leaving harder.
How should the cancellation state machine work?
Keep billing state and access state separate. Your payment provider manages charges and subscription status, but your application decides what the customer can still use and when access ends. Paddle's cancellation documentation highlights the distinction between cancelling a subscription and restricting access to the product.
This section looks at the architecture behind a reliable cancellation system, including the records you need, how to handle failed events and where compliance problems can emerge.
Why are billing and access two different machines?
Cancellation involves several separate moments: the customer's first cancellation attempt, the point when future billing stops, the date access ends and the point when the provider confirms the subscription has ended. Each matters for a different reason. New York City's rule, for example, makes the first cancellation attempt important when calculating potential restitution for subsequent charges. The customer cares about when the product stops working, while the provider manages the subscription and billing lifecycle.
Payment platforms handle the time between cancellation and access ending in different ways. Stripe lets you set cancel_at_period_end, allowing a subscription to run until the end of the period the customer has paid for. You can reverse that scheduled cancellation before the period ends. Paddle schedules cancellation for the next billing date, while Chargebee describes a subscription scheduled to end at the end of its term as non-renewing.
Stripe's Entitlements feature formalises the same split: as long as a customer maintains an active subscription for a feature, they retain an active entitlement. Billing problems also need separate handling. An unpaid invoice can move a Stripe subscription into past_due or unpaid, depending on the account's failed-payment settings, without the customer having requested cancellation. See Stripe's subscription overview.
Vindicia offers another example. Its subscription deletion documentation explains that entitlements can continue until the end date determined by the last successful billing when immediate disentitlement is not enabled.
For your architecture, keep three records separate:
Keep the state model small. A practical starting point is Active, Cancel requested, Scheduled to end and Ended, with Past due and Reactivated handled as additional paths where needed.
Reactivation also requires care. Stripe allows a scheduled cancellation to be reversed before the subscription period ends, but a fully cancelled subscription cannot simply be restarted. Paddle likewise states that cancelled subscriptions cannot be reinstated. A returning customer may therefore need a new subscription, fresh consent and a new acknowledgment.
Why should the cancellation request be its own record?
Because it is the evidence of when the customer tried to cancel, even if the payment provider or another service fails afterwards. Record the request before calling the provider. Include the subscription, timestamp, channel, customer reference and a unique request identifier.
If the provider call fails, retry safely and alert the responsible team if the problem persists. Never tell the customer their subscription is cancelled if your system has only recorded the request and has not yet established whether the cancellation was processed. Where the interface acknowledges receipt before processing finishes, make that distinction clear.
This is where idempotency helps. An idempotency key allows a system to recognise retries of the same request rather than treating each one as a new operation. The IETF HTTP API working group's draft describes this pattern, although the document is an Internet-Draft rather than a final standard.
Used correctly, idempotency helps prevent duplicate operations when a customer double-clicks, a request times out or your service retries a failed call. It also helps avoid inconsistent results when multiple requests arrive close together.
How do webhooks fail, and what should you do about it?
Webhooks can arrive late, more than once or out of order. Your application must handle all three cases without corrupting the subscription state.
Stripe documents these limitations in its webhook guide. In live mode, Stripe retries failed event deliveries for up to three days using exponential backoff, but it does not guarantee that events arrive in the order they were generated. It recommends tracking event IDs to identify duplicate deliveries.
Build three safeguards into your integration. First, record each event ID and make duplicate events safe to process. Second, use webhook events to trigger a check of the provider's current object state when necessary, rather than assuming the event's arrival order reflects the actual sequence of changes. Third, run a regular reconciliation between your provider's subscriptions and your own database.
Reconciliation helps detect a cancellation recorded by your application but never accepted by the provider, or a subscription cancelled by the provider while your application still grants access. Do not rely exclusively on webhook retries to catch every discrepancy, particularly if an endpoint is disabled or misconfigured.
Why should you schedule notices yourself instead of relying on provider events?
Because a provider's event timing may not match the legal notice window you need to meet. Stripe's customer.subscription.trial_will_end event is generally sent three days before a trial ends, as described in its subscription webhook documentation. That may be too close to the deadline for a business that needs to send a notice between three and 21 days before the end of a qualifying trial.
A safer approach is to calculate notice dates in a scheduler you control. Work backwards from the relevant trial end, renewal date or price-change date, and select a send date comfortably inside the applicable legal window. For example, a trial reminder sent 10 days before the trial ends may fit a three-to-21-day window. A reminder 35 days before a qualifying annual renewal may fit a 15-to-45-day window. A price-change notice sent 14 days in advance may fit a five-business-day-to-30-day window, provided the exact statutory requirements are met.
These are illustrative scheduling choices, not universal defaults. Store the customer's jurisdiction, subscription terms and selected notification channel, and calculate deadlines according to the applicable law. New York requires notices through the method selected by the consumer where applicable, and other states can have different windows. Keep the rules in jurisdiction-specific configuration so a legal change does not require you to hunt through application code.
Record every notice's scheduled date, actual send time, channel and delivery status. A scheduler should also flag missed or failed sends so the team can respond before a deadline is breached.
What belongs in the audit trail?
Keep enough evidence to establish what the customer agreed to and how the business handled cancellation. For consent, record the customer reference, timestamp, consent method, plan, price, trial terms and the exact version of the terms shown. Store the actual text or a durable versioned record, not just a link to a page that can change later.
California requires businesses to retain verification of affirmative consent for at least three years, or one year after the contract ends, whichever period is longer. Confirm the current statutory wording and any additional recordkeeping rules that apply to your product.
For cancellation, record the first attempt, acknowledgment or confirmation, the time billing was stopped, the date access ended and the notices sent, including their channels. Keep the audit trail protected from unauthorised changes, and retain only the personal information you need. Your privacy policy and retention schedule should explain how these records are used and kept.
Where does this break in practice?
The biggest risks appear where two systems or processes meet. Test the following cases before launch:
- The interface says cancellation is complete, but the provider call failed and the next invoice is still issued.
- The provider cancels the subscription, but your application continues granting access, or cuts it off before the paid period ends.
- A cancellation request arrives just as a free trial converts to a paid subscription, and the two processes race.
- A price-change notice is sent from a scheduled job using the wrong timezone, putting it outside the required window.
- A customer signed up in the app, but cancellation is available only on the website.
- A customer subscribed through an app store, but the cancellation button in your settings does not take them to the correct place.
- A New York customer is charged a higher price and cancels within the applicable statutory period, but your system cannot calculate the required prorated refund.
- A webhook endpoint is disabled for several days, and no reconciliation process detects the resulting mismatch.
A cancellation system is reliable only when the customer-facing flow, payment provider, access controls, notice scheduler and audit trail agree. Design for failure at each boundary, and make the first cancellation attempt a durable record rather than a temporary UI event.
What do Stripe, Paddle and Chargebee give you, and what is left to build?
Stripe, Paddle and Chargebee all support cancellation at the end of a paid period, allowing customers to keep access for the time they have already paid for. The implementation differs by provider: Stripe uses cancel_at_period_end, Paddle schedules a cancellation for the next billing date, and Chargebee changes the subscription to non-renewing when it is cancelled at the end of its term.
| Provider | Hosted cancellation option | End-of-period cancellation | Documented limitation |
|---|---|---|---|
| Stripe | The customer portal can allow cancellations, collect cancellation reasons and offer retention coupons | cancel_at_period_end lets the subscription run until the paid period ends | A fully cancelled subscription cannot be restarted |
| Paddle | Subscription-related emails include a cancellation link, which Paddle says is provided for compliance reasons | A scheduled change cancels the subscription on the next billing date | Cancelled subscriptions cannot be reinstated |
| Chargebee | The customer portal can route cancellation requests to Chargebee Retention when configured | Cancelling at the end of the term changes the subscription status to non-renewing | A future-dated subscription can only be cancelled immediately, according to its documentation |
These are descriptions of product behaviour, not legal guarantees. None of the vendor documentation I read claims that default settings meet New York City's or California's requirements. Paddle's cancellation links are a useful built-in feature, but you still need to check how the full customer journey works.
Stripe's customer portal is a practical starting point for a hosted cancellation flow. Chargebee's Retention integration can also support retention offers. However, your application remains responsible for ensuring that the complete experience meets the rules that apply to your customers.
The cancellation control must be reachable through the required medium. If customers subscribe inside your app, for example, provide an obvious route from the app to the hosted portal or a native cancellation screen. Do not assume that an email link alone meets every applicable requirement.
Retention offers must not replace or obstruct cancellation. In California, an online offer must appear alongside a prominent, continuously visible and nearby direct cancellation link or button. Your implementation should preserve that control throughout the offer process.
You also need to build or configure the parts the payment provider cannot manage for you: a reliable consent record, a notice scheduler based on each customer's jurisdiction, and access rules that reflect the subscription's actual state. The provider may know when a subscription ends, but it generally cannot determine every legal deadline that applies to your customer.
Finally, account for subscriptions purchased through app stores. Those customers may need to cancel through the relevant store rather than through your own billing portal. Your interface should direct them to the correct destination and update access when the cancellation is confirmed.
What does an easy cancel cost in retention?
Some subscribers keep paying for services they rarely use. Research on gym memberships and subscription payments links this behaviour to inertia and automatic renewals. However, I found no reliable published estimate of how much a compliant cancellation flow alone reduces retention. The research points more clearly to defaults and inattention than to the effect of the cancel button itself.
In a study of 7,752 members across three health clubs, DellaVigna and Malmendier found that members paying flat monthly fees above $70 attended an average of 4.3 times per month and paid more than $17 per expected visit, despite having the option of a $10-per-visit pass through a 10-visit package. Monthly-contract members were also 17% more likely to remain enrolled beyond a year than members who committed annually. The findings suggest that how a subscription is structured can influence how long people keep paying. See the American Economic Review study.
A separate study by Einav, Klopack and Mahoney examined payment-card data covering ten subscription services. When a card was replaced, subscribers had to make a new decision about continued payment, and cancellation rates rose substantially. The authors estimated that inattention increased seller revenue by between 14% and more than 200% compared with a model in which consumers were fully attentive. This is an NBER working paper, not a peer-reviewed journal article, and its findings concern subscription inertia rather than the isolated effect of a cancellation interface.
How common are difficult cancellation flows?
Regulators have found potentially manipulative design practices across many subscription services. In 2024, consumer protection agencies from 26 countries reviewed 642 websites and mobile apps offering subscriptions. Nearly 76% used at least one possible dark pattern, and nearly 67% used multiple patterns. The review did not establish that every identified practice was unlawful. See the FTC's summary of the international review.
A European Commission mystery-shopping study also found that 97% of the popular websites and apps examined used at least one dark pattern. Difficult cancellation was among the practices identified. Separately, a CHI 2024 study of news-site cancellation flows across four countries (preprint) documented examples of deliberate barriers, including requiring customers to telephone a representative or type a specific phrase to leave.
These studies show that difficult cancellation is widespread enough to attract regulatory attention. They do not establish how much revenue any particular cancellation design generates or how much a business will lose when it makes cancellation easier.
Do dark patterns work, and is there a catch?
Experimental research suggests that dark patterns can influence purchasing decisions, but the effects depend on the design and can come with a reputational cost.
Luguri and Strahilevitz tested manipulative interfaces with representative samples of American consumers. Participants exposed to mild dark patterns were more than twice as likely to sign up for a questionable service as participants in the control group. Those exposed to aggressive patterns were almost four times as likely to sign up. The researchers also found evidence of a stronger consumer backlash against aggressive patterns than against milder ones.
The experiment measured sign-up behaviour, not cancellation rates or long-term retention. It therefore cannot tell a subscription business how much revenue a difficult cancellation flow will preserve. It does show that interface design can affect consumer choices, with potential consequences for trust and legal exposure. See the Journal of Legal Analysis study.
Another study analysed around 53,000 product pages and identified 1,818 instances of dark patterns across approximately 11,000 shopping websites. It also identified third-party companies offering dark-pattern functionality as a ready-made service. This illustrates how manipulative design can become embedded in commercial software, but it does not quantify the retention impact of subscription cancellation barriers. See the study published in the ACM Digital Library.
What has nobody measured?
The isolated effect of making cancellation easier remains uncertain. A 2026 review in Digital Policy, Regulation and Governance concludes that procedural friction is widely documented but lacks a dose-response estimate. It also finds that direct subscription evidence is strongest for passive renewal defaults. See the review.
This distinction matters. Automatic renewal can remain lawful when the business meets the applicable disclosure, consent and notification requirements. But the more difficult question is how much retention comes from customers actively choosing to stay and how much comes from customers forgetting to leave.
One reasonable hypothesis is that clearer renewal reminders will lead some forgetful customers to cancel, while an easier cancellation button will mainly remove unnecessary friction for people who have already decided to leave. That is a hypothesis, not an established research finding. The actual impact will depend on the product, customer base and subscription model.
Estimates of the time and money consumers could save from easier cancellation do not answer the retention question either. The FTC's 2024 analysis used an assumed telephone cancellation time of six minutes and three seconds to estimate the time saved by a simpler process. The Roosevelt Institute estimated annual benefits of $21.5 million to $162.5 million for New York City adults in its letter supporting the proposed rule. These are estimates of consumer benefits, not measurements of lost seller revenue.
What should you measure using your own data?
Measure retention and cancellation behaviour before and after introducing the compliant flow. Track how many customers start cancellation, how many complete it, how long the process takes, how many accept a save offer, how many reactivate within 30 or 90 days, and how many contact support about billing.
For customers in jurisdictions where the law requires an easy cancellation process, do not keep a deliberately obstructive version as a control group. Instead, compare cohorts before and after the change, account for seasonality and acquisition differences, and monitor whether retention changes alongside other customer behaviours.
You can still test other parts of the subscription experience. A two-year randomised experiment involving 680,588 users at a global SaaS company found that longer free trials significantly increased trial adoption and delayed conversion, without a statistically significant effect on immediate conversion. The experiment tested trial length rather than cancellation reminders, but it shows that trial design is another variable worth examining. See the 2025 study in Frontiers in Psychology.
The practical takeaway is to treat compliant cancellation as a requirement, not a retention experiment. Measure what happens after you remove unnecessary friction, and use lawful experiments elsewhere in the subscription journey to understand how to attract and retain customers who genuinely want to stay.
What does enforcement look like, and what does it cost?
The financial consequences go beyond the headline penalty. New York City's rule sets penalties of $525 for a first violation, $1,050 for a second and $3,500 for a third or subsequent violation. A violator is also liable for the amount charged after the customer's first cancellation attempt. See the NYC click-to-cancel rule.
The important detail is how violations are counted. These are fixed penalties per violation, not necessarily one fine per business. DLA Piper interprets the rule as allowing each statement, description or omission that constitutes a deceptive trade practice to count as a separate violation. That could multiply exposure for a cancellation flow used by many customers. However, how the Department of Consumer and Worker Protection (DCWP) will count violations in practice remains uncertain. As of October 25, 2026, I found no published DCWP enforcement action under the new rule.
The city began accepting complaints about difficult-to-cancel subscriptions when the rule took effect on October 1, 2026. DCWP also reported receiving more than 100 complaints about subscription cancellation difficulties in 2025 alone. Mayor Mamdani's Executive Order 10, issued on January 5, 2026, directs the department to prioritise enforcement against subscription practices that deceive or mislead consumers. See the city's click-to-cancel page and DLA Piper's analysis.
New York State has a different penalty structure. Under General Business Law section 527-a, courts can impose civil penalties of up to $100 for a single violation or $500 for multiple violations arising from one act or incident. For knowing violations, the limits rise to $500 and $1,000, respectively. The attorney general can also seek an injunction without proving that someone has already suffered harm. The law provides a defence where a business demonstrates that a violation was unintentional and resulted from a genuine error despite having reasonable procedures in place to prevent it.
The attorney general's May 2025 settlement with Equinox shows how enforcement can extend beyond fines. The company agreed to $600,000 in penalties, changes to its cancellation practices and refunds for subscribers who had tried but failed to cancel. The action concerned the company's failure to provide cost-effective, easy-to-use online cancellation mechanisms. See the New York Attorney General's announcement.
Federal cases show how much larger the consequences can become. Amazon's settlement included a $1 billion civil penalty and $1.5 billion in consumer refunds. Chegg agreed to pay $7.5 million following FTC allegations that it continued charging some customers after they had cancelled. In May 2026, Shutterstock agreed to pay $35 million and maintain simple cancellation mechanisms for its negative-option features.
The FTC has also reported that complaints about negative-option marketing exceeded 90 per day in 2025, illustrating the continued scrutiny of subscription practices.
For a SaaS business, the real cost of non-compliance is therefore not just the penalty listed in a statute. It can include refunds for charges collected after cancellation attempts, engineering work to rebuild the flow under pressure, legal expenses and settlement obligations that disrupt the product roadmap. The best protection is to make cancellation reliable from the start, keep clear records of customer requests and billing events, and verify that the implementation meets the laws applicable to each customer.
What should you ship first?
Build the cancellation path first, then the records and notices. The cancellation path is the part customers, complaint forms and regulators are most likely to test directly. If you have only one week, prioritise the first group.
Cancellation path
- Add a Cancel control to account settings. Customers must be able to reach it through every medium where they can sign up, without being forced to contact an agent, call or start a chat.
- Keep any retention offer and the cancellation button on one page, with equal prominence. Use a clear label such as "Click to cancel".
- Make the final state clear: stop the next charge, display a confirmation and send a confirmation through the customer's original medium.
- If customers can sign up by phone, display a phone number on your website that they can keep and use to cancel.
- Provide a clear route for customers billed through an app store, linking them to the correct store settings.
Records
- Create an append-only cancellation request log. Write each request before calling the billing provider and associate it with an idempotency key to prevent duplicate processing.
- Keep a consent record for each customer, including the time, medium, plan, price, trial terms and version of the text presented.
- Retain these records for at least three years, or one year after termination if that period is longer, to meet California's rule.
- Run a nightly reconciliation job to compare your subscription records with those held by your billing provider.
Notices
- Build a scheduler that calculates trial, renewal and price-change notice dates from the customer's contract state. Store the applicable notice windows in configuration by jurisdiction.
- Schedule notices to be sent comfortably within the required window, rather than at its very beginning or end.
- Log every notice, including its delivery channel and send time.
- Implement a refund process for price increases where New York law requires one.
Checks before launch
- Walk through your own sign-up and cancellation flows on a phone. Time each process and compare how easy it is to sign up versus cancel.
- Test each failure scenario identified in the cancellation-flow section to confirm that requests, billing changes and confirmations behave correctly.
- Ask a lawyer who practises in your largest customer markets to review the implementation before launch.
Where RocketDevs fits
A compliant cancellation flow is a focused engineering project. It needs a settings screen, a cancellation state machine, a notice scheduler and an audit log connected to your billing provider. You do not need a large agency or a team-sized project. You need an engineer with experience in webhooks, retries and idempotency who can test how the different parts behave when something goes wrong.
Each RocketDevs developer is assessed over 6-8 hours, with only the top 2% of applicants accepted. A Senior-tier engineer is $30.99/hr. For this project, we would start with the cancellation request log and state machine, connect the billing provider, then build the notice scheduler and retention page. The goal is to give your lawyer a working flow to review, not just a plan on paper.
You can test the fit on a 14-day risk-free trial, money back and 100% honoured. Build a vetted team with RocketDevs. You can also read our guide on how to write a product spec developers can build from to define the scope clearly.
If you are comparing this build with a larger programme, these guides can help you assess the options. MVP development for startups and the cost of building a SaaS platform cover budgeting. Can a solo developer build a SaaS app? explores the staffing question, while our guide to a pre-launch security review covers security considerations for audit logs and webhook endpoints.
Conclusion: make cancellation a feature, not a fight
A compliant click-to-cancel flow is more than a button in your account settings. It is a reliable process that lets customers leave without unnecessary friction, stops billing when it should, records what happened and sends the notices each jurisdiction requires. Get those details wrong, and the cost can extend well beyond a fine to refunds, legal disputes and urgent engineering rework.
The practical starting point is straightforward: build the cancellation path first, make every state change traceable, automate notice deadlines and test what happens when a provider call fails or a webhook arrives late. Then have a lawyer review the flow against the laws that apply to your customers. Treat cancellation as a core product journey, not an afterthought, and you can reduce compliance risk without turning a focused engineering task into a major rebuild.
You do not need a large team to get the foundations right. You need the right engineering experience, a clearly scoped build and enough testing to prove the flow works when real customers use it. Build cancellation so it is easy to complete, difficult to break and straightforward to audit.
Frequently asked questions
What is the click-to-cancel rule?
New York City's rule requires a cancellation mechanism that is as easy to use as the method a customer used to sign up, available through the same medium. California requires online cancellation for customers who can sign up online, while Virginia generally bars requiring customers to interact with an agent. The exact requirements and effective dates vary by jurisdiction, so businesses should check the laws that apply to their customers before building the flow.
Is the FTC click-to-cancel rule still in effect?
No. The Eighth Circuit vacated the FTC's amended Negative Option Rule on July 8, 2025, because the Commission had not followed the required procedures. In March 2026, the FTC sought public comment on whether to develop a new rule, and Skadden reports no replacement rule or timetable. The Restore Online Shoppers' Confidence Act (ROSCA) remains in effect and requires covered online sellers to provide a simple way to stop recurring charges.
Can I still offer a discount when someone clicks cancel?
Yes, in New York and California, provided the offer does not obstruct or delay cancellation. California requires a prominent, continuously displayed cancellation button alongside an online retention offer, while New York prohibits unreasonable or unlawful conditions that make cancellation harder. A practical approach is to display the offer and cancellation button on the same page, giving customers a clear choice to accept the offer or proceed with cancellation.
Do I need a click-to-cancel button if I only sell to businesses?
Not necessarily. California and New York's consumer protection rules generally focus on purchases for personal, family or household purposes, while Virginia's definition of a consumer includes certain small businesses acquiring services for business use. A self-service SaaS plan purchased by an individual may therefore be covered even if your company also serves business customers. Ask legal counsel to assess sales-led contracts and customer eligibility, and consider using one straightforward cancellation flow for self-service plans.
How much is the penalty for a non-compliant cancellation flow?
In New York City, the penalty schedule starts at $525 for a first violation, rises to $1,050 for a second and $3,500 for a third or subsequent violation. A violator is also liable for the amount charged after a customer's first cancellation attempt. New York State has a separate penalty structure, with civil penalties of up to $100 for a single violation or $500 for multiple violations arising from one act, increasing to $500 and $1,000 respectively for knowing violations. Federal enforcement can involve much larger sums: Amazon's settlement included a $1 billion civil penalty and $1.5 billion in consumer refunds. The actual exposure depends on the law, the conduct and how violations are counted.
How should a SaaS company test its click-to-cancel flow before launch?
Test the complete journey on a mobile device, from finding the cancellation option to receiving confirmation. Verify that the next charge is stopped, cancellation requests are recorded, repeated requests do not create errors, and billing-provider failures or delayed webhooks do not leave the subscription in the wrong state. Check that required notices are sent within the applicable deadlines, then have legal counsel review the flow for the jurisdictions where you operate. A cancellation journey should be easy for customers to complete and straightforward for your team to verify.
James Hitch, COO at RocketDevs.LinkedIn
Sources
Laws, rules and court opinions
- NYC Department of Consumer and Worker Protection, Notice of Adoption, Title 6 RCNY part 8, Click to Cancel, adopted July 10, 2026, effective October 1, 2026
- New York State Legislature, General Business Law section 527-a, unlawful practices, read October 25, 2026
- California Legislature, AB 2863, Chapter 515, Statutes of 2024, approved September 24, 2024
- US Court of Appeals for the Eighth Circuit, Custom Communications, Inc. v. Federal Trade Commission, No. 24-3137, July 8, 2025
- Legal Information Institute, Cornell Law School, 15 U.S. Code section 8403, negative option marketing on the Internet, ROSCA section 4
- New York State Legislature, A.3008-C, Part W (automatic renewals), 2025
- Virginia General Assembly, Code of Virginia section 59.1-207.46, read October 25, 2026
- Minnesota Office of the Revisor of Statutes, Minnesota Statutes section 325G.59, 2025 statutes
- UK Parliament, Digital Markets, Competition and Consumers Act 2024, Part 4, Chapter 2 (subscription contracts), prospective text
- Office of the Federal Register, Electronic Code of Federal Regulations, 16 CFR Part 425, Use of Prenotification Negative Option Plans, up to date as of October 22, 2026
- US Government Publishing Office, US Code, 2023 Edition, Title 15, section 8403, 2023 edition
- Virginia General Assembly, Code of Virginia section 59.1-207.45, definitions, read October 25, 2026
Regulators and enforcement
- NYC Office of the Mayor, Mayor Mamdani announces landmark Click-To-Cancel consumer protection rules (press release), July 10, 2026
- US Federal Trade Commission, Rule Concerning the Use of Prenotification Negative Option Plans, advance notice of proposed rulemaking, Federal Register, March 13, 2026
- US Federal Trade Commission, FTC announces final click-to-cancel rule (press release), October 16, 2024
- US Federal Trade Commission, Regulatory Agenda, Federal Register, August 14, 2026
- US Federal Trade Commission, Revision of the Negative Option Rule, Withdrawal of the CARS Rule, Removal of the Non-Compete Rule, Federal Register, February 12, 2026
- US Federal Trade Commission, FTC secures historic $2.5 billion settlement against Amazon (press release), September 25, 2025
- US Federal Trade Commission, Chegg to pay $7.5 million to settle FTC allegations concerning unlawful cancellation practices (press release), September 15, 2025
- US Federal Trade Commission, FTC sues to stop sprawling enterprise operating unlawful subscription schemes (press release; allegations only), June 17, 2026
- US Federal Trade Commission, Negative Option Rule, final rule, Federal Register (vacated July 2025), November 15, 2024
- US Federal Trade Commission with ICPEN and GPEN, Results of review of dark patterns affecting subscription services and privacy (press release), July 10, 2024
- NYC Government, Click to Cancel, nyc.gov, read October 25, 2026
- Office of the New York Attorney General, Attorney General James secures $600,000 from Equinox for hard-to-cancel memberships (press release), May 30, 2025
- US Federal Trade Commission, Shutterstock to pay $35 million to settle FTC allegations (press release), May 13, 2026
Law firm analysis
- Skadden, Arps, Slate, Meagher & Flom, New York City's Click-to-Cancel Rule: What Businesses Need to Know, September 8, 2026
- DLA Piper, New York City adopts Click-to-Cancel rule and proposes junk fee regulations, July 27, 2026
- Olshan Frome Wolosky, New York quietly passes critical consumer protection measures in budget bill, June 2025
- Ashurst, New York and Colorado update auto-renewing subscription requirements, 2025
- Kilpatrick Townsend & Stockton, California's latest automatic renewal law amendments take effect in July 2025, October 2024
- Greenberg Traurig, Virginia enacts automatic renewal consumer protection law, May 2026
- K&L Gates, New EU withdrawal button requirement: practical implications for US and global online sellers, July 8, 2026
- Lewis Silkin, Consumer law update: subscriptions regime delayed again to spring 2027, April 2, 2026
- TLT, DMCC Act subscription contracts regime brought forward by the PM, August 2026
- Manatt, Phelps & Phillips, Eighth Circuit vacates the FTC's recently amended Negative Option Rule, July 2025
- Cooley, FTC issues new advance notice of proposed rulemaking on negative option marketing, March 20, 2026
- Covington & Burling, FTC launches new rulemaking on the Negative Option Rule, March 12, 2026
- Kelley Drye & Warren, FTC quietly reopens click to cancel rulemaking in response to petition, 2025
- Wilson Sonsini, California amends automatic renewal law again, 2024
Research
- Norwegian Consumer Council, You can log out, but you can never leave, January 14, 2021
- DellaVigna and Malmendier, American Economic Review 96(3), Paying Not to Go to the Gym, 2006
- Einav, Klopack and Mahoney, NBER Working Paper 31547, Selling Subscriptions, 2023
- European Commission, summarised by Deceptive Patterns, Behavioural study on unfair commercial practices in the digital environment: dark patterns and manipulative personalisation, 2022
- Sheil, Acar and Schraffenberger, CHI 2024, Staying at the Roach Motel: Cross-Country Analysis of Manipulative Subscription and Cancellation Flows, 2024
- Sheil, Acar and Schraffenberger, arXiv:2309.17145, Staying at the Roach Motel (preprint), 2023
- Luguri and Strahilevitz, Journal of Legal Analysis, Shining a Light on Dark Patterns, 2021
- Mathur et al., Proceedings of the ACM on Human-Computer Interaction, Dark Patterns at Scale, 2019
- Bikowski, Elsayed and Daif, Digital Policy, Regulation and Governance, Cancellation friction and consumer protection in subscription markets, 2026
- Roosevelt Institute, Letter to DCWP regarding the proposed click-to-cancel rule, 2026
- Zhang and Duan, Frontiers in Psychology, Longer or shorter? A large-scale randomized field experiment on the impact of free trial duration, 2025
Vendor and standards documentation
- Apple Support, Cancel a subscription from Apple, read October 25, 2026
- Paddle, Cancel a subscription, Paddle developer documentation, read October 25, 2026
- Stripe, Cancel subscriptions, Stripe Billing documentation, read October 25, 2026
- Chargebee, Subscription cancellations, Chargebee documentation, read October 25, 2026
- Stripe, Entitlements, Stripe Billing documentation, read October 25, 2026
- Stripe, How subscriptions work, Stripe Billing documentation, read October 25, 2026
- Vindicia, Cancel a subscription, Vindicia help, read October 25, 2026
- IETF HTTPAPI working group, The Idempotency-Key HTTP Header Field, Internet-Draft, October 2026
- Stripe, Receive Stripe events in your webhook endpoint, read October 25, 2026
- Stripe, Subscription webhooks, Stripe Billing documentation, read October 25, 2026
- Stripe, Configure the customer portal, read October 25, 2026
- Chargebee, How to set up Chargebee Retention for the Chargebee customer portal, read October 25, 2026

Written by
James Hitch
COO
James Hitch is the COO of RocketDevs, where he runs sales, recruiting, and the vetting operation that accepts only the top 2–3% of developer applicants. He cares about putting accessible, elite engineering talent within reach of founders and startups worldwide, at a fair price. He writes about technical hiring, building AI-native engineering teams, and how startups can access elite developers affordably.
More from our blog
Continue exploring insights and stories from RocketDevs
