Navigating ‘Click to Cancel’ Regulations

Automatic renewals have become a preferred method of goods and service delivery for many businesses, particularly in the context of e-commerce. The ever-changing landscape of federal and state laws regulating negative options and automatic renewals has been widely documented.
Each month, new and amended state laws are proposed, introduced, and oftentimes passed. Overlaying the state laws, there are existing federal laws and regulations that govern negative options. This has resulted in a patchwork of state and federal laws and regulations, making absolute compliance a difficult proposition for many companies.
In a purported effort to provide clarity to companies regarding their compliance obligations in this space, the Federal Trade Commission (FTC) recently finalized its Rule Concerning Recurring Subscriptions and Other Negative Option Programs (the Final Rule). While the Final Rule has reached the last stage of the FTC’s rulemaking process, questions remain. In particular, the Final Rule is facing multiple legal challenges from a number of industry groups who assert that the Final Rule is arbitrary and an abuse of the FTC’s discretion. Regardless of the pending challenges, the promulgation of the Final Rule is a significant update for sellers and consumers who participate in automatic renewal programs, and it is vital for sellers to take note of the requirements and move toward compliance.
Although the prevalence of subscription models appears to have significantly increased in recent years alongside the advent and expansion of e-commerce, the regulation of negative option plans and subscription-based offerings is certainly not a new concept. In 1973, the FTC, the leading federal advertising regulator, first introduced its Negative Option Rule. The Negative Option Rule was promulgated in the context of the somewhat outdated “book of the month” subscription model (remember getting 8 records for $1?), whereby members would receive advance notice of an upcoming publication and would then have ten days to reject the offering. If the member failed to reject the offer, the publication/record would be sent, and the member would be responsible for paying for it, much to many parents’ chagrin.
In addition to the Negative Option Rule, there are various other federal laws currently on the books that govern aspects of these types of programs. In particular, the Restore Online Shoppers’ Confidence Act (ROSCA) requires marketers utilizing negative option contracts to provide a “simple mechanisms for a consumer to stop recurring charges from being placed on the consumer’s credit card, debit card, bank account, or other financial account.” 15 U.S.C. §§8403(3).
In addition to the federal laws, there is an ever-evolving web of state laws that govern automatic renewals for residents of the specific state. Although many of these automatic renewal laws include similar or related requirements, there are clear and distinct differences in the requirements in the states that have separate automatic renewal laws, and there are some states that do not have separate automatic renewal laws.
Further, these state laws are a moving target, as they are constantly passing and being amended. For example, California, historically a leader in automatic renewal regulation, recently amended its automatic renewal law, with the amended law set to go in effect on July 1, 2025. Turning to the highly publicized recent developments at the FTC, the process to update the Negative Option Rule was initiated in 2019 when the FTC issued an Advance Notice of Proposed Rulemaking (ANPR), seeking comment on the existing Negative Option Rule.
In a related but separate move, in 2021, the FTC published its Enforcement Policy Statement Regarding Negative Option Marketing (Enforcement Policy Statement). In releasing the Enforcement Policy Statement, the FTC purported to “provide guidance regarding its enforcement of various statutes and FTC regulations” in the negative option space. However, FTC guidance documents like the Enforcement Policy Statement do not have the force of law. Because of that, the Enforcement Policy Statement was and continues to be the subject of some criticism as it appeared to detract from and not be additive to the proper process, that being the rulemaking process that had already been initiated. In any case, the FTC persisted with its rulemaking process in parallel.
In 2023, after reviewing the comments it received in response to the ANPR, the FTC issued a notice of proposed rulemaking (NPRM), where it proposed to amend the existing Negative Option Rule (Proposed Rule). After holding an informal hearing at the beginning of 2024, the FTC recently announced that it had finalized the Final Rule.
Notably, by promulgating the Final Rule, the FTC has sought to expand its authority to obtain civil penalties, notwithstanding the Supreme Court ruling in AMG Capital Mgmt., LLC v. FTC, 593 U.S. 67 (2021). In fact, Commissioner Melissa Holyoak issued a dissenting statement alongside the FTC’s announcement of the Final Rule, labeling it as “nothing more than a back-door effort at obtaining civil penalties in any industry where the negative option is a method to secure payment.”
It is important for impacted sellers to understand the potential monetary relief that the FTC is likely to seek in relevant enforcement actions going forward, particularly since the penalty per violation is currently set at $51,744, and there can be several violations in one transaction. Many of the provisions and concepts contained within the Final Rule will be familiar to those who regularly track relevant state laws, as they are consistent with or similar to existing obligations that apply on certain state-wide bases. Importantly, the Final Rule applies broadly, including in both business-to-consumer and business-to-business transactions.
Pursuant to the Final Rule, sellers are required to make certain disclosures to consumers and obtain the consumer’s express informed consent to the negative option feature in a specific manner. Prior to obtaining a consumer’s billing information, sellers must disclose to the consumer all material terms of the transaction, including but not limited to: that consumers will be charged for the good or service, or that charges will increase after any applicable trial period, and that charges will be on a recurring basis unless the consumer cancels; each deadline by which the consumer must act to prevent or stop future charges; the amount and frequency at which the consumer will be charged; and information on how to cancel.
Sellers must also obtain the consumer’s unambiguously affirmative consent to the negative option feature separately from any other portion of the transaction, and must not include any information that interferes with, detracts from, contradicts, or otherwise undermines the ability of consumers to provide their expressive informed consent to the negative option feature. Subject to a specific exception, sellers must maintain verification of the consumer’s consent for at least three years. The Final Rule states that consent is obtained through a check box, signature, or other similar method where the consumer must affirmatively select or sign to accept the negative option feature and no other portion of the transaction will be deemed in compliance with this requirement.
Further, the Final Rule specifies that the method of cancellation provided must be as easy to use as the mechanism the consumer used to enroll in the negative option feature. For online enrollment where online cancellation is required, the cancellation method must be easy for the consumer to find, and consumers must not be required to interact with a live or virtual representative (such as a chatbot) to cancel if the consumer did not interact with such representative as part of the enrollment process. Therefore, consumers must be able to “click to cancel.”
In addition, cancellation requests made over the phone must be processed during normal business hours, and online or phone cancellation must also be available where in-person cancellation is provided. Providing in-person enrollees a remote (online/phone) method of cancellation is an enhancement of existing cancellation obligations and will affect many gym memberships.
Unfortunately, the Final Rule does not supersede, alter, or affect any state laws, except to the extent that any state law is inconsistent with the Final Rule. Any state laws that provide greater protection to the consumer still apply. Therefore, businesses must ensure compliance with the Final Rule and applicable state laws, adding an additional obligation.
The actual effective dates will be known once the Final Rule is published in the Federal Register (which as of today’s date has not yet occurred). Much of the Final Rule’s provisions will go into effect in 180 days from publication, except for the misrepresentation prohibitions, which are slated to be effective within 60 days from publication.
Although we are awaiting the publication of the Final Rule, the story appears to be far from over. Notably, the Proposed Rule included two additional requirements that did not make it to the Final Rule. Namely, a requirement to send an annual reminder to consumers and a prohibition against forcing consumers to receive “save” offers without first obtaining the consumers’ unambiguous affirmative consent.
Although the FTC declined to include these provisions in the Final Rule, it notes that it plans to seek further comments on these points through a supplemental NPRM, and therefore “keeps the record open on these issues.”
In addition, shortly after the FTC announced the Final Rule, two lawsuits were filed against the FTC, petitioning for review of the Final Rule. The respective petitioners, comprised of several industry groups, including the Electronic Security Association, the Interactive Advertising Bureau, and NCTA — The Internet & Television Association, assert that the Final Rule is “arbitrary, capricious, and an abuse of discretion” and request that the respective Courts “hold unlawful, vacate, enjoin, and set aside the Final Rule.” Only having just been filed, the lawsuits are in their nascent stage.
Affected businesses should certainly monitor the progression of these lawsuits as the Final Rule moves toward the effective dates. The question remains, however, whether the Final Rule has moved us closer to clarity on compliance obligations with these subscription models, or further away.
Ultimately, companies engaged in such automatic renewal practices should take proactive steps now to bring their enrollment, consent, and cancellation practices into compliance with the Final Rule requirements.
The Final Rule reflects how the current makeup of the FTC views negative options and automatic renewals, and unless one of the challenges is effective, it will be enforceable against sellers. In addition, it is imperative that such companies continue to monitor emerging state laws that may afford consumers greater protection than the Final Rule and take steps to comply with any such requirements as they are rolled out.

*****