The law

Can they legally make it this hard to cancel?

Published August 20, 2026 · updated August 22 · 12 min read

In July 2025 a court threw out the FTC's click-to-cancel rule and the headlines said the protections were gone. Two months later the FTC fined Amazon a billion dollars for exactly the thing the dead rule was supposed to stop. Both of those are true, and the gap between them is the part nobody explained.

What actually happened

The story got compressed into one headline — "click-to-cancel struck down" — and a lot of detail fell out. Here is the sequence, with dates, because the dates are doing most of the work.

• December 29, 2010 The Restore Online Shoppers' Confidence Act (ROSCA) is signed into law. It sets three conditions on charging anyone for an online subscription. It is a statute passed by Congress, not an agency rule.
• October 2024 The FTC finalises an amended Negative Option Rule — the "click-to-cancel" rule. It goes much further than ROSCA: prescriptive disclosure requirements, express informed consent, and a cancellation mechanism at least as easy as the one used to enroll.
• July 8, 2025 The Eighth Circuit vacates the rule in its entirety in Custom Communications, Inc. v. FTC — six days before it was due to take effect. The reasoning is procedural, not substantive: the court held the FTC skipped a preliminary regulatory analysis it was required to perform once it found the rule would cost more than $100 million a year.
• September 25, 2025 Eleven weeks after the rule dies, the FTC announces a $2.5 billion settlement with Amazon over Prime enrollment and cancellation — charged under the FTC Act and ROSCA. Not the rule. The statute.
• March 11, 2026 The FTC announces an Advance Notice of Proposed Rulemaking to consider reviving parts of the vacated rule. Published in the Federal Register March 13, comments closed April 13. As of August 2026, no replacement rule has been issued.

So the honest answer to "is click-to-cancel still a thing in 2026" is: the rule is gone and a replacement is somewhere in a queue. That is genuinely a loss. But it is not the whole board, because the rule was never the only thing on it.

The law they didn't touch

Here is ROSCA's operative sentence. It is short, it is in plain English, and almost nobody writing about this quotes it — so, quoted in full rather than paraphrased:

Read clause three again. Simple mechanisms. That obligation has been federal law since 2010. The Eighth Circuit decision in 2025 vacated an FTC rule; it did not and could not repeal an act of Congress. ROSCA is exactly as much in force today as it was the day before the ruling.

What "simple" turned out to be worth

A vague word in a statute means nothing until somebody enforces it. In September 2025, somebody did.

The FTC announced a settlement with Amazon and two executives over how consumers were enrolled in Prime and what happened when they tried to leave. The agency's own summary of the allegation is that Amazon "enrolled millions of consumers in Prime subscriptions without their consent, and knowingly made it difficult for consumers to cancel." The numbers:

The FTC noted this was only the third ROSCA case in which it had obtained a civil penalty — which tells you both that the statute has teeth and that they are not often bared. Three cases in fifteen years is not a dragnet.

The order also required Amazon to change the flows themselves: a clear button to decline Prime, conspicuous disclosure of cost and renewal terms, and cancellation "using the same method that consumers used to sign up" — a process that "cannot be difficult, costly, or time-consuming."

Note where that as-easy-as-signup language lives. It is in the order, binding on Amazon. It is not in ROSCA, and it does not automatically bind anyone else. That is the difference between a settlement and a rule, and it is why the vacated rule mattered: a rule would have applied that standard to everybody at once.

Six days after the rule died, the FTC did it anyway

Amazon is the headline number. The more revealing case is a small one almost nobody covered.

On July 14, 2025 — six days after the Eighth Circuit vacated the click-to-cancel rule — the FTC announced a settlement with Southern Health Solutions, Inc., trading as Next Medical and NextMed, a telehealth company selling GLP-1 weight-loss memberships. The Commission voted 3–0 to issue the complaint. The settlement was $150,000.

Most of that case is not about cancellation at all. It is about fake Trustpilot reviews, before-and-after photos of people who were never customers, gift cards offered in exchange for deleting bad reviews, and weight-loss claims with nothing behind them. Worth saying plainly, because the interesting part is what else was in the complaint.

Three of the FTC's allegations were that NextMed:

• "failed to adequately disclose the terms of its membership programs, including the 12-month commitment and early termination fee"
• "failed to obtain informed consent to charge consumers"
• "failed to process consumers' cancellation and refund requests in a timely manner"

Those are the three requirements of the click-to-cancel rule — clear disclosure of material terms, express informed consent, simple cancellation — charged under the FTC Act, one week after a court had thrown the rule out. The consent order goes further and requires NextMed to obtain informed consent before billing, to disclose refund and cancellation terms before consumers are asked to pay, and to "provide a simple way for consumers to request cancellations or refunds" and honour them promptly.

Your state may have gone further

While the federal rule was being litigated, states kept legislating. Trackers maintained by law firms and compliance vendors count at least 25 US jurisdictions with an auto-renewal statute on the books as of 2026, and several of them contain precisely the language the vacated federal rule would have supplied. A sample of the more specific ones:

This is a patchwork, not a floor. The requirements differ, the effective dates differ, and which one applies to a given transaction is a question with a real answer that depends on facts we can't see from here. What the table is good for is a rough sense of the gap between "there is no federal rule" and "there is nothing."

The parts that are genuinely unsettled

A page like this is worth less than nothing if it only tells you the encouraging half. So:

"Simple" has no definition

ROSCA does not define the word, and outside of specific enforcement actions there is no general federal standard for how many clicks, screens or retention offers is too many. That vagueness is the entire reason the FTC wanted a rule.

ROSCA covers transactions "effected on the Internet"

That is the statute's own language. A gym membership signed on paper at a front desk, or a subscription sold over the phone, sits outside it — other rules may apply, but not this one. Several state statutes are broader on this point.

The FTC brings the cases

ROSCA is enforced by the Federal Trade Commission. What that means in practice is that the remedy for a bad cancellation flow is a regulator deciding a pattern is worth pursuing — which is slower and less personal than most people expect when they discover the law is on their side.

Three cases in fifteen years

The FTC's own note that Amazon was only its third ROSCA civil penalty is the most honest single data point on this page. The statute is real. Enforcement is rare. Both things are true at once, and a company weighing whether to make its cancel button smaller is weighing exactly that.

Where to report it

If a cancellation flow struck you as deliberately obstructive, the two places that collect that are:

• The FTC, at ReportFraud.ftc.gov. Reports feed the Consumer Sentinel Network, which the FTC and other agencies use to spot patterns. One report is a data point; the Amazon case started as a lot of data points.
• Your state attorney general's consumer protection office. Often the more relevant route, because the state auto-renewal statutes above are enforced at state level, and several are stricter than anything federal.

What this changes on a Tuesday

Practically: less than you'd hope, and more than nothing.

Knowing the statute exists does not make the retention wall disappear. Nobody at a chat support desk is going to be moved by a citation, and a cancellation attempt that opens with a legal threat mostly gets escalated to someone whose job is to slow it down further. If you're at that stage, the thing that actually works is a clear, unemotional, written cancellation request that creates a record — which is what our cancellation scripts are for.

What the law changes is the frame. The friction you hit is not you being bad at computers, and it is not an accident of bad design. It is a deliberate product decision, made by people who ran the numbers, in a category where the regulator has extracted a billion-dollar penalty for going too far. Knowing that is worth something on the third screen of a cancellation flow, if only because it stops you assuming the problem is you.

Disclosure, since this page argues in a direction that happens to suit us: Charge Ninja is a paid product and a one-time payment rather than a subscription. Nothing above depends on that. The statute is quoted from the US Code, the settlement figures are from the FTC's own press release, and every source is linked below so you can check the argument without taking our word for any of it.

Common questions