Click-to-cancel got struck down: what still applies to advertiser subscriptions on a classifieds site

An advertiser signs up for a subscription because it beats paying per listing, forgets about it for four months, and then can't find a cancel button anywhere near where the sign-up button was. Instead of calling support, they call their card issuer, and the chargeback that lands on the merchant account a week later has nothing to do with age verification or content moderation. It has to do with a checkout flow nobody reviewed once the payment processor was approved and everyone moved on to the next problem.

It's tempting to treat this as solved news. In July 2025, a federal appeals court threw out the FTC's headline click-to-cancel rule days before it was due to take effect, and the version of the story that traveled fastest was the simplest one: the rule is dead, cancellation flows are back to normal. That reading is wrong in a way that matters to anyone billing advertisers on a recurring basis. The rule that got struck down was never the only rule, and the statute it was built on top of survived untouched. None of what follows is legal advice, and a business running recurring charges should have its actual signup and cancellation flow reviewed by a lawyer, not just the theory of one.

The rule that got struck down, and the one that didn't

What was vacated was a 2024 update to the FTC's Negative Option Rule, the one everyone called click-to-cancel. The Eighth Circuit threw out the whole thing in July 2025 on a technical ground: the FTC had skipped a preliminary economic analysis the law required before adopting a rule of this size. The court never reached the question of whether the rule's substance, clear disclosure, real consent, easy cancellation, was reasonable. A rule struck down for skipping a form is a rule an agency can rewrite and reissue. It is not a rule whose ideas were rejected.

What survived untouched is the Restore Online Shoppers' Confidence Act, a statute Congress passed in 2010, not a rule the FTC wrote, so no court can vacate it over a missing form. ROSCA covers any negative option sold over the internet, meaning any subscription, membership, or recurring listing plan where silence is treated as agreement to keep paying. It requires three things in plain terms: disclose the price and the renewal terms clearly before taking the customer's card number, get an actual yes to the recurring charge instead of burying it inside a general terms-of-service checkbox, and provide a way to stop the charges that takes no more effort than signing up did.

The FTC has kept enforcing exactly these three requirements since the vacatur, relying on ROSCA itself and on the FTC Act's general ban on unfair or deceptive practices, which reaches the same conduct even without a dedicated rule attached to it. A chargeback is the customer-side version of the same failure, since a cardholder who can't find the cancel button usually disputes the charge with their bank instead, while a federal complaint is the regulator-side version, and it doesn't require the advertiser to have disputed anything with their bank at all.

None of this is unique to subscription businesses of a particular size. ROSCA sets no transaction-volume floor, no industry carve-out, and no small-business exception. A directory running fifty advertiser subscriptions a month answers to the same three requirements as a company running fifty million.

What enforcement looks like without a dedicated rule

The clearest way to see what the FTC actually penalizes is to look at what it has already penalized, since none of it required the vacated rule to exist. In August 2024, Care.com paid 8.5 million dollars to settle claims that included burying its subscription cancellation behind a multi-step process while continuing to charge people who thought they were done. The case ran entirely on ROSCA and the FTC Act's unfairness standard, the same two tools still available today.

In September 2025, two months after the click-to-cancel rule was struck down, the FTC brought two more cases ten days apart. Chegg, an education platform, paid 7.5 million dollars over a pattern in which roughly two hundred thousand people who asked to cancel kept getting charged anyway. Ten days later, Amazon agreed to a settlement of 2.5 billion dollars, split between a civil penalty and refunds to roughly thirty five million consumers, over Prime enrollment and cancellation flows the agency called deliberately complicated.

The dollar figures scale with the size of the company, not with the size of the violation. What all three cases share is the same underlying failure: a cancellation path that took more clicks, more screens, or more waiting than the signup path did. That is the fact pattern a regulator looks for, and it exists at any transaction volume, including one advertiser subscription a day.

None of these settlements required proof of intent to deceive. A checkout built by a developer optimizing for fewer signup drop-offs, sitting next to a cancellation flow nobody optimized at all because it doesn't generate revenue, produces exactly this asymmetry by accident. The standard the FTC applies doesn't ask why the two paths are different lengths. It asks whether they are.

The states that didn't wait for Washington

Even if a federal rule comes back exactly as written, and even if it doesn't, more than thirty U.S. states already have their own automatic-renewal statutes on the books, and several tightened them further after the federal rule was vacated rather than easing off. For an operator selling advertiser subscriptions nationally, the practical standard isn't the loosest state's law. It's the strictest one a customer might be sitting in, because there is no way to know which advertiser is calling a state attorney general before it happens.

California is the state to design around, not because it is the strictest on every point but because it is specific enough to build a checklist from. Since July 2025, its Automatic Renewal Law has required clear disclosure of the renewal terms before payment, an annual reminder notice covering the price and how to stop the charge, and a cancellation method that works in the same channel the customer used to sign up. An account opened online has to be cancellable online, without a phone call or a retention conversation standing in the way.

That last point catches more directories than the others, because it is common to route every cancellation request through a support inbox or a call meant to save the account. Under California's requirement that cancelling be no harder than signing up, and under ROSCA's own requirement for a simple cancellation mechanism, that routing is itself the violation, independent of whether the advertiser eventually does get to cancel. The friction is the problem, not just the outcome.

Whichever pricing model a directory settles on, a subscription that renews automatically inherits every one of these obligations the moment it launches, while a plain pay-per-post listing, which ends on its own without anyone having to cancel anything, inherits none of them. That difference in exposure is worth weighing before a recurring plan replaces the one-time fee as the default option on the pricing page, not after.

Two bills, one direction, no law yet

Washington hasn't been idle since the vacatur, and an operator watching from the sidelines should know roughly where things stand without treating any of it as settled. In March 2026, the FTC opened a new rulemaking proceeding asking the public whether to revive the rule's core ideas, following a petition two consumer advocacy groups had filed at the end of 2025. The comment period closed in April 2026, and as of this writing the agency has not issued a new rule.

In Congress, a bill called the Unsubscribe Act would write the same three requirements into a statute instead of a regulation, which would put it out of reach of the kind of procedural challenge that killed the FTC's rule. A companion version has been sitting in the Senate since mid-2025, and a bipartisan House version was reintroduced in January 2026. Neither has passed, and nothing says either will.

The direction is consistent even if the timeline isn't. Nobody at the federal or state level is moving toward loosening these requirements. Building a cancellation flow that only just clears ROSCA today is building something that will need revisiting the moment either the FTC or Congress finishes what is already in motion.

What to fix this month

Start by watching someone else sign up for a subscription and then cancel it, on the actual site, not the design mockup. Time both. If cancelling takes more clicks, more page loads, or one more phone call than signing up did, that gap is the exposure described in every case above, whatever the terms of service happen to say.

Separate the recurring-charge consent from the general terms-of-service checkbox. A single box agreeing to terms and conditions that happen to mention auto-renewal in paragraph twelve does not satisfy the express-consent requirement on its own. The renewal price and frequency need their own visible line before the card is charged, not a cross-reference to a document nobody reads.

Move cancellation out of the support queue and into the account settings page, reachable without writing an email or waiting for a reply. If a retention offer is going to be shown, show it after the cancellation request has been logged, not instead of processing it, and record the date and channel of every cancellation the same way transaction records are already kept for chargebacks.

Build to California's standard even for advertisers who are not in California, since a national subscription product cannot easily run two different cancellation flows by state, and the version that would fail elsewhere is the one missing the annual reminder and the online-only cancel path. Whatever gets fixed this month keeps working whether a new federal rule arrives next year or never does, because the obligations it would restate are already sitting in a statute nobody vacated.