Click-to-cancel rules for SaaS: where things stand in November 2026

“Click to cancel” is shorthand for a simple idea: if a customer can sign up online, they should be able to cancel online, without a phone call or an obstacle course. In the US, the FTC tried to make that a nationwide rule in 2024; a federal court threw the rule out in 2025, and the FTC started over in 2026. Meanwhile, state laws, an older federal statute and European rules already require much of the same thing.

This article summarizes the situation as of November 3, 2026, with links to the sources we relied on. Laws in this area are moving, so check the dates on everything you read, including this.

This is not legal advice. It is a starting point for a conversation with a lawyer who knows your markets and your business model.

Summary table

Jurisdiction	Rule	Status on November 3, 2026	Applies to
US (federal)	FTC “Click-to-Cancel” amendments to the Negative Option Rule (2024)	Vacated by the Eighth Circuit, July 8, 2025	Not in force
US (federal)	New FTC rulemaking on negative option marketing	Advance notice published March 2026; no proposed rule text found	Not in force
US (federal)	Restore Online Shoppers’ Confidence Act (ROSCA)	In force; actively enforced	Online negative option sales to consumers
California	Automatic Renewal Law, as amended by AB 2863	Amendments in force since July 1, 2025	Consumers in California
EU	Withdrawal function (Directive 2023/2673)	Applies from June 19, 2026, subject to national transposition	Online consumer contracts with a right of withdrawal
EU	Digital Fairness Act	Proposal expected but not published as of this date	Not in force
Germany	Cancellation button, BGB section 312k	In force since July 1, 2022	Consumer contracts for ongoing services concluded online
UK	DMCC Act 2024, subscription contracts regime	Not yet in force; start announced for January 2027	Consumer subscriptions

United States: the FTC rule that didn’t happen

What the 2024 rule said

In October 2024, the FTC finalized amendments to its 1973 Negative Option Rule. Among other things, they required sellers to make cancellation at least as easy as signup, and to offer an online cancellation method when the customer signed up online. Most provisions were due to take effect on July 14, 2025.

What the court did in July 2025

On July 8, 2025, the US Court of Appeals for the Eighth Circuit vacated the amendments in Custom Communications, Inc. v. FTC (No. 24-3137). The court held that the FTC Act required the agency to prepare a preliminary regulatory analysis once the rule’s expected economic impact passed $100 million, and that the FTC had skipped that step. The court decided the case on that procedural ground and did not rule on the challengers’ other arguments, such as whether the FTC exceeded its authority (Mayer Brown; Bass, Berry & Sims).

Practical effect: the July 14, 2025 compliance deadline disappeared, and the 2024 amendments are not law. The original 1973 rule, which is narrower, remains.

The 2026 restart

On March 11, 2026, the FTC announced an advance notice of proposed rulemaking (ANPRM) on negative option marketing, published in the Federal Register on March 13, with comments due April 13, 2026 (FTC press release; Covington; Greenberg Traurig). The notice asks whether to keep the existing rule, adopt provisions similar to the vacated 2024 amendments, write new ones, or rely on alternatives such as education.

An ANPRM is an early step. The FTC would still need to publish a proposed rule, take comments, and issue a final rule. As of this writing we found no published proposed rule. Treat any article that says “click-to-cancel is the law nationwide” as out of date, and any article that says “the issue is dead” as equally wrong.

What still applies federally: ROSCA

The Restore Online Shoppers’ Confidence Act (15 U.S.C. 8403) has applied to online negative option sales since 2010. In short, it requires sellers to:

1. Clearly disclose all material terms before collecting billing information.
2. Get the consumer’s express informed consent before charging.
3. Provide “simple mechanisms” for the consumer to stop recurring charges.

The third point is the federal hook for easy cancellation, and the FTC uses it. Recent examples:

• Amazon (Prime). In September 2025, Amazon agreed to pay $2.5 billion ($1 billion civil penalty and up to $1.5 billion in refunds) to settle FTC claims under the FTC Act and ROSCA about Prime enrollment and cancellation; Amazon did not admit wrongdoing (Goodwin; Alston & Bird).
• Chegg. In September 2025, Chegg agreed to pay $7.5 million to settle FTC allegations about its cancellation practices (Hogan Lovells).
• Uber (Uber One). The FTC’s lawsuit, first filed in 2025, was amended in December 2025 to add 21 states and the District of Columbia as co-plaintiffs; the case is pending and the allegations are unproven (Goodwin).

ROSCA is written for consumers. Whether and how it reaches a business-to-business sale depends on the facts; ask counsel if your customers are mostly companies.

US states: California as the reference point

Many states have their own automatic renewal laws. California’s is the one most SaaS teams design around, because it is detailed and widely copied.

California’s Automatic Renewal Law (Cal. Bus. & Prof. Code sections 17600 and following) was amended by AB 2863, signed in September 2024, with changes effective July 1, 2025. According to law firm summaries (Davis Wright Tremaine; Venable; Kilpatrick), the amended law includes:

• Express affirmative consent to the automatic renewal terms, kept on record.
• Online cancellation for customers who signed up online, without unnecessary steps or delay.
• A limited save attempt. When a consumer cancels online, the business may present a save offer only if it also shows a prominent, continuously displayed option to cancel. Summaries differ on details, so read the statute text.
• Prompt processing of cancellation requests, including those made by phone or voicemail.
• Annual reminders of the auto-renewal terms, and notice before certain price changes.

The law protects consumers in California, so a US-wide consumer product will usually follow it everywhere rather than run a separate flow per state.

Other states have their own laws with different notice periods and triggers. We don’t list them here because the details differ and change; a lawyer or a maintained state law tracker is the right source.

European Union

No general “cancel as easily as you subscribed” rule yet

EU consumer law already prohibits unfair commercial practices and requires clear pre-contract information, but as of this writing there is no EU-wide rule that cancelling a subscription must be as easy as signing up (Covington’s Inside Privacy, DFA series).

The withdrawal function (from June 19, 2026)

Directive (EU) 2023/2673 adds Article 11a to the Consumer Rights Directive. For distance contracts concluded through an online interface that carry a right of withdrawal, traders must provide a clearly labeled, easy-to-find withdrawal function, with a confirmation step and an automatic acknowledgment on a durable medium such as email. Member states had to transpose the directive by December 19, 2025, with the rules applying from June 19, 2026 (Greenberg Traurig; iubenda). Some member states were reported to be late with transposition (Van Bael & Bellis).

Note the difference: withdrawal is the consumer’s right to back out of a new contract, usually within 14 days. Cancellation is ending an ongoing subscription later. The withdrawal function covers the first, not the second. For a subscription sold to EU consumers, it still matters in the first two weeks.

The Digital Fairness Act (expected)

The European Commission is preparing a Digital Fairness Act that is expected to address subscription traps, including easier cancellation and renewal reminders. As of November 3, 2026, the proposal has not been published; reports point to a release in the coming weeks, and it would then go through the Parliament and Council (CMS; AKD). Don’t plan around specific requirements until there is a text.

Germany: the cancellation button

Germany already has a specific rule. Since July 1, 2022, section 312k of the German Civil Code (BGB) requires businesses that let consumers enter ongoing contracts through a website to provide a clearly labeled cancellation button (for example “Verträge hier kündigen”) that leads to a confirmation page. If you sell subscriptions to German consumers, you need this regardless of what the EU does next.

United Kingdom

The Digital Markets, Competition and Consumers Act 2024 includes a subscription contracts regime: clearer pre-contract information, reminder notices, a cooling-off period, and an easy way to end the contract. That part of the Act is not yet in force. In April 2026, the government said it would start in spring 2027 (Taylor Wessing); in August 2026, the start was brought forward to January 2027 (TLT; Latham & Watkins). Commentators noted that secondary legislation and guidance were still pending (Wiggin). Check gov.uk for the final commencement regulations.

B2B vs B2C

Most of the rules above protect consumers. A SaaS company that only sells to businesses under negotiated contracts may fall outside many of them. But the line is not always clean: self-serve plans bought with a personal card, sole traders and freelancers can look a lot like consumers. Many B2B SaaS teams choose to meet consumer standards anyway, because it is simpler than maintaining two flows and because customers expect it.

A practical baseline

If you sell subscriptions online and want one flow that holds up in most markets, a reasonable baseline is:

• Customers who signed up online can cancel online, in the same channel (web, app).
• A clear “Cancel” control is easy to find in account settings.
• Any save offer is shown alongside a visible, working cancel button.
• One save attempt, not a series.
• Cancellation takes effect without requiring a call, chat or email.
• Confirmation on screen and by email, with the end date.
• Renewal terms and price disclosed clearly before the first charge, with recorded consent.
• Renewal reminders where required (for example annual plans in California).
• For EU consumers: a withdrawal function for the first 14 days; for Germany, the cancellation button.
• A lawyer has reviewed the flow for your actual markets.

Our cancel flow best practices guide covers the design side of this checklist.

How NoChurn helps

NoChurn’s cancel flows are built around the baseline above: a reason, at most one matching offer (discount through a Stripe coupon, pause, downgrade or call), and a one-click “Cancel now” button visible on every step. The flow works as a hosted modal or through the headless API on web, desktop, iOS and Android, so cancellation can live in the same channel as signup. NoChurn does not make your business compliant on its own; your terms, disclosures, reminders and legal review remain your responsibility. See pricing and the docs for details.