Subscription Cancellation Laws: What SaaS Founders Actually Need to Do

The short version: the FTC's click-to-cancel rule was adopted in 2024, then vacated by a federal appeals court in July 2025 before it took effect, and the FTC is trying to revive it. But state laws, especially California's, already enforce the same core principle: if customers can subscribe online, they must be able to cancel online, easily. Comply with that principle and you are safe almost everywhere.

I am not a lawyer and this is not legal advice. But I run a subscription-adjacent business and I have watched founders tie themselves in knots over this, so here is the actual state of play as of late 2026, and the short checklist that keeps you out of trouble.

The FTC click-to-cancel saga

In October 2024, the FTC finalized amendments to its Negative Option Rule, the famous click-to-cancel rule. The headline requirement was simple: canceling a subscription had to be as easy as signing up. Signed up in three clicks? Cancel in three clicks.

Then, on July 8, 2025, the Eighth Circuit vacated the entire rule. Not because the court loved dark patterns, but because the FTC had skipped a required procedural step in the rulemaking. Days before enforcement was supposed to start, the rule was void. In 2026 the FTC has been moving to revive it through a fresh rulemaking, so the substance may well return. But right now, the federal click-to-cancel rule itself is not in force.

Here is the mistake to avoid: reading "rule vacated" as "anything goes." Two layers of law still bite.

Layer one: ROSCA (the federal law that never left)

The Restore Online Shoppers' Confidence Act has been federal law since 2010 and applies to any online subscription sold to US customers. It requires clear disclosure of renewal terms before billing, express informed consent, and simple mechanisms to stop recurring charges. The FTC actively enforces it and has used it to extract major settlements from subscription companies over cancellation friction. Click-to-cancel or not, a nightmare cancel flow is already federally actionable under ROSCA.

Layer two: state auto-renewal laws (the stricter ones)

California's Automatic Renewal Law is the one that matters most, and it got significantly stricter with AB 2863, effective July 1, 2025:

• •Express affirmative consent to the auto-renewal terms, separate from the rest of the checkout. A buried pre-checked box does not count.
• •Cancel online if you signed up online. Immediately. The law explicitly prohibits retention flows that impede or delay the cancellation.
• •Reminder notices before renewal on annual and longer plans, and before free trials convert to paid.
• •Clear disclosure of what the price will be after any promotional period ends.

Other states have been passing or tightening their own versions, and state attorneys general enforce them. Since you cannot practically run one cancel flow for Californians and a worse one for everyone else, California's standard effectively becomes your standard.

The compliance checklist

What this means in practice for a SaaS founder:

• •Put a real cancel button in the account settings. No chat-with-support requirement, no call-us hours, no email-us-and-wait.
• •Make the path to it short and findable. If a reasonable person cannot locate cancellation within a minute, you have the problem these laws describe.
• •If you show a save offer during cancellation, the 'no thanks, just cancel' option must be equally prominent. Offers are allowed; obstacle courses are not.
• •Get explicit consent to auto-renewal at signup, with the renewal terms stated right there, not behind a link.
• •Send a reminder before annual renewals and trial conversions. This is legally required in some places and good manners everywhere.
• •Keep records: who consented to what terms, when. If a regulator or a card network dispute ever asks, this file is your defense.

A note on selling outside the US

If you have European customers, the EU Consumer Rights Directive adds its own layer: consumers get a 14-day withdrawal right on distance contracts, and digital subscriptions have their own wrinkles around when that right expires once service begins. The UK's consumer protection regime has been moving in the same direction as California's: clear renewal disclosures, reminders, easy exit. The practical takeaway is the same everywhere: the strictest mainstream market you sell into should set your cancellation UX, because building one flow that satisfies California and the EU automatically covers almost everyone else.

Enforcement is also real, not theoretical. Regulators on both sides of the Atlantic have taken subscription companies to task over hidden cancel buttons, forced phone calls, and pre-ticked renewal consent, and the settlements tend to include both money and mandated flow changes. The companies in those cases all thought their friction was standard practice. It was, until it was exhibit A.

The founder reframe

I get the instinct that makes companies bury the cancel button: every cancel that completes feels like revenue walking out. But the math works the other way. A customer who cancels easily and leaves on good terms is a win-back candidate. A customer who had to fight your flow, then filed a chargeback, then told their friends, is a permanent loss plus a dispute fee plus a reputation dent. Chargebacks from customers who felt trapped are exactly the involuntary losses that hurt most.

The B2B carve-out worth knowing

Most auto-renewal and cancellation laws, including California's, are written to protect consumers, not businesses. If you sell exclusively B2B under negotiated contracts, some of these requirements technically do not bind you. Two reasons to comply anyway. First, the line between consumer and small business is blurry in practice: the freelancer paying with a personal card looks a lot like a consumer to a regulator. Second, easy cancellation is simply good business in B2B too; the procurement manager who left cleanly is the one who brings you into their next company.

One practical habit to close with: once a quarter, cancel your own product. Use a real test account, start the cancel flow yourself, and time exactly how long it takes and how many screens you hit. If the experience annoys you, it is out of compliance in spirit even where it is legal in letter, and it is generating the chargebacks and angry replies that no retention metric justifies. The law is the floor; your own annoyance is a pretty good ceiling.

If this all feels like a lot, the one-line version is: let people leave the same way they joined. Online signup, online cancel. Instant signup, instant cancel. Do that, keep your consent records, and the specific statutes become someone else's problem. The founders who get in trouble are never the ones who made leaving easy, and they always thought they had more time before anyone noticed.

Easy cancellation is not churn-friendly, it is churn-honest. The customers who stay, stay because they want to. And the ones who leave through a clean exit are reachable again. That is genuinely how I think about the whole lifecycle: make leaving easy, make staying valuable, and make the failed-payment side airtight so nobody leaves by accident. The last part is what StayPaid handles: the customers who never meant to cancel get recovered, and the ones who did cancel get an honest, human goodbye. Both groups are worth more to you next year than they are today.