Click-to-cancel was struck down. Do state laws still apply?

State auto-renewal laws still apply even though the Eighth Circuit vacated the FTC's click-to-cancel rule on 8 July 2025. California and New York still set how a customer must be able to cancel, and a hard cancel flow feeds Visa 13.2 disputes, which an issuer can raise within 120 days of the processing date.

What happened to the FTC click-to-cancel rule?

The federal rule is gone for now. On 8 July 2025 the Eighth Circuit vacated the FTC's 2024 click-to-cancel amendments, after finding that the agency had skipped a required preliminary regulatory analysis, according to a law-firm alert from Goodwin.

The federal picture is still unsettled. On 11 March 2026 the FTC published a press release asking for public comment on an advance notice of proposed rulemaking on negative option plans, such as subscriptions that keep charging unless the customer acts.

No replacement rule had been proposed as of that notice, and nothing here depends on one arriving. Plan your cancel flow around the state laws already in force.

What does California require?

California's automatic renewal law, Business and Professions Code 17602 as amended by AB 2863, sets these terms:

• A customer who signed up online must be able to cancel online, through a direct link or button, or an immediately accessible termination email.
• A retention offer is allowed only when a click-to-cancel button is shown alongside it.
• Plans with terms of a year or more need a renewal reminder 15 to 45 days before renewal.
• Proof of consent must be kept for 3 years, or 1 year after termination, whichever is longer.

The retention rule catches many merchants. Placing a discount between the customer and the cancel button is permitted only when the cancel button is shown with it, and a flow that hides the exit behind the offer risks a disputed charge and a statutory violation. Check your cancel page against all four terms.

What does New York require?

New York sets the same direction. General Business Law 527-a requires cancellation by a mechanism as easy as the sign-up, through the same medium and with no hang-ups or delays, and penalties run $100 to $500 per violation.

Two states with large customer bases are enough to settle the design for everyone. One cancel path, online, a single click from the account page, with a confirmation email sent at once, is a sensible cancel design for customers in both states.

Ask your team how many clicks it takes to cancel today, and whether the path matches how customers signed up.

How does a hard cancel flow lead to chargebacks?

A hard cancel flow can end in a Visa 13.2 dispute. Visa reason code 13.2 covers a cancelled recurring transaction, a charge the customer says came after they cancelled, and the Visa Core Rules give the issuer 120 days from the processing date to raise it.

A customer who tried to cancel, hit a phone queue and gave up has an easy story to tell the bank. You then have to prove otherwise with a record that may not exist, whereas a cancel button leaves a timestamp your response can cite directly. What the bank looks for under this code is set out on the page for Visa reason code 13.2.

The records worth building now are these:

• the date and time of every cancellation request and every confirmation email;
• the sign-up screen, with the renewal terms visible beside the consent control;
• reminder emails and their send dates.

If a customer complains about a charge made after a logged cancellation, refund it at once, because Stripe and Shopify block refunds once a dispute is open.

Takeaway: what to do this week

1. Move cancellation online. Give customers who signed up online a single-click cancel path from the account page, with a confirmation email.
2. Show the cancel button beside any retention offer. California permits the offer only when the button is shown with it.
3. Log every cancellation and reminder. Timestamps of requests, confirmations and renewal reminders are the record a 13.2 response needs.
4. Refund post-cancellation charges before a dispute opens. Once a dispute is open, Stripe and Shopify block the refund.

Sources: Goodwin, alert on the FTC click-to-cancel rule (13 February 2026); FTC press release on negative option rulemaking (11 March 2026); California Business and Professions Code 17602 as amended by AB 2863; New York General Business Law 527-a, NY Senate; Visa Core Rules (18 April 2026), Table 11-99. All checked 24 October 2026.