FTC Click-to-Cancel Is Back: What Your SaaS Cancellation Flow Needs in 2026

The FTC's original Click-to-Cancel rule required businesses to make cancelling a subscription at least as easy as signing up for one. It had a compliance deadline of July 14, 2025 — and six days before that deadline, a federal appeals court threw the whole rule out. If your team treated that as the end of the story and moved cancellation-flow compliance off the roadmap, you moved too fast. California's version of the same rule never went anywhere, and five months after the vacatur, the FTC quietly restarted the federal rulemaking process from a different angle.

What actually happened to the federal rule

In October 2024, the FTC finalized amendments to its Negative Option Rule — the "click-to-cancel" provisions — requiring that online cancellation be at least as simple as the sign-up process, in the same medium the customer used to enroll, with no forced phone calls or retention scripts standing between a subscriber and the exit.

On July 8, 2025, the Eighth Circuit Court of Appeals vacated the rule. The ruling wasn't a rejection of the policy — it was procedural. The FTC is required to complete a preliminary regulatory analysis whenever a rule's projected annual economic impact exceeds $100 million, and an administrative law judge had already found that this rule cleared that threshold. The agency skipped the analysis anyway. The court threw the rule out under the Administrative Procedure Act without ever ruling on whether the cancellation requirements themselves were reasonable.

That distinction matters more than the headline "rule vacated" suggests. A policy killed on the merits tends to stay dead. A policy killed on a paperwork technicality tends to come back with the paperwork fixed — which is exactly what happened next. The FTC submitted a draft Advance Notice of Proposed Rulemaking (ANPRM) to the Office of Information and Regulatory Affairs on January 30, 2026, formally issued it on March 11, and published it in the Federal Register two days later. The public comment period closed April 13, 2026. Every law firm alert we've seen on this — Cooley, Covington, Sidley, Goodwin, Jones Day — reads the same way: expect a revised rule that looks substantially like the one that got vacated, not a rethink of the substance.

California never blinked

While the federal rule was working its way through a court case, California's own version kept moving. AB 2863 amended the state's Automatic Renewal Law (CARL), and the amendments took effect July 1, 2025 — untouched by anything happening at the federal level.

The amended CARL requires "express affirmative consent" to auto-renewal terms, which is a higher bar than the plain "affirmative consent" the law used to require. It mandates same-medium cancellation: if someone signed up online, you can't route their cancellation through a phone call or a support ticket queue. And for subscriptions that renew annually, it requires an annual reminder disclosing what's renewing, how much it costs, and how to cancel, sent before the charge hits.

This applies based on where your subscriber lives, not where your company is registered. Any SaaS running self-serve signups almost certainly has California subscribers, which means CARL is already binding on you today, independent of whatever the FTC eventually finalizes.

The FTC didn't stop suing people just because the rule got vacated

The vacated rule was a specific implementing regulation. It sat on top of two things that the Eighth Circuit's ruling never touched: the Restore Online Shoppers' Confidence Act (ROSCA), which has required clear disclosure and simple cancellation for online negative-option sales since 2010, and Section 5 of the FTC Act, the agency's general unfair-or-deceptive-practices authority. Both were fully enforceable the entire time the rule was tied up in court, and both still are.

Law firms tracking FTC enforcement activity counted five negative-option cases and six settlements the agency brought between January 2025 and early 2026 — a period that includes the months after the rule was vacated. The rulemaking itself moved slower than the agency's appetite for bringing cases under existing law. If your cancellation flow's compliance argument boils down to "the click-to-cancel rule doesn't exist," that argument was never actually load-bearing.

What Stripe changed on its end

Stripe's response has been to make the compliant default the path of least resistance. Every subscription renewal email and free-trial-completion email now automatically includes a cancellation link, pointed by default at Stripe's hosted customer portal. You don't have to opt in — it ships in the email whether you configured anything or not.

You can swap that default: instead of Stripe's hosted portal, point the link at your own cancellation URL — your own flow, hosted wherever you run it, including a cancellation flow like CancelFlow instead of Stripe's generic portal page. The one constraint worth knowing before you build against it: you can't mix and match. If you switch to a custom URL, it has to be consistent across the email types that carry a cancellation link — you can't send Stripe-hosted links in one email and a custom URL in another. Stripe also appends a stripe_source query parameter to custom URLs, which tells you which email triggered the click — useful if you want your flow to behave differently for a renewal-driven cancellation than for someone who navigated to your billing page on their own.

The portal itself already supports an optional cancellation-reason prompt and a single "deflection" offer — a retention coupon you configure once in the dashboard. It's a real mechanism, but it's static: everyone who tries to cancel sees the same offer regardless of why they're leaving. That's the gap between what Stripe's default portal does and what a purpose-built flow does — we cover the reason-routed version of this in our pause vs discount vs downgrade guide.

Building a flow that's compliant, not just fast

None of this requires ripping out a working cancellation flow. It requires checking a handful of specific things against what CARL and ROSCA actually say, since both are enforceable today regardless of where the federal rulemaking lands:

• Same medium. If someone signed up on your website, they need to be able to cancel on your website — not by calling a number or emailing support and waiting for a reply.
• No mandatory reason field. Requiring a cancellation reason before the cancel action completes is exactly the kind of obstruction regulators have flagged. Make the reason optional; we go into why this also produces better data in our cancellation survey guide.
• One offer, not a gauntlet. A single retention offer that's easy to decline is fine. Three escalating offers, each requiring another click to get past, starts to look like the obstruction pattern the FTC and California are both targeting.
• Annual reminders for annual plans. If you offer annual billing — and given that annual subscribers churn at roughly a third the rate of monthly ones, you probably should — California requires a reminder disclosing the renewal amount and how to cancel before the charge lands, not just an invoice after the fact.
• Immediate, in-product confirmation. A subscriber who cancels shouldn't have to wonder whether it worked. Confirm it on the spot, in the same flow, not via a follow-up email days later.

None of these change the save-rate mechanics we've written about before — a well-run flow still recovers 25–40% of at-risk subscribers by offering a relevant alternative at the right moment. What's changed is that "the cancel button is hard to find" is no longer just a bad-UX problem you can deprioritize. It's a specific, named line item in an active regulatory record.

CancelFlow's flow is built around the same constraint either way: the cancel action always completes if the subscriber wants it to, the reason field is never required to proceed, and it shows one offer instead of a sequence of them. If you're routing Stripe's renewal and trial-completion emails to a custom cancellation URL, that's exactly the kind of flow those links should point to — compliant by default, without giving up the mechanics that make a cancellation flow worth having in the first place.

Frequently asked questions

Stop losing subscribers today

One script tag. One function call. A live cancellation flow in under 10 minutes.