NYC's Click-to-Cancel Rule Takes Effect October 1. It's Not the Same Law as New York State's.

Every automatic-renewal law we've tracked this year has come from a state legislature, a federal agency, or a national government. NYC's Department of Consumer and Worker Protection just broke that pattern. On October 1, 2026, New York City becomes the first municipality in the country to enforce its own click-to-cancel rule — a city regulation that sits on top of, not instead of, whatever state and federal rules already apply to a business with customers in the five boroughs.

That's a smaller headline number than the nine-figure fines in Australia's new subscription law, and it's not the kind of statutory-damages exposure Virginia created when it killed its good-faith defense. The reason it still matters is scope, not size: this is a compliance obligation triggered by geography at the city level, not the state level, which means a business can be fully compliant with New York State law and still be in violation of New York City law the moment a subscriber's billing address reads Manhattan, Brooklyn, Queens, the Bronx, or Staten Island.

What the rule actually requires

DCWP's final rule, adopted after a proposal from Mayor Mamdani's office in April and formal comment through the summer, has three operative pieces. First, any business making an automatic renewal or continuous service offer has to let a customer cancel using a mechanism that's simple, easy to use, and available through the same medium the customer used to consent. Second, cancellation has to be available through any medium the customer could have used to sign up — not just the one they happened to pick. Third, and this is the part that catches sales-assisted and in-person businesses off guard: if a customer can consent in person, the business also has to offer an online cancellation path, even if the sign-up itself never touched a website.

None of that requires cancellation to complete in a single click the way Colorado's law does. NYC's rule is about which doors are open, not how many turns it takes to get through the one you use. A subscription business that requires an email to a support inbox to cancel is compliant under NYC's medium-matching standard as long as email was also an available way to sign up — but the same flow fails instantly if signups happen over the phone or at a kiosk and there's no online alternative for cancelling.

The notice windows layered on top

Beyond the cancellation mechanic, the rule sets specific timing requirements for two kinds of advance notice. Subscriptions with an initial term of at least one year that auto-renew for six months or longer require a renewal reminder sent 15 to 45 days before the cancellation deadline. Free trials that run longer than one month require a reminder 3 to 21 days before the deadline to cancel and avoid the first real charge. Both numbers will look familiar if you've already built a notice schedule for other states — they land inside the same general range as California's and Maryland's windows — but they're a distinct legal requirement under city law, not an inherited satisfaction of it.

The per-violation fine schedule is the smaller exposure. The bigger one is that the rule makes a business liable for every charge collected after a customer's documented first attempt to cancel — which means a support queue backlog, a broken cancel button, or a retention flow that quietly routes cancel requests into a "one of our team will reach out" dead end can generate real, calculable damages the moment DCWP or a customer can show the attempt happened and the charges kept coming anyway.

Who's exempt, and who isn't

DCWP carved out banks, credit unions, and other entities regulated by the New York Department of Financial Services, along with NY-licensed security alarm operators and sellers of service contracts under state insurance law. That list is narrow and mirrors the kind of already-regulated-elsewhere exemptions you see in most consumer protection rules — it does not include a small-business or revenue-based carve-out. A two-person SaaS company running self-serve signups with NYC customers is in scope on day one, the same as a company with a thousand employees.

That's a meaningfully different posture than the other new subscription law to pass this summer. Louisiana's Click-to-Cancel Act, signed June 9, 2026 and taking effect January 1, 2027, exempts any business with fewer than 50 employees or under $5 million in annual gross revenue. NYC drew no such line.

Sources: NYC DCWP Notice of Adoption (2026); Louisiana HB750, Act No. 830 (2026 Regular Session); Kelley Drye, "Summer 2026 Autorenewal Roundup" (2026).

The direction is consistent even where the details diverge: three separate jurisdictions tightened cancellation rules in the same summer, and none of them coordinated their numbers, exemptions, or effective dates with each other. That's the same pattern we've already documented across Colorado and New York State and Maryland — a patchwork that grows by one jurisdiction at a time, each with just enough numeric drift to break a compliance build that assumed one state's rule was a stand-in for all of them.

What to actually check before October 1

The specific gap NYC's rule creates isn't in the cancel button itself — most self-serve SaaS products with a working cancellation flow already offer online cancellation to online signups, which covers the most common medium-matching case by default. The gap shows up in the less common paths: sales-assisted signups, phone-based upgrades, in-person enrollment at an event or a retail-adjacent product, or any flow where a subscriber consented through a channel your cancel flow doesn't mirror. If your onboarding data doesn't currently record which channel a given subscriber used to sign up, you can't easily prove medium-matching compliance for that subscriber if DCWP or a customer ever asks — which makes channel logging a quieter but real requirement alongside the more visible one.

The other check worth running now is timing. If your renewal and trial-ending reminders were built around New York State's or California's day-counts, run them against NYC's 15-to-45-day and 3-to-21-day windows specifically — they overlap heavily but aren't automatically identical in trigger conditions, and the "6 months or longer" auto-renewal threshold for the long-notice requirement is its own specific number worth confirming against your actual subscription terms rather than assuming it matches whatever else you've already built.

None of this is a reason to rebuild anything from scratch. It's a reason to audit whether the cancellation and notice logic you already have quietly assumes "the customer signed up online" as a universal fact about your subscriber base — an assumption that was probably true for most of it and is exactly the kind of gap a rule like this one exists to close for the rest. If you're building that audit from zero, a cancellation flow that treats cancel as a first-class, always-reachable action rather than a support-ticket afterthought — which is the whole premise behind CancelFlow — clears the medium-matching bar by construction, whether the subscriber underneath it signed up on your website, over the phone, or in person.

Frequently asked questions

Stop losing subscribers today

One script tag. One function call. A live cancellation flow in under 10 minutes.