Click-to-Cancel Is Vacated. California's Auto-Renewal Law Isn't.

Click-to-Cancel Is Vacated. California’s Auto-Renewal Law Isn’t.

The short and skinny: if you sell subscriptions to Californians, the death of the FTC’s click-to-cancel rule changed nothing about what you have to build. California already requires nearly the same things, has required them since July 1, 2025, and enforces them through a route that does not depend on any federal rulemaking surviving a circuit court.

I keep meeting founders who read a headline in July 2025, decided the cancel-flow ticket was moot, and moved it to the backlog. The ticket is still in the backlog. The state law has been in force the whole time.

What did the Eighth Circuit actually hold?

That the FTC skipped a step. Not that the rule was wrong.

In Custom Communications, Inc. v. Federal Trade Commission, No. 24-3137 (8th Cir. July 8, 2025), a per curiam panel vacated the Negative Option Rule in its entirety, six days before its July 14 compliance date. The holding is procedural. Section 22 of the FTC Act (15 U.S.C. § 57b-3) requires a preliminary regulatory analysis for any proposed rule with an estimated annual economic effect of $100 million or more. The Commission estimated it would land under that line and skipped the analysis. During the informal hearings, an administrative law judge found the compliance burden would exceed $100 million. The FTC finalized anyway. The court held that petitioners had been deprived of the chance to argue about burden and alternatives, called that prejudicial error, and set the rule aside without reaching the substantive challenges at all.

Worth reading twice, because the distinction is the whole post. The Eighth Circuit did not say sellers may bury the terms or hide the cancel button. It said the agency filled out the paperwork in the wrong order.

Is the FTC done with this?

No. It restarted, and it is being noisy about it.

On March 11, 2026 the Commission issued an Advance Notice of Proposed Rulemaking on the Negative Option Rule, published in the Federal Register on March 13 with comments due April 13, 2026. It is an unusually data-hungry ANPRM: it asks how long enrollment and cancellation actually take, what “save” offers are worth to consumers, and which parts of the vacated rule produced measurable benefit. As of this writing the Commission has not issued a proposed rule, and it may yet decide to propose nothing. But the four ideas it keeps circling are the four from the vacated rule: clear and conspicuous disclosure of material terms, affirmative consent to the negative option feature, a simple cancellation mechanism, and no misrepresentations.

Separately, and more immediately: the vacatur did not touch the Restore Online Shoppers’ Confidence Act or Section 5 of the FTC Act. Both still reach online subscription offers, and the Commission has kept bringing cases under them.

What does California actually require?

Roughly what you thought the federal rule was going to require, plus a few things it wouldn’t have.

The Automatic Renewal Law sits at Business and Professions Code § 17600 et seq. AB 2863 (Stats. 2024, ch. 515) amended §§ 17601 and 17602 and applies to any contract entered into, amended, or extended on or after July 1, 2025 (§ 17602(j)). “Amended or extended” is doing quiet work in that sentence. Your legacy subscribers are not permanently grandfathered; change the plan and the new rules attach.

Here is the operative list, section by section, because founders do better with the citation than with a paraphrase.

Free trials are in scope. Sections 17601(a)(1) and (a)(5) now sweep in a “free-to-pay conversion,” defined at § 17601(a)(6) as free service for an initial period that becomes a payment obligation unless the customer affirmatively cancels first. A 14-day trial with a card on file is squarely inside the statute.

Consent must be express, and provable. Section 17602(a)(4) requires the consumer’s express affirmative consent to the renewal terms themselves, on top of consent to the agreement containing them under (a)(2). Section 17602(a)(5) prohibits including anything in the contract that “interferes with, detracts from, contradicts, or otherwise undermines” that consent. Section 17602(a)(6) requires you to keep verification of consent for three years, or one year after termination, whichever is longer. That last one is a logging requirement wearing a consent requirement’s clothes: if your checkout doesn’t store what was displayed and when, you can’t prove the rest.

Online sign-up means online cancellation. Section 17602(d)(1) is California’s own click-to-cancel, and it is blunt. A business that lets a consumer enroll online must let that consumer terminate “exclusively online, at will, and without engaging any further steps that obstruct or delay” immediate termination, through either a prominently located link or button inside the account, profile, or settings, or a pre-formatted termination email the consumer can send without adding information.

You may still make a save offer, on one condition. Section 17602(e)(2) says a retention offer is not an obstruction so long as you simultaneously display a prominent, continuously and proximately visible link or button reading “click to cancel” or words to that effect. Show the discount. Keep the exit on screen the entire time.

Notices run on a clock. A fee change requires clear notice plus cancellation instructions no less than 7 and no more than 30 days before it takes effect (§ 17602(g)(2)). A free trial or promotional price lasting more than 31 days requires notice between 3 and 21 days before it converts (§ 17602(b)(1)). An initial term of a year or longer requires notice 15 to 45 days before renewal (§ 17602(b)(2)). And every annual subscription gets an annual reminder identifying the product, the frequency and amount of the charges, and how to cancel (§ 17602(h)).

Cancel where they signed up. Section 17602(f) requires cancellation to be available in the same medium the consumer used to activate the service, or the medium they’re used to dealing with you in. Phone signups need a retainable phone number, displayed on the website.

What is the actual exposure?

Here is where founders relax one step too early. The ARL has no private right of action of its own; Mayron v. Google LLC (2020) 54 Cal.App.5th 566 held exactly that.

It matters less than it sounds. Section 17603 provides that goods sent in violation of the article are, absent good faith, an unconditional gift to the consumer. Private plaintiffs use ARL violations as the predicate for claims under the Unfair Competition Law (§ 17200 et seq.), the false advertising law (§ 17500 et seq., with injunctive relief under § 17535), and the Consumers Legal Remedies Act, which between them carry restitution, injunctions, and fees. Public enforcers need no predicate at all: the Attorney General, district attorneys, and city attorneys all enforce the ARL directly. The Attorney General issued a consumer alert on the amended law in September 2025, and in August 2025 two county district attorneys announced a reported $7.5 million auto-renewal settlement with a meal-kit subscription company.

The realistic first contact is not a class action. It is a demand letter, or a county prosecutor’s inquiry about a cancel flow that somebody screenshotted.

What should I do about it?

Start by trying to cancel your own product. On a phone, signed in as an ordinary user, with a timer running. If you cannot get from account settings to cancelled without a chat widget, a phone call, or a third “are you sure,” you have your finding and you didn’t need a lawyer to get it.

Then, in rough order of engineering effort:

1. Ship the cancel control. A link or button in account settings that terminates the subscription. If you show a save offer on the way, the cancel button stays visible next to it.
2. Fix the consent record. Store what the renewal terms said, where they appeared, and the timestamp of the affirmative consent. Retain per § 17602(a)(6).
3. Build the notice calendar. Trial conversion, annual renewal, fee change, annual reminder. This is a scheduled job with templates, not a policy paragraph.
4. Re-read your own trial copy. Section 17602(a)(7) makes misrepresenting any material fact about the transaction unlawful, not just the renewal terms. The marketing page is in scope now.

Most of this is configuration and copy, and the renewal terms themselves live in the agreement your customers accept at checkout, which is worth reading with the same eye you’d bring to the rest of your contracts. If you’re triaging where subscription compliance sits against everything else on the list, I ranked what actually reaches small web apps in this post, and mapped the broader sequence in the founder’s legal stack.

If you want the subscription flow reviewed against the sections above rather than against a headline, that’s part of the firm’s web compliance package.

This article is general information, not legal advice, and reading it does not create an attorney-client relationship. The law here is moving quickly — several items above were amended, vacated, or introduced within the last eighteen months. Your specific facts matter; confirm current requirements with the relevant authorities or your own advisor. Law Office of Ian Daily.