Click-to-Cancel Is Vacated, But the Rule Isn't Gone: What ROSCA Still Requires in 2026

What the Eighth Circuit actually vacated, and why

On July 8, 2025, the United States Court of Appeals for the Eighth Circuit vacated the Federal Trade Commission revised Negative Option Rule, the regulation popularly known as the "click-to-cancel" rule. The decision is narrower than the headlines suggested. The court did not rule that difficult cancellation flows are lawful, nor that the FTC lacks authority over deceptive subscription practices. It held that the agency had failed to complete a step its own rulemaking procedure required: a preliminary regulatory analysis of the rule's costs and benefits at the point the statute obliges the Commission to produce one.

That distinction is the entire story. A rule vacated on procedural grounds is set aside because of how it was made, not because a court has blessed the conduct it tried to regulate. The substantive judgment the FTC expressed, that consumers should be able to end a recurring charge through the same medium they used to begin it, was left legally intact. What disappeared was the specific, uniform, nationally binding text that would have made those expectations mechanically enforceable as a single rule.

The named rule is gone; the law underneath it is not

It is easy to conflate the click-to-cancel rule with the whole body of law on subscription cancellation. They are not the same thing. The vacated rule sat on top of a legal foundation that long predates it and that the Eighth Circuit did not touch.

Three sources of authority survive the vacatur, according to the client alerts issued by major law firms in the weeks after the decision. First, the Restore Online Shoppers Confidence Act (ROSCA), the federal statute that has governed online negative-option marketing since 2010. Second, the state automatic-renewal statutes, a growing patchwork of laws in states such as California that impose their own disclosure and cancellation requirements and were unaffected by a federal court ruling on a federal rule. Third, Section 5 of the FTC Act, the Commission's standing power to act against unfair or deceptive acts and practices, which is the authority the FTC used against obstructed cancellation long before any dedicated rule existed.

The practical upshot: the enforcement surface did not shrink to zero when the rule fell. It reverted to the pre-rule legal baseline, which was already substantial.

What ROSCA still requires

ROSCA is the load-bearing federal statute now that the rule is vacated. Its core obligations for any business that sells through a negative option, meaning any arrangement where a customer's inaction is treated as consent to a recurring charge, are longstanding and did not change on July 8.

• Disclose all material terms clearly and conspicuously before obtaining the customer's billing information, including that charges will recur, how much and how often, and how to stop them.
• Obtain the customer's express informed consent to the negative-option feature before charging, not consent buried in a block of terms or bundled into an unrelated agreement.
• Provide a simple mechanism to stop recurring charges, so a customer who wants to cancel can actually do so without being routed through obstruction.

State auto-renewal statutes did not move

A federal court vacating a federal rule has no effect on state law. The automatic-renewal statutes enacted by individual states, of which California's is the most cited, continue to impose their own disclosure, consent, and cancellation duties on businesses that sell to residents of those states.

For an operator this is the part most easily missed. Even in the window where no dedicated federal rule is in effect, a subscription business serving customers across multiple states faces a live patchwork of state auto-renewal requirements. Compliance is not paused by the vacatur; it is simply governed by the statutes that were always there. A business that standardizes its cancellation flow to the strictest applicable state law is generally the one least exposed as the federal picture resettles.

Obstructed cancellation is a documented dark pattern the FTC treats as actionable

The regulatory concern behind all of this is not abstract. In its September 2022 staff report, "Bringing Dark Patterns to Light," the FTC named obstructed cancellation, alongside disguised ads, buried fees, and forced data sharing, as one of the recurring design tactics it considers legally actionable under Section 5. That report was approved before the click-to-cancel rule was written and stands independent of it.

The report drew directly on academic evidence that these patterns are widespread rather than fringe. A 2019 automated and manual crawl of roughly eleven thousand shopping websites, published by researchers at Princeton, catalogued more than eighteen hundred dark-pattern instances across fifteen distinct types, and identified third-party vendors selling this design as a turnkey service. Obstructed cancellation is one recognized member of that taxonomy. The point for a business reading the 2025 vacatur is that the FTC did not need a dedicated rule to view a hard-to-exit subscription as a deceptive practice, and it still does not.

A replacement rulemaking is already underway

The vacatur did not end the story; it reset it. The FTC has moved to replace the vacated text, submitting an advance notice of proposed rulemaking to the Office of Information and Regulatory Affairs on January 30, 2026. That step signals the agency intends to rebuild a negative-option rule through the procedure the Eighth Circuit said was missing the first time.

What that future rule will say, how prescriptive it will be, and when it will take effect are genuinely unsettled. This is the one part of the picture that is not a settled fact but a forecast, and confident predictions about regulatory timing have a poor track record. The sound planning posture is to treat a stricter, procedurally sound federal rule as a realistic future state, and to design cancellation flows that already meet the surviving ROSCA and state-law standards so that a new rule requires little rework rather than a scramble.

How to read this if you run a subscription or membership

The operational translation is short. The vacatur removed a rule, not a duty. If your business bills on a recurring basis, your cancellation flow is governed today by ROSCA, by the auto-renewal statutes of every state your customers live in, and by Section 5, all of which survived intact. A flow that is honest at sign-up, that discloses recurring terms before taking payment, that captures real consent, and that lets a customer leave through a mechanism at least as simple as the one they joined through, is aligned with the law as it actually stands in 2026.

There is also a conversion reading here, not only a compliance one. An obstructed cancellation is a short-term retention tactic that converts a departing customer into a hostile one and a potential complaint, while a clean, honest exit preserves the option of winning them back and protects the reputation that decides whether the next buyer chooses you at all. The evidence in conversion science points the same direction as the law: the durable path is to earn retention, not to trap it.

The status, dated and caveated

Regulatory content ages. The facts in this piece are current as of July 20, 2026: the click-to-cancel rule stands vacated by the Eighth Circuit as of July 8, 2025; ROSCA, state auto-renewal statutes, and Section 5 remain in force; and a replacement FTC rulemaking is in motion. Any of these can change, particularly the rulemaking, which is actively moving.

This article is a plain-language explanation of a legal status, not legal advice, and it does not create any advisory relationship. Before you rely on it for a specific cancellation flow, contract, or disclosure, have the details reviewed against your jurisdictions and your facts by qualified counsel. Compliance-sensitive content on this site is routed through internal legal review before publication for exactly that reason.