On July 8, 2025, the Eighth Circuit Court of Appeals vacated the FTC's "Click to Cancel" rule — six days before every subscription business in the US was supposed to comply with it. Not because a judge decided dark-pattern cancellation flows are fine. The court threw the rule out on a technicality: the FTC skipped a mandatory cost-benefit analysis for a regulation with at least $100 million in projected annual effects, so companies never got a real chance to comment. A rule built to make canceling as easy as signing up died on a paperwork error.
Quick answer
There is no single federal "one-click cancel" law in the US right now. What protects you instead is a patchwork: existing anti-fraud law the FTC still enforces (ROSCA), a handful of state laws (California, Minnesota, Massachusetts, Louisiana, New York City), and — if none of that applies to you — the chargeback right baked into your credit card. If you're in the EU, you have something stronger and already in force: a 14-day no-questions withdrawal right on any service contract you sign online.
A patchwork, not a federal floor
The vacated rule is gone, but the underlying conduct it targeted is still illegal under the Restore Online Shoppers' Confidence Act and Section 5 of the FTC Act — both untouched by the ruling. That's the law the FTC used against Amazon: a $2.5 billion settlement announced September 25, 2025, over Prime's enrollment and cancellation dark patterns, with a $1 billion penalty and up to $1.5 billion in consumer redress for an estimated 35 million people (FTC). A year later the FTC raised the per-consumer refund cap from $51 to $200 and moved to automatic payouts. Uber is next in line: a coalition of 22 states plus DC sued in December 2025 over Uber One, alleging a cancellation flow that in some cases required up to 23 screens and at least 32 actions before a request even reached a human — who might take a day to process it, during which the customer got billed again. I don't read 23 screens as an accident of UX; it's a funnel built one screen at a time by someone whose bonus was tied to the churn number staying low.
Below the federal level, your rights depend on your ZIP code. California's amended Automatic Renewal Law (AB 2863, live since July 1, 2025) requires that anyone who can sign up online must also be able to cancel "exclusively online, at will," with no extra obstruction — and if the merchant shows a retention offer mid-cancellation, it has to keep the cancel button visible at the same time, not swap it out. Minnesota bans unsolicited retention pitches during cancellation unless you opt in to hear them. New York City's Click-to-Cancel rule, effective October 1, 2026, requires the cancel mechanism to be at least as easy and in the same medium as sign-up, backed by fines starting at $525 and climbing to $3,500 per repeat violation. None of this is uniform — crossing a state line can change what a company owes you.
The EU's 14-day right is the real floor
If the US approach is reactive patchwork, the EU's is a standing rule: Directive 2011/83/EU gives anyone who signs a distance contract — including an online subscription — 14 days to withdraw, no reason required, running from the day the contract is concluded rather than from first use. Miss that disclosure and the window doesn't just vanish: a trader who fails to tell you about the right extends it by up to 12 months. Starting June 19, 2026, a second directive (2023/2673) forces online traders to add a clearly labeled withdrawal button that stays live for the full 14 days and triggers an automatic confirmation email — the principle being that withdrawing shouldn't take more effort than signing up did. It's narrow, though: it only covers that initial 14-day window, not a general right to cancel an ongoing subscription with one click forever.
Companies have tried to write around the 14 days by calling a subscription "digital content" instead of a "digital service" — content can have the withdrawal right waived at signup, services can't. In July 2026 the CJEU closed that door for a specific case: ruling against Sky Austria, it held that a personalized, adaptive streaming subscription counts as a service, so the 14-day right can't be signed away at checkout (CJEU, Case C-234/25). The UK still runs on its own, older 2013 regulations (same 14-day structure, pre-Brexit implementation of the same EU directive) — its tougher subscription-specific regime, with two separate cooling-off windows and single-click cancellation, is written into the DMCCA but isn't enforced yet; the government has pushed the target date up to January 2027.
Reading the actual cancellation clause before you sign is the cheapest way to know which of these regimes even applies to you — the kind of fine print this piece on subscription terms that always trip people up walks through clause by clause.
None of these rules help if you can't prove you tried. If a merchant keeps billing after you've invoked a cancellation right, your credit card issuer is a faster remedy than any regulator: under the Fair Credit Billing Act you have 60 days from the statement date to file a written dispute, the issuer must acknowledge it within 30 days, and you don't have to pay the disputed amount while it investigates. Canceled-subscription disputes made up 40% of all general-purpose card disputes in 2024, so issuers have seen this exact complaint before. Keep a timestamped copy of whatever cancellation request you sent — screenshot, email, the withdrawal form if the EU button applies — before you need it, which is the same discipline behind weighing a chargeback against a plain refund request once a renewal has already hit your card.
I'd rather not need any of this law in the first place. A tool like Subnesio won't make a merchant obey ROSCA or the withdrawal directive, but it does solve the problem one step upstream: if you can see every renewal date before it fires, you rarely need to invoke any of this — you're canceling on day 12, not fighting a chargeback on day 40. Check the plans at Subnesio's pricing page if that's the gap you're actually trying to close.
The rules exist. Whether they bite still depends on which jurisdiction's law reaches the company that's ignoring you.
