NYC's Click-to-Cancel Rule Takes Effect October 1 — the Federal One Died Six Days Short, and for Businesses the Fine Is the Cheap Part

Key takeaways

• The rule is adopted, and it starts October 1, 2026. New York City's Department of Consumer and Worker Protection (DCWP) adopted a "Click to Cancel" rule — new 6 RCNY §§ 5-110 through 5-110.3, plus a new penalty row in § 6-47. It was proposed April 8, 2026, heard May 8, 2026, and takes effect October 1, 2026.
• The federal rule everyone is thinking of is a different thing, on a different layer. The FTC's Negative Option Rule — the one the internet calls "click to cancel" — was vacated by the Eighth Circuit on July 8, 2025, six days before its cancellation requirements were due to bite. No business ever had to comply with them. The FTC reopened rulemaking with an advance notice on March 11, 2026 (published in the Federal Register on March 13, 2026). An advance notice is not a rule. A city rule with an effective date is.
• The fine is small. The restitution is not. The penalty chart runs $525 / $1,050 / $3,500 by violation tier. But § 5-110.2 makes a violator liable for "the monetary amount charged … after the consumer's first attempt at cancellation." A fine is a number the city sets. Restitution is a number you set — every time you bill someone who already tried to leave.
• If you already comply with New York State's law, DCWP says exactly three things are new. In its own words, the rule is consistent with the state's General Business Law "except that includes expanded or amended provisions relating to penalty amounts (in section 6-47), restitution (in section 5-110.2), and available mediums for cancelation (in section 5-110.1(d))." Two of those three change what it costs you. Only one changes what you have to build.
• There is no small-business exemption. The exemption list in § 5-110.3 has five entries, and every one of them is a category of regulated or franchised entity. SaaS, e-commerce, media, fitness, subscription boxes: none of them are on it. Telecom asked for an exemption and DCWP said no, in writing.
• The rule never says who it reaches geographically. No section addresses sellers located outside New York City. That cuts both ways, and we'll be honest about it below rather than guess for you.

What NYC's click-to-cancel rule does — and when it starts

The short version: from October 1, 2026, offering an auto-renewing subscription in a way that doesn't meet DCWP's requirements is itself a deceptive and unconscionable trade practice under New York City law. That's § 5-110.1(a), and it's the load-bearing sentence in the whole document:

"It is a deceptive and unconscionable trade practice for any person to offer or provide an automatic renewal or continuous service to a consumer except in accordance with the requirements of this section."

That framing matters more than it looks. DCWP didn't build a new enforcement machine — it plugged the subscription requirements into § 20-700 of the Administrative Code, the city's existing prohibition on deceptive or unconscionable trade practices. (The city statute is disjunctive: either one is enough. The new rule's own § 5-110.1(a) happens to name both.) The plumbing was already there. This rule just attached your checkout flow to it.

The requirements themselves, in the order the rule states them:

• § 5-110.1(b) — disclosure, before the ask. The material terms (what the product is, the amount charged, the frequency, the deadline to act to stop further charges, and the cancellation mechanisms) must be clear, conspicuous, and presented "before consent to the offer or billing information has been requested" — and in visual proximity to the request for consent (or temporal proximity, for a voice offer). Free trial or intro pricing? You must also explain how and when the price changes and what it becomes.
• § 5-110.1(c) — cancel in the medium they used to say yes, with a mechanism as easy as the one that got their consent.
• § 5-110.1(d) — cancel through every medium in which you accept consent. This is not the same requirement as (c). More on that below, because this is the one that actually changes engineering tickets.
• § 5-110.1(e) — no obstruction. No hanging up on callers, no false or obscured cancellation information, no misrepresenting what canceling costs or does. Save offers are still allowed — but only where they don't impose unreasonable conditions, refuse to acknowledge, obstruct, or unreasonably delay the cancellation.
• § 5-110.1(f) — no consent, no charge, no shipment. Anything you send without affirmative consent is an unconditional gift.
• § 5-110.1(g), (h), (i) — three separate advance-notice duties, each with a floor and a ceiling.

The rule is short. You can read the whole thing in fifteen minutes, and if you sell subscriptions you should: the DCWP Notice of Adoption is a public PDF. What follows is what it means for a business rather than for a consumer — which is the read that's hard to find right now.

Didn't click-to-cancel die? The federal one did. This is a different layer.

Search this topic today and you'll land on some version of the same sentence: the click-to-cancel rule was set aside and will never take effect. It's the sentence that quietly convinced a lot of founders to stop paying attention — and it's a slightly rounded-off version of what actually happened.

Here is the actual sequence, with years attached:

• January 14, 2025 — the FTC's amended Negative Option Rule takes effect. Its central cancellation provisions, though, carry a deferred compliance date: businesses have until May 14, 2025 — later pushed to July 14, 2025 — before those parts bind anyone.
• July 8, 2025 — the Eighth Circuit vacates the rule. The ground was procedural: the Commission hadn't issued the preliminary regulatory analysis the FTC Act requires. The timing is the part nobody quotes — the rule died six days before its cancellation requirements were due to become enforceable. No business ever had to comply with the federal click-to-cancel mechanics.
• March 11, 2026 — the FTC reopens the rulemaking with an advance notice of proposed rulemaking, published in the Federal Register on March 13, 2026. It contains no draft rule text; it asks whether a rule is needed at all. That is the beginning of a process, not the end of one. There is no final federal click-to-cancel rule in force today, and we're not going to pretend to know when there will be.
• April 8, 2026 — NYC DCWP proposes its own rule.
• May 8, 2026 — public hearing. DCWP reports "substantial comments" from consumers, industry, and advocates.
• October 1, 2026 — the city rule takes effect.

That six-day gap is worth holding onto, because it explains the shape of the confusion. Nothing about the federal rule was ever tested against a real compliance deadline. It was struck down on how it was made, not on what it asked for — and "the rule was vacated" got compressed, in the retelling, into "regulators tried to make you do this and failed." The first is a fact about administrative procedure. The second is a conclusion about your obligations, and it doesn't follow.

Meanwhile the ground under the federal rule never went quiet. The vacatur took out a rule, not the statutes underneath it: the Restore Online Shoppers' Confidence Act (ROSCA) and the FTC Act survived it untouched, and both were already the basis for enforcement. DCWP's own Notice points at FTC actions that extracted click-to-cancel commitments from companies under existing law — FTC v. AdoreMe (2017), FTC v. Bridge It (2023) — and at a $600,000 settlement the New York Attorney General announced with Equinox on May 30, 2025 over cancellation difficulty. The federal rule fell. The enforcement hooks didn't.

And below the federal layer, states kept legislating. DCWP's Notice names Utah, Idaho, California, Massachusetts, Georgia, Minnesota, Colorado, Illinois, and Arkansas as states with click-to-cancel-related laws — "several states, including" is how the Notice puts it, so read that as a floor, not a census — alongside New York's own GBL § 527-a. (Footnote 9 collects the statutory citations.) That is a citation list, not a comparison — those statutes are not interchangeable, and the only way to know what any one of them demands of your flow is to read that one. Treat the list as a map of where to look, not as a set of rules you already understand.

This is a shape founders have seen before. It's the same one we walked through when the federal 1099-K threshold was reset and several states simply didn't follow the federal number: a federal number changing — or dying — tells you almost nothing about the layer you actually sell into. The layers run on their own clocks.

Who it lands on — and the five exemptions that don't include you

The rule applies to any person making an automatic renewal or continuous service offer to a consumer. The definitions are deliberately plain:

• Automatic renewal: "a plan or arrangement in which a paid subscription or purchasing agreement is automatically renewed at the end of a definite term for a subsequent term."
• Continuous service: "a plan or arrangement in which a subscription or purchasing agreement continues until the consumer cancels the service."

If your product bills monthly until someone stops it, that's continuous service. If it bills annually and rolls over, that's automatic renewal. SaaS, paid communities and memberships, subscription boxes and DTC replenishment, paid newsletters and media, apps with auto-renewing plans, gyms and studios, coaching retainers — the definitions don't care which category you'd put yourself in.

Now the exemptions. § 5-110.3 has five, in full:

• Services provided by a business or affiliate "doing business pursuant to a franchise issued by a political subdivision of New York State"
• Entities (and their subsidiaries and affiliates) regulated by the Department of Financial Services
• Security system alarm operators licensed by the New York State Department of State
• Banks, bank holding companies and their subsidiaries and affiliates; credit unions; and other financial institutions licensed under state or federal law
• Sellers and administrators of a service contract, as defined under § 7902 of the Insurance Law

Read that list again as a list of what it contains, not what it omits. Every entry describes an entity that is already regulated by a named regulator, or operating under a franchise granted by a unit of government. It is a list about regulatory overlap. Nothing on it is about size, revenue, headcount, or industry sector.

Two things worth flagging carefully:

"Franchise issued by a political subdivision" is not the franchise you're thinking of. The words describe a franchise granted by a government body — the kind of arrangement a utility or cable operator holds. It does not, on its face, describe buying a franchise of a national brand. If you think you might genuinely be in this category, that's a conversation for a lawyer, not an inference from a blog post.

Telecom asked to be let out, and DCWP said no — in writing. Representatives of the motion picture, television, streaming, telecom, broadband, health and fitness, newspaper, and magazine industries all objected to the rule. The wireless and telecom industries specifically argued that federal law and the FCC already protect their customers. DCWP's answer is one of the sharpest lines in the document:

"The comments, however, do not identify any federal law or regulation that imposes a Click to Cancel requirement. Accordingly, the comments do not justify exempting industries regulated by the FCC from this rule."

That sentence tells you something about the whole posture of this rule. The absence of a federal requirement was treated as a reason to impose a local one, not a reason to defer. If well-funded industry associations couldn't win an exemption through the comment process, "we're a small company" isn't going to find one either.

If you already follow New York State's law, here is exactly what's new

This is the part that no summary is telling you, and it's sitting in plain sight in DCWP's response to industry comments. Trade groups argued the state's General Business Law already covered this and a city rule would just create confusion. DCWP disagreed — and in disagreeing, it volunteered a precise diff of its own rule:

"the rule is fully consistent with the existing approach in the GBL, except that includes expanded or amended provisions relating to penalty amounts (in section 6-47), restitution (in section 5-110.2), and available mediums for cancelation (in section 5-110.1(d))."

That is the agency's own characterization of its own rule — not a legal opinion you can bank, and not a substitute for putting your flow next to both texts. But as a starting point for triage it's worth more than any external summary, because it comes from the people who wrote the thing. Take it at its word and you get this:

Look at the third column. Of DCWP's own three expansions, exactly one changes what you have to ship — and it's the one nobody is talking about. The other two are the price of getting it wrong.

The cancellation-medium test: (c) and (d) are two different requirements

Everyone repeats the slogan: canceling should be as easy as signing up. That slogan is subsection (c). Subsection (d) is a separate sentence with a separate job, and it's where the design work actually lives.

Read (d) again slowly, because the scope is broader than it first appears. It doesn't ask what medium this customer used. It asks what mediums your business accepts consent through — and requires that a cancellation route exist in all of them. If your sales team closes annual plans on a call, "cancel in your account settings" is a web mechanism, not a phone one. If you take consent in person at a pop-up or a gym counter, the rule expressly says the in-person option isn't enough on its own — you must also offer a website or email route.

And note how the operative clause ends: consent to the renewal, the continuous service offer, "or any price increase." The mediums through which you get someone to accept a price rise are inside the same test.

The practical audit takes ten minutes. Write down every way a human being can say yes to your subscription — web checkout, in-app purchase, phone sale, in-person signup, an emailed order form, a DM, a QR code at an event. Then write down every way they can say no. Under (d), the second list has to be at least as long as the first.

One honest gap: if you sell through an app store's auto-renewing subscription system, part of the consent and cancellation flow belongs to the platform, not to you. The rule speaks about "a person making an automatic renewal or continuous service offer" and doesn't address platform-billed subscriptions. We're not going to guess how that maps. It's a question worth putting to your counsel specifically, rather than assuming the platform's cancel screen discharges your obligation.

The fine is $525. Restitution is the number to worry about.

The penalty chart added to § 6-47 is almost disarmingly modest:

For a funded company, those are rounding errors, and it would be easy to read that chart and conclude this rule has no teeth. That reading stops one section too early. § 5-110.2 is a single sentence, and it is the entire ballgame:

"If a person is found to have violated any provision of this part, such person is liable for the monetary amount charged for the automatic renewal or continuous service offer after the consumer's first attempt at cancellation."

Sit with the structure of that sentence.

The trigger is any provision. Not just the cancellation ones. Violate the disclosure rule in (b) — bury your renewal terms below the billing form — and the restitution provision is live.

But the measure is the cancellation flow. The amount owed is what you charged after the consumer's first attempt at cancellation. Not after a successful cancellation. Not after a cancellation you acknowledged. After the attempt. So the size of the number is set by how many charges you managed to collect in the gap between someone trying to leave and actually getting out.

That inverts the usual instinct about compliance costs. A fine is capped and knowable — you can put $3,500 in a spreadsheet. Restitution has no fixed ceiling in the text, because it isn't priced by the city at all. It's priced by your own billing. Every extra retention screen, every "we'll process that within one billing cycle," every support queue where cancellation emails go to die is, under this measure, converting your own revenue into your own liability.

The text is written around "the consumer" — singular — and it doesn't spell out how the measure aggregates across a subscriber base. We won't guess at that; it's exactly the kind of question that gets answered by enforcement practice and by lawyers, not by inference. What the text does establish beyond argument is the measure itself: revenue billed after a first cancellation attempt is revenue you may not get to keep.

Which means the most valuable thing your systems can do before October 1 has nothing to do with your checkout page. It's a timestamp. See the checklist below.

Anything you ship without affirmative consent is a gift

§ 5-110.1(f) is the provision that should stop every subscription-box, replenishment, and physical-goods founder cold:

"In any case in which a person sends any goods, wares, merchandise, or products to a consumer, under a continuous service agreement or automatic renewal of a purchase, without first obtaining the consumer's affirmative consent, the goods … shall for all purposes be deemed an unconditional gift to the consumer, who may use or dispose of the same in any manner such consumer sees fit without any obligation whatsoever on the consumer's part to the person, including, but not limited to, bearing the cost of, or responsibility for, shipping any goods … to the person."

There's no proportionality in that sentence and no cure. The goods are the consumer's, full stop. They don't owe you the money, they don't owe you the item, and they explicitly don't owe you the return shipping — which is the clause that quietly destroys the standard "just send it back and we'll refund you" playbook.

For physical-goods subscriptions the operational reading is stark: your fulfillment trigger must be a record of affirmative consent, not an assumption of one. A renewal you couldn't evidence consent for isn't a shipment with a billing risk attached. It's a present.

Three notice windows — each with a floor and a ceiling

Most coverage of advance-notice duties says "at least 15 days." Read the actual text and every window has two edges. Sending too early is as much a miss as sending too late.

Two details that don't survive summarizing:

• The notice goes out "in the manner selected by the consumer" — text, email, app notification, or any other channel you offer. Not the channel that's cheapest for you.
• (g) and (i) say expressly that the notice must include instructions on how to cancel. A renewal reminder that doesn't tell people how to get out isn't a renewal reminder for those purposes. (h) — the material-change notice — doesn't repeat that sentence; it cross-refers to (g) for the manner of notice. Reading the cancellation instructions into (h) as well is an inference rather than the text, though it's the safe direction to err in.

Note the (h) window in particular: five business days is a very short runway for a price-increase announcement, and thirty days is a hard outer edge. If your standard practice is a 60-day heads-up on pricing changes, that's a habit worth checking against the text rather than assuming that earlier is always safer.

The question the rule doesn't answer: does it reach a seller outside New York City?

Here we stop and mark the edge of what's known, because on this one you'll get more from an honest gap than from a confident guess.

The rule contains no geographic-scope provision. It says "any person" making an offer "to a consumer." It does not define a consumer by location. It does not use the language jurisdictions typically use when they intend to reach sellers who aren't physically present — and it does not say the opposite either. There is no section on remote sellers, in either direction.

That absence is conspicuous, and it's worth seeing why. When a US jurisdiction does mean to reach a business that sits outside its borders, it usually says so explicitly and it usually attaches a number. State sales-tax law is the clearest example: economic-nexus statutes are written around sales into the state and set dollar or transaction thresholds that tell a remote seller precisely when it has crossed the line — the structure we walk through in do foreign sellers have to collect US sales tax. Whatever else you think of those rules, they answer the question. This rule doesn't contain that machinery, and it doesn't contain its opposite.

So we're going to say the unsatisfying thing plainly:

• "I have NYC customers, so it applies to me" is not something the rule text supports. It's an inference.
• "I'm not in New York City, so it can't touch me" is not something the rule text supports either. That's an inference too — and it's the more expensive one to get wrong, because it's the one that ends with you doing nothing.

What we can point to is the architecture the rule was built into: DCWP's authority comes from the City Charter and the Administrative Code, and the substantive hook is § 20-700, the city's prohibition on deceptive or unconscionable trade practices in the sale of consumer goods or services. How far a city consumer-protection provision reaches a seller who has never set foot in the city is a genuine legal question, and it is not one a subscription rule resolves on its own. If your answer to that question is load-bearing for your business, get it from a lawyer licensed in New York — not from us, and not from a summary.

There is, however, a pragmatic exit from the anxiety. Look back at DCWP's own diff: the rule is, by the agency's account, the state's existing GBL § 527-a approach plus penalties, restitution, and the all-mediums cancellation duty. At least nine other states have their own click-to-cancel-style laws. ROSCA and the FTC Act are still live, and the FTC has an open rulemaking on top of them. Building a cancellation flow that satisfies this rule is, in most cases, not a New York City project — it's the thing you were going to have to do for the US market anyway, on somebody's timetable. October 1 is just the earliest date somebody put on it.

This is general information about a New York City consumer-protection rule, not legal advice. Whether and how it applies to your business — especially if you're outside New York City — depends on facts this piece can't see. Confirm your position with a lawyer before you change your billing flows, or decide not to.

What to do before October 1

• Map your consent mediums, then your cancellation mediums. Every route a human can use to say yes (web, in-app, phone, in-person, email, DM) needs a matching route to say no. That's § 5-110.1(d), and it's the requirement most likely to need engineering time rather than copy edits.
• Move the material terms above the billing-info step. Price, frequency, the deadline to act to stop charges, and how to cancel — clear, conspicuous, and in visual proximity to the consent request, before you ask for a card. For voice sales, the equivalent is temporal proximity: say it near the ask, not at the end.
• Write out what a trial becomes. If there's a free trial or an intro price, the offer has to explain how and when the price changes and what the new price is.
• Set three calendar rules, each with two edges. 15–45 days (annual-plus renewals), 5 business days–30 days (material changes and price increases), 3–21 days (first charge after a trial longer than a month). Send in the consumer's chosen channel. (g) and (i) require cancellation instructions in the notice; putting them in the (h) notice too is the safe call.
• Audit the cancellation path for the behaviors named in (e). Nothing that hangs up, obscures, misstates the consequences of canceling, or "unreasonably delays." Save offers survive — but only if the offer can't obstruct or delay the cancellation the customer already asked for.
• Never ship without a consent record. Under (f), goods sent without affirmative consent are an unconditional gift, return shipping included.
• Log the first cancellation attempt — this is the one that pays for itself. Restitution is measured from "the consumer's first attempt at cancellation." That means your systems need to record attempts, not just completions: the chat that went nowhere, the support email, the call that dropped, the retention screen someone bounced off. If you can't produce that timestamp, you have no way to know what your exposure is — and in a dispute, someone else will define when the attempt happened.

The second column on the penalty chart

Look at § 6-47 one more time. Every tier has two columns — a violation amount and a default amount — and DCWP set them to the same number. $525 and $525. $1,050 and $1,050. $3,500 and $3,500.

The rule doesn't explain the second column, and we're not going to invent a procedure for you. What we can point at is what's on the page: DCWP priced a default at all — and a default, in the ordinary sense of the word, is what happens when nobody answers.

The rule says nothing about addresses. The chart implies something about them anyway. If you sell into a city you've never set foot in, the mundane question underneath all of this has nothing to do with your checkout flow: when something official gets sent to your business, where does it land, and who reads it? Founders running a US entity from abroad know this failure mode by another name — it's the same structural problem as the $25,000 Form 5472 penalty whose 90-day clock starts when the IRS mails the notice, not when you read it. The obligation runs on the sender's calendar, not yours.

So the boring half of your October 1 preparation is the half nobody writes about: a US address you actually monitor, where official mail gets seen in days rather than seasons. On the US side, our partner SaveOffice handles that — Auteur doesn't operate the US service directly — and you can see how it works on the US virtual office page. It won't fix your cancellation flow, and no address makes a rule stop applying. What it does is keep you out of the column DCWP already priced.

FAQ

Who does the NYC click-to-cancel rule apply to? Any person making an automatic renewal or continuous service offer to a consumer — which, on the rule's own definitions, covers a subscription that renews at the end of a term or one that simply continues until it's canceled. That takes in SaaS, memberships, subscription boxes, paid media, apps, and fitness. The exemptions in § 5-110.3 are five, and every one of them keys on a regulatory license or a government-granted franchise: businesses operating under a franchise issued by a political subdivision of New York State, entities regulated by the Department of Financial Services, licensed security alarm operators, banks and credit unions and other licensed financial institutions, and sellers and administrators of service contracts under Insurance Law § 7902. There is no exemption based on size, and none for a sector merely because it asked — the telecom industry asked and was refused. One thing the rule genuinely doesn't say is how far it reaches geographically: it contains no provision about sellers located outside New York City, in either direction. If that question decides what you do next, take it to a New York lawyer.

Is the click-to-cancel rule dead, delayed, or blocked? Three different things are being confused under one name. The federal one — the FTC's Negative Option Rule — took effect on January 14, 2025, but the compliance date for its cancellation provisions was deferred to July 14, 2025, and the Eighth Circuit vacated the rule on July 8, 2025 on procedural grounds — six days short. Those requirements never became enforceable, and the FTC restarted the process with an advance notice on March 11, 2026, which is a rulemaking, not a rule. The state layer never went anywhere: New York's GBL § 527-a still requires clear terms, affirmative consent, and a cancellation mechanism as easy as the consent mechanism, and at least nine other states have laws of their own — and ROSCA and the FTC Act were never touched by the vacatur. The city rule described here is adopted, with an effective date of October 1, 2026 — not proposed, not blocked, not delayed. "Click to cancel is dead" is a statement about one federal rule, and a false one about your obligations.

What are the penalties for violating NYC's click-to-cancel rule? The civil penalty schedule in § 6-47 is $525 for a first violation, $1,050 for a second, and $3,500 for a third and subsequent violation — with the default amount set identically at each tier. The number that should shape your planning is in § 5-110.2: a business found to have violated any provision of the rule is liable for the monetary amount charged after the consumer's first attempt at cancellation. There's no fixed ceiling on that figure in the text, because the city doesn't set it — your billing does. Whatever you collected between someone trying to leave and actually getting out is the exposure.

Bottom line

The federal click-to-cancel rule was vacated on July 8, 2025 — six days before the deadline that would have made its cancellation requirements bite — and the FTC is back at the advance-notice stage as of March 11, 2026. Both of those facts are true, and neither of them is about you. On October 1, 2026, New York City's rule takes effect, with no exemption based on size and none for any sector that asked for one.

If you already meet New York State's requirements, DCWP has told you precisely what's new: penalties, restitution, and § 5-110.1(d) — and only the last of those three changes what you have to build. It's the one that says a customer must be able to cancel through every medium in which you're willing to take their yes.

And when you cost this out, don't stop at the penalty chart. $525 is the price of the violation. § 5-110.2 is the price of the flow — every dollar you billed after a customer first tried to leave. A fine is a number the city sets once. Restitution is a number you set every month, in your own billing system, and the only way to know how big it's getting is to start recording something most subscription businesses never bother to record: the moment somebody first tried to go.

Two things are worth doing before October. Instrument that moment. And make sure the mail from a city you've never visited — through our US partner SaveOffice, on the US virtual office page — reaches somebody who actually opens it.