Click to Cancel Is Enforceable in New York City Now. The Cancellation Flow Is a Compliance Surface.

On 1 October 2026, New York City's rules on the cancellation of subscriptions took effect. The Department of Consumer and Worker Protection adopted them to make sure consumers can easily cancel subscriptions and to stop deceptive and unconscionable practices around cancellation, and the city is the first municipality to put a click-to-cancel rule in force — with a complaint portal for consumers who run into one that does not work.

For anyone whose job is retention, this is not a legal footnote. The cancellation flow is a lifecycle flow. Most programs have spent years optimising it, and very few have ever documented the line between "we make it easy and explain what they lose" and "we make it slow and hope they give up." The rule draws that line and prices both sides of it.

What the rule says, and what it costs to ignore

The adopted rules amend Title 6 of the Rules of the City of New York, and the operative citation appears in the enforcement schedule as 6 RCNY § 5-110.1, unconscionable and deceptive trade practices relating to automatic renewal and continuous service offers. The Statement of Basis and Purpose is blunt about the mechanism: under the city's consumer protection law, failing to offer clear, conspicuous and streamlined methods of cancellation is itself both a deceptive trade practice and an unconscionable one — not a technicality to be corrected after a complaint, but the substance of the violation.

The consequences are attached to the violation, not to the intention. Businesses that fail are liable for restitution as well as civil penalties, and the city's schedule steps up per violation: $525 for a first violation, $1,050 for a second, and $3,500 for a third and subsequent violation.

The floor underneath this was already there. New York State law requires a business making an automatic renewal or continuous service offer to clearly and conspicuously present the terms, to obtain affirmative consent, and to provide a mechanism to cancel that is as easy to use as the mechanism used to consent. What the city has added is local enforcement authority of its own, and a complaint channel that makes a bad flow visible without a lawsuit.

The part that is actually a design problem

Cancel flows are usually the most-tested, least-documented flow in a lifecycle program. They have accumulated years of local decisions: an extra confirmation screen added after a spike in churn, a dropdown whose first option is "pause for a month", a phone number that appears only for annual plans. Each decision looked reasonable at the time. Together they are a system nobody owns, and the system is now something a regulator can read.

Two failure modes are worth naming plainly, because both feel like competence from inside the team:

• Friction that was never measured. A step count is not a churn metric, and "we offered them a discount" is not a save. If nobody has ever instrumented the flow as a journey — entries, drop-off per screen, support contacts, time to completion — then the retention number contains an unknown quantity of people who are still paying because leaving was hard.
• Retention that is really inertia. Involuntary retention is not a win to report; it is a complaint queued up, a chargeback risk, and now a fine. Volume that only exists because the exit is hidden is the single most expensive kind of growth to keep.

A save offer is not the problem. Offering a reason to stay, honestly, at the moment someone decides to leave is good lifecycle work — the public comments on this rule even asked for it to stay. The problem is a path engineered so that the offer is the only way out.

What to audit this week

• Findability: can cancellation be reached from the same surface where the subscription was taken out, without a support ticket or a phone call?
• Parity of steps: count the clicks to subscribe and the clicks to cancel. If the second number is larger, you have a decision to make and a record to keep.
• Terms and consent: are the renewal terms, price and billing cadence presented clearly and conspicuously at the point of sale, with affirmative consent rather than a pre-ticked box?
• Confirmation: does the cancellation produce a durable acknowledgement, and does the message that follows still try to sell instead of confirming?
• Hidden continuations: cancelling one thing that silently leaves another running, and the reverse — a cancel that kills a service the customer did not intend to lose.

The federal picture is unsettled, which is not the same as safe

The FTC finalised a national click-to-cancel rule in October 2024; the Eighth Circuit vacated it in mid-2025 on procedural grounds shortly before it would have taken effect. In March 2026 the agency asked for public input on whether to update its older Negative Options Rule, including whether to bring back provisions of the vacated rule. More than half of US states already regulate automatic renewals, and regulators have been building the same requirements from different directions: disclosure up front, consent, confirmation, an easy exit.

That is the reason to treat this as a direction rather than a local event. A program that can show, on a page, how someone cancels and how many steps it takes is not doing compliance theatre. It is the same artifact you need to improve the flow — and the only version of retention that survives being audited.