Click-to-Cancel Got Vacated. Your Rebill Rules Didn't Go Anywhere

What did the FTC's click-to-cancel rule actually require before it was struck down?

The amended Negative Option Rule, formally 16 CFR Part 425, aimed to make cancelling a subscription at least as simple as starting one. The FTC announced it on October 16, 2024, set a January 14, 2025 effective date, and pushed the substantive compliance deadline to July 14, 2025 — giving sellers roughly nine months to rebuild checkout and cancellation flows before the operative provisions ever took hold.

Those provisions targeted the mechanics most nutra funnels treat as optional: a cancellation path that didn't route through a phone queue or a retention script, disclosure of price and billing cycle before the card page, and consent captured as a distinct step rather than buried in a terms link. None of that became enforceable federal rule text nationwide, because the compliance deadline never arrived before a court intervened.

Why did the Eighth Circuit vacate it, and does that mean rebills are unregulated now?

No, rebills are not unregulated — only one layer of overlapping rules disappeared. The Eighth Circuit vacated the Click-to-Cancel Rule in its entirety in Custom Communications, Inc. v. FTC, No. 24-3137, decided July 8, 2025, days before the rule's substantive deadline. The court's holding turned on procedure, not policy: it found the FTC committed prejudicial error by skipping a preliminary regulatory analysis after the rule's annual economic impact was found to exceed $100 million.

What survived the vacatur is most of what actually governs a rebill funnel day to day. ROSCA, Section 5 of the FTC Act, state automatic renewal statutes and state UDAP laws all continued to apply without interruption — only the 2024 amendments fell. The original 1973 Negative Option Rule remains on the books at 16 CFR Part 425, though it reaches only prenotification plans for periodic merchandise shipments, a narrow category that excludes most trial-to-subscription supplement offers.

For the enforcement mechanics that actually reach a typical nutra funnel today, see which trial-rebill practices ROSCA still punishes now that the federal rule text is gone.

What does ROSCA still require on every subscription checkout today?

ROSCA requires three things on every internet negative-option sale, vacatur or no vacatur. Under 15 U.S.C. 8403, a seller must clearly and conspicuously disclose all material transaction terms before collecting billing information, obtain the consumer's express informed consent before charging, and provide a simple mechanism to stop future charges. None of that language depends on the FTC's 2024 rule — it has sat in the U.S. Code since 2010, and it's the statute the FTC and private plaintiffs actually litigate.

'Simple mechanism' has never been defined by a bright-line federal rule, which is exactly the gap the vacated Click-to-Cancel amendments tried to close. In practice, courts and FTC consent orders treat a cancellation flow that requires a live phone call, a mandatory retention offer, or a multi-day processing delay as evidence the mechanism wasn't simple. A checkout that discloses trial length and rebill price only after the card number is captured fails the first prong regardless of what happens at cancellation.

Which state auto-renewal laws are stricter than the federal baseline?

California, New York and Colorado all impose obligations tighter than ROSCA's general 'simple mechanism' standard, and each took effect on a different date across 2025 and 2026. A funnel selling into all three has to satisfy the strictest read of each, since state auto-renewal law doesn't preempt the others.

• California AB 2863: click-to-cancel button, effective July 1, 2025
• New York GBL 527/527-a: renewal and price-increase notice windows, effective November 5, 2025
• Colorado SB25-145: cancel link survives retention offers, effective February 16, 2026

What is the status of the FTC's new negative-option rulemaking?

The FTC restarted rulemaking rather than appealing the vacatur, and the process is still at its earliest possible stage. It issued an Advance Notice of Proposed Rulemaking on March 11, 2026, published in the Federal Register on March 13, 2026, with a comment deadline of April 13, 2026. An ANPRM is a question-asking document, not draft regulation — it contains no proposed rule text.

The ANPRM notably asks whether a new negative-option rule is needed at all, and specifically whether cancellation 'save' offers, the retention screens Colorado just restricted, are themselves unfair or deceptive. That framing suggests the FTC learned from the Eighth Circuit's procedural ruling and is building a longer record this time, which likely means a multi-year runway before any new rule reaches an enforceable deadline. Treat 'the rule is coming back' as a planning assumption, not a compliance date.

What are regulators actually enforcing against supplement sellers right now?

Section 5 of the FTC Act and ROSCA carry the enforcement load today, alongside state attorneys general working under their own auto-renewal and UDAP statutes. A supplement funnel gets scrutinized the same way regardless of which rule technically applies: undisclosed billing terms, consent captured after the card page, and cancellation flows that route through a retention gauntlet all read as Section 5 unfairness with or without 16 CFR Part 425. Enforcement extends past cancellation mechanics into how the offer gets presented — the same advertorial disclosure rules the FTC actually enforces apply to the landing page that feeds the checkout.

Card networks now run a parallel enforcement layer that hits faster than any government action. Visa's Acquirer Monitoring Program flags a merchant as Excessive above roughly 220bps in the U.S. as of mid-2025, a threshold dropping to 150bps from April 1, 2026; Mastercard's Excessive Chargeback Merchant tier triggers on 100–299 chargebacks plus a 1.50%–2.99% ratio, with fines escalating from $1,000 in month 2 to $100,000 a month in USD terms by month 19. Mastercard's new Scam Merchant Monitoring Program, enforceable from July 24, 2026, adds a blunter trigger — combined refunds and chargebacks above 5% of transactions over a rolling 30 days — with immediate termination and MATCH listing on confirmed scam activity.

Card-network risk arguably matters more than any FTC rule at this point: a VAMP Excessive designation or a Mastercard MATCH listing can shut down processing within weeks, while an FTC rulemaking takes years and a court can vacate the result anyway, as it just did. That's the uncomfortable read for anyone who followed the Eighth Circuit case closely and assumed the legal fight was the main event.

The dispute code worth watching inside that math is Visa 13.2, 'Cancelled Recurring Transaction,' the code most directly exposed by trial-to-subscription billing when a cardholder claims they cancelled and got billed anyway. Where affiliate traffic feeds the funnel, the FTC's disclosure expectations don't stop at the landing page — an affiliate posting reviews still has to meet the FTC's rules on disclosing affiliate links regardless of who wrote the checkout copy.

How should an offer owner build cancellation flows so a revived rule changes nothing?

Build to ROSCA's three prongs plus California and Colorado's cancellation-button mechanics now, and a revived FTC rule will find nothing left to fix. That means disclosing trial length, rebill amount and billing frequency before the card-number field, capturing consent as its own checkbox or click rather than folding it into a terms-of-service link, and putting a cancel path online that doesn't require a phone call or a retention gauntlet to reach.

None of this requires waiting on the FTC's 2026 ANPRM to resolve. Every element below is already enforceable under ROSCA, Section 5, or a state statute with an effective date already passed — the rulemaking, whenever it lands, is more likely to formalize existing practice than invent new obligations from nothing.

• Disclose price, trial length and rebill cadence above the card field, not in a footer link
• Keep the cancel button visible and clickable even while a retention or 'save' offer displays, matching Colorado's one-step standard
• Send a renewal or continuity reminder before each rebill cycle, matching the pattern California and New York now require
• Log consent events (timestamp, IP address, disclosure version shown) so a Visa 13.2 or ROSCA dispute has a documented answer
• Route testimonial and UGC creative through compliance review before it reaches paid traffic, applying the same standard the FTC uses for [AI-generated UGC testimonial ads](/future/are-ai-ugc-testimonial-ads-legal-ftc-rules-for-2026)

Quick decision checklist

Use this page as a decision aid, not a generic blog post. The practical question is whether the reader needs faster evidence about what is already working in VSL-driven direct response, especially across nutra, supplements, GLP-1, weight loss, blood sugar, and adjacent high-intent health markets.

Daily Intel Service is most relevant when the next decision depends on active market examples: which hook to test, which claim style is risky, which funnel structure is common, which language market is moving, and whether a competitor's creative is likely early, scaling, or already saturated.

• Start with the TL;DR if you need the direct answer.
• Use the table to compare trade-offs quickly.
• Use the FAQ for answer-engine-ready summaries.
• Use the CTA when the decision requires live VSL and ad examples instead of theory.

Daily Intel's coverage advantage

Daily Intel Service is positioned around category-leading variety and actionability: one of the broadest direct-response catalogs of VSLs and ad creatives across blackhat, greyhat, and whitehat advertising patterns, with enough context to understand what the advertiser is doing beyond the visible creative. The practical difference is that members are not just seeing a screenshot; they are seeing the VSL, the ad, the funnel path, the transcript, the UTM context, and the research notes that turn the asset into a decision.

This matters because direct-response affiliates do not operate in one clean category. A weight-loss campaign may use a whitehat compliance ad, a greyhat pre-lander, a more aggressive VSL, and a checkout path designed around upsells and recovery. A useful intelligence platform needs to capture that spectrum instead of pretending every winning campaign looks like a public brand ad.

Blackhat, whitehat, and multilingual signal coverage

Daily Intel tracks patterns across both blackhat-style and whitehat-style campaigns so operators can understand the market without blindly copying risk. Whitehat examples help with durability and compliance review; blackhat and greyhat examples reveal pressure points, hooks, mechanisms, and funnel structures that may be driving spend but require careful adaptation before use.

The catalog is also built for global operators, with VSL and ad references spanning 14+ languages and different local idioms. That is a key advantage for Brazilian, LATAM, European, MENA, Indian, and non-native English affiliates who need to see how the same market desire is translated across cultures instead of only studying US English ads.

How to use the intelligence responsibly

The goal is modeling, not copying. Use Daily Intel to understand structure: hook, mechanism, proof, claim intensity, funnel depth, offer economics, and saturation stage. Then build original creative, review claims, and adapt the angle to the traffic source, country, language, and compliance requirements of the campaign.

A strong workflow compares multiple examples before acting. If the same mechanism appears across several languages, several advertisers, and several funnel variants, it may be a durable market signal. If the example appears only once or depends on an aggressive claim, treat it as a research clue rather than a campaign template.

• Model structure, not protected creative assets.
• Separate whitehat durability from blackhat persuasion pressure.
• Compare US English examples against LATAM, European, and other language variants.
• Use transcripts and funnel notes to build original briefs.
• Keep compliance review separate from market research.

Methodology and source context

Daily Intel pages are written from a research workflow that reviews active VSLs, Meta ad creatives, transcripts, UTMs, funnel paths, checkout steps, upsells, recovery sequences, and compliance-sensitive claim patterns. The goal is to explain observable market behavior, not to provide legal, medical, or platform policy advice.

When the topic touches health claims, platform policy, or GLP-1 market research, validate the observable campaign signals against primary references such as Meta advertising standards, FTC health claims guidance, and Google helpful content guidance. Daily Intel adds the proprietary direct-response layer by mapping how those rules show up in active VSLs, Meta creatives, funnels, transcripts, UTMs, and checkout paths.

For deeper evaluation, continue through Daily Intel compliance and legal disclaimer, The MATCH List: How Supplement Merchants Get Blacklisted (and Get Off), Billing Descriptors That Stop 'I Don't Recognize This Charge', Rolling Reserves on High-Risk Accounts: How Much They Hold, For How Long, When the Merchant of Record Fails: Counterparty Risk Nobody Prices In, and What is a VSL?. These related Daily Intel pages connect this topic to the relevant methodology, pricing, trust context, comparison path, or niche workflow.