New York City’s click-to-cancel rule takes effect on October 1, 2026, and it lands on a retail industry that no longer has a federal version of the same rule to comply with. The Department of Consumer and Worker Protection (DCWP) adopted the measure on July 10, 2026. According to the city, it is the first municipal subscription-cancellation rule of its kind in the United States.
The timing matters because the federal equivalent is gone. The Eighth Circuit vacated the Federal Trade Commission’s amended Negative Option Rule on July 8, 2025, days before its compliance date, on procedural grounds. The FTC restarted the process with an advance notice of proposed rulemaking in March 2026, but no new federal rule exists today.
Into that gap steps a city agency with its own penalty schedule. DCWP can levy $525 for a first violation and up to $3,500 for repeat violations, per violation, with each offending statement or omission capable of counting separately. For a subscription retailer running a single non-compliant checkout flow across thousands of New York City sign-ups, the arithmetic is the story.
In short
- Effective date: the NYC click-to-cancel rule applies from October 1, 2026, adopted by DCWP on July 10, 2026.
- Core test: cancellation must be at least as easy as signing up, and available through the same medium used to enroll.
- Penalties: $525 to $3,500 per violation, plus restitution to harmed consumers, enforced citywide by DCWP.
- Federal vacuum: the FTC’s Negative Option Rule was vacated in July 2025 and its replacement is only at the advance-notice stage.
- Still to come: a separate all-in pricing junk fees rule remains a proposal after an August 7, 2026 hearing.
What exactly takes effect in New York City on October 1?
The rule governs what DCWP calls automatic renewal and continuous service offers. In commercial terms that means any arrangement where a consumer’s initial consent keeps producing charges until the consumer acts to stop them. Subscription boxes, replenishment programs, paid loyalty tiers, streaming add-ons, gym and studio memberships, software seats sold to consumers, and free trials that convert to paid all sit inside the definition.
Three obligations carry most of the weight. The first is a pre-purchase disclosure duty covering the material terms of the offer. The second is a cancellation-parity duty. The third is a set of advance reminder notices tied to renewals, price changes, and the end of longer free trials.
None of these concepts is new to subscription lawyers. What is new is the combination of a municipal enforcement body, an uncapped per-violation penalty structure, and a jurisdiction that contains roughly 8.5 million consumers and, by DCWP’s own count, more than 45,000 licensed businesses across 45-plus industries.
The city estimates the rule will save New York consumers between $21.5 million and $162.5 million a year. That range is wide enough to signal how little hard data exists on the size of the subscription-friction problem, but the direction of travel is not ambiguous.
In announcing the package on July 10, DCWP Commissioner Samuel A.A. Levine framed it as closing an era of consumer fleecing, according to the city’s statement. The same announcement cited a Consumer Reports estimate that an average family of four pays roughly $3,200 a year in hidden fees across the economy.
Those two figures do different work. The subscription savings estimate is the city’s own and is specific to this rule. The $3,200 figure is an economy-wide hidden-fee number that belongs to the separate pricing measures announced the same day, and it should not be read as an estimate of subscription harm.
Which businesses does the click-to-cancel rule cover?
The rule reaches businesses that offer, sell, or administer qualifying subscriptions in New York City or to New York City consumers. That phrasing is what makes a municipal rule an e-commerce rule. A direct-to-consumer brand shipping from Ohio does not escape DCWP simply by having no storefront in the five boroughs.
For national retailers, this is the familiar problem of a local rule with extraterritorial reach. The practical compliance answer is almost always the same: build to the strictest applicable standard and apply it everywhere, because geo-fencing a cancellation flow by billing ZIP code creates its own evidentiary mess.
The category breadth is easy to underestimate. Retail subscription revenue no longer sits only in obvious places like paid delivery memberships; it sits in extended warranties sold at checkout, in auto-replenishment on consumables, in premium tiers of loyalty schemes, and in software and service add-ons that retailers increasingly sell alongside hardware.
Each of those was typically built by a different team at a different time, on a different billing system. That fragmentation, rather than any reluctance to comply, is the main reason large merchants miss auto-renewal requirements.
Who is exempt
The rule carves out entities already supervised under other regimes. Exemptions cover businesses regulated by the New York State Department of Financial Services, banks and credit unions, licensed security alarm operators, and sellers of service contracts under New York Insurance Law.
Retailers should read those exemptions narrowly. A merchant that offers a co-branded card through a bank partner is not thereby a bank, and the subscription arm of a retailer is not a DFS-regulated entity because a financing partner is.
The territorial reach question
Where a subscriber lives, where the merchant is incorporated, and where the transaction is processed can all point in different directions. DCWP has not published a bright-line nexus test, which means the conservative reading is the operative one for now.
That uncertainty is one reason the rule will probably change behavior well beyond New York. Merchants tend to standardize cancellation flows once any material market requires a compliant one, the same dynamic that spread California’s requirements nationally after 2025.
What must a retailer disclose before taking a subscription?
The pre-purchase disclosure duty is specific. Before a merchant requests consent or collects billing information, the consumer must see the material terms of the offer, presented clearly.
The required set includes a description of the product or service, the cost, the frequency of charges, any cancellation deadline, and the mechanisms actually available for cancelling. Where a free trial is involved, the trial terms belong in the same disclosure.
The sequencing is the part that breaks existing checkouts. Many subscription funnels present price and cadence on a product page, then collect card details, then surface renewal mechanics on a confirmation screen or in a follow-up email. Under the NYC rule, the disclosure has to precede both consent and the billing-information request.
This mirrors the affirmative-consent architecture that California adopted through AB 2863, signed in September 2024 with its expanded requirements effective July 1, 2025. California made consent to the auto-renewal term its own discrete step rather than something bundled into a general terms acceptance. Merchants that already rebuilt for California are most of the way to the New York City standard.
California also expanded its definitions of automatic renewal and continuous service to bring free trials inside the regime, and added consent record-keeping obligations. That last point is the quiet one: a disclosure duty is only enforceable if the merchant can show what the consumer actually saw, which means retaining the rendered consent screen rather than the current version of it.
For retailers that run frequent checkout experiments, this creates a versioning requirement. A merchant running an A/B test on a subscription upsell needs to know which variant a given subscriber consented to, and on what date, because that is the artifact a regulator or a plaintiff will ask for.
None of the New York City requirements demand a specific layout. What they demand is that the material terms be clear, conspicuous, and positioned ahead of the two commitment points: consent and billing information. Design teams have latitude on how, not on where.
How does the cancellation path test work in practice?
The operative language is that cancellation must be at least as easy to use as the enrollment method, and available through the same medium used to subscribe. Merchants must also offer cancellation through every medium in which they accept consent.
That is a two-part test, and the second half is the one that catches retailers. A brand that sells subscriptions online, in-app, over the phone, and at a store counter has to support cancellation in all four channels, not just the cheapest one.
The same-medium requirement
Online enrollment requires an online cancellation path. This is where the NYC rule departs from New York State’s automatic-renewal statute, General Business Law section 527-a, whose requirements the city rule otherwise largely mirrors.
The distinction reported by practitioners is that the city rule mandates an online cancellation route even for in-person enrollments, whereas the state statute permits a telephone option in more circumstances. For gyms, salons, and specialty retail with counter sign-ups, that is a concrete build.
What counts as obstruction
The rule prohibits obstructing, unreasonably delaying, or refusing to acknowledge cancellation requests. It specifically bars disconnecting consumers who call to cancel, giving false information about how to cancel, and misrepresenting what happens if a consumer cancels.
Retention offers are not banned. A merchant may still present a discount or a pause option. The line is that the retention flow cannot become the obstacle: the consumer must be able to reach completed cancellation without navigating the save attempt as a mandatory gate.
Operationally this is a product decision, not a legal one. A single skippable retention screen with a visible continue-to-cancel control tends to survive scrutiny. A three-step wizard, a required phone call, or a chat queue does not.
The prohibition on misrepresenting the consequences of cancelling is worth separating out, because it catches copy rather than architecture. Warning a subscriber that they will immediately lose access they are in fact contractually entitled to keep until the end of a paid period is a misrepresentation, even if the cancellation button works perfectly.
The same applies to loyalty balances. If cancelling a paid tier does not forfeit accrued points, a retention screen implying otherwise creates exposure under the rule without any change to the cancellation path itself.
What do the renewal and trial reminder clocks require?
The rule attaches three distinct notice windows to three distinct events. Each is expressed as a range rather than a fixed number of days, which gives merchants scheduling latitude but removes the excuse of a single missed send.
| Trigger event | Notice window before the event | Typical retail example |
|---|---|---|
| Renewal of a subscription with a term of one year or more | 15–45 days | Annual paid loyalty tier, annual box plan |
| Material change to terms, including a price increase | 5–30 days | Shipping fee added to a replenishment plan |
| Cancellation deadline following a free trial longer than one month | 3–21 days | 60-day trial of a premium delivery tier |
The annual-renewal notice is the one most likely to be missing from existing retail stacks. Monthly plans generate a receipt every cycle, which functions as a de facto reminder. Annual plans often generate one charge and one receipt twelve months apart, with nothing in between.
The price-increase notice is the one most likely to collide with commercial planning. A merchant that decides in late October to raise a subscription price for November billing has to work backwards from the 5–30 day window, which constrains how late pricing decisions can be finalized.
The trial notice applies only to free trials longer than one month, which means the common 7-day and 14-day trials sit outside it. That gap is likely to shape product design: a 30-day trial and a 31-day trial now carry materially different compliance loads.
Merchants should also note that these are windows, not deadlines. Sending a renewal notice 60 days ahead does not satisfy a 15–45 day requirement, because the notice has to land inside the window to function as a reminder rather than as a forgotten email.
How big are the penalties, and who enforces them?
DCWP holds direct citywide enforcement authority and operates an independent penalty regime, separate from New York State enforcement. That is the structural change: subscription businesses now face a second regulator with its own numbers.
Penalties escalate from $525 for a first violation to $3,500 for a third and subsequent violation. Critically, each statement, description, or omission can constitute a separate violation. Restitution to harmed consumers sits alongside the fines.
| Layer | Instrument | Status as of late September 2026 | Penalty exposure |
|---|---|---|---|
| New York City | DCWP click-to-cancel rule | Effective October 1, 2026 | $525 to $3,500 per violation, plus restitution |
| New York State | General Business Law section 527-a | In force, largely mirrored by the city rule | State remedies, separate from DCWP |
| California | Automatic Renewal Law as amended by AB 2863 | Expanded requirements in force since July 1, 2025 | State enforcement and private litigation risk |
| Federal | FTC Negative Option Rule | Vacated July 8, 2025; ANPRM issued March 2026 | No rule-specific penalties; Section 5 still applies |
The absence of a federal rule does not mean the absence of federal risk. The FTC continues to bring negative-option cases under Section 5 and the Restore Online Shoppers’ Confidence Act, which is how the agency reached its Amazon Prime settlement. Retailers tracking US subscription-trap enforcement through 2026 have watched that docket rather than the rulebook.
The per-violation multiplier is what separates the city regime from a conventional consumer-protection penalty. A single non-compliant disclosure screen is not one violation if each omission on it can be counted separately, and a flow served to every New York City subscriber is not one event.
No enforcement history exists yet, because the rule is not in force. That means the first cases will set the practical scale, and merchants have no benchmark for how aggressively DCWP will aggregate violations. The conservative planning assumption is that it will.
Why is a city writing e-commerce rules at all?
Because the venue for retail consumer-protection rulemaking has shifted downward. When a federal rule is vacated on procedural grounds and its replacement re-enters a multi-year process, states and cities fill the space, and they do it faster.
New York City is not alone in this. Earlier in September, Seattle’s surveillance pricing ordinance went to a full council vote as the first US city attempt to ban algorithmic grocery pricing, with its own penalty schedule and its own definition of covered businesses. Two cities, two first-in-nation retail rules, one quarter.
The pattern creates a compliance geography that no national retailer can serve with a single policy document. It also creates a discovery problem: municipal rules are not indexed in the places where retail legal teams normally look for federal and state developments.
For merchandising and growth teams, the practical consequence is that subscription mechanics have moved from a conversion-optimization question to a jurisdictional one. The flow that maximizes trial-to-paid conversion in one city may be a $3,500-per-violation exposure in another.
There is a second reason cities are moving first, and it is procedural rather than political. The Eighth Circuit vacated the FTC rule for failing to produce an adequate preliminary regulatory analysis, a requirement that binds federal agencies conducting this kind of rulemaking. Municipal agencies operate under lighter analytical obligations, which is part of why DCWP moved from announcement to effective date in under three months.
That asymmetry has a cost for merchants. A federal rule arrives with a long comment record, published cost estimates, and industry guidance. A municipal rule can arrive with a press release and a penalty schedule, which leaves interpretation to practitioners in the interval before the first enforcement action.
How does October 1 fit the wider retail compliance calendar?
October 1 is already a dense date for US retail. The revised FTC settlement order lifting the Amazon Prime refund cap to $200 starts its automatic benefit-tier payments on the same day, which puts the largest subscription business in US retail and a new municipal subscription rule on one calendar line.
That coincidence is useful for framing rather than causally linked. The Prime order is a negotiated federal settlement covering one company; the DCWP rule is a general municipal regulation covering an entire category. But they land together, and they point at the same consumer complaint: enrollment is frictionless and exit is not.
State-level laws taking effect October 1 add to the noise. Several states have unrelated retail-adjacent measures starting that day, including a first-in-the-nation California vehicle return policy. The result is a compliance date that will generate a large volume of search demand and very little clarity.
The revised Prime order is instructive on one point that applies directly to the city rule. Its central mechanism is not a new cancellation flow but automatic remediation: eligible members in a defined benefit-usage band receive payments without filing a claim. Regulators increasingly prefer remedies that do not depend on consumers taking action, which is the same logic behind restitution in the DCWP schedule.
What is coming next: junk fees and the revived FTC rule
The click-to-cancel rule was announced alongside two pricing measures, and only one of them is settled. A hotel junk fees rule took effect on February 21, 2026, with its deposit and hold provisions following on January 22, 2027. A broader, industry-neutral junk fees rule remains a proposal.
The proposed general rule would make it a deceptive and unconscionable trade practice to advertise or display a price without clearly disclosing the total price, defined as the maximum total of all mandatory fees and charges. Government taxes and reasonable shipping costs sit outside the definition.
The record-keeping trap in the junk fees proposal
One provision deserves attention from anyone who charges a mandatory fee. The proposal would require businesses to keep records substantiating the basis for each fee, and failure to produce those records would create a presumption that DCWP’s allegations are true.
A rebuttable presumption that flips on a document request is an unusual enforcement design for a municipal rule. It shifts the practical burden onto the merchant before any adjudication of the underlying fee. DCWP held its public hearing on the proposal on August 7, 2026, with written comments due the same day.
If adopted, that rule would converge with the direction European and UK enforcement has already taken on all-in checkout pricing across UK and EU retail, where total-price display is now the baseline rather than the aspiration.
Where the FTC actually is
The Commission submitted a draft advance notice to the Office of Management and Budget in January 2026, announced the ANPRM on March 11, 2026, published it in the Federal Register on March 13, and closed comments on April 13. An ANPRM is the earliest formal stage: the Commission may proceed to a proposed rule, propose narrower amendments, or take no further action.
That sequencing means no federal negative-option rule is plausible before 2027 at the earliest. Meanwhile the same agency is advancing separate work on pricing practices, and merchants tracking the FTC personalized pricing standard are watching a second federal thread that could reach checkout mechanics from a different direction.
What should retail and e-commerce teams do before October 1?
The compliance work splits cleanly into four workstreams, and none of them requires a legal opinion to start.
| Obligation | What has to change | Most common gap in retail stacks |
|---|---|---|
| Pre-consent disclosure | Material terms shown before consent and before billing capture | Renewal mechanics disclosed on the confirmation screen instead |
| Cancellation parity | A cancellation route in every medium that accepts consent | In-store and phone enrollments with online-only cancellation, or the reverse |
| Anti-obstruction | Completable cancellation without a mandatory save gate | Multi-step retention wizards and chat-queue routing |
| Notice clocks | Three scheduled sends tied to renewal, price change, and trial end | Annual plans with no mid-term communication at all |
| Consent records | Retention of what each subscriber actually saw and agreed to | Checkout experiments with no variant-level consent logging |
- Inventory every recurring charge. Paid loyalty tiers, replenishment plans, extended warranties sold directly, premium delivery, and any trial that converts. Teams routinely miss trials owned by growth rather than by the subscription product manager.
- Audit the enrollment sequence. Confirm that description, cost, charge frequency, cancellation deadline, and cancellation mechanisms all appear before consent and before billing details are requested.
- Map channel parity. List every medium in which consent is accepted, then confirm a cancellation route exists in each. In-person and phone enrollments are the usual gaps.
- Build the three notice clocks. Annual renewal at 15–45 days, material change at 5–30 days, post-trial cancellation deadline at 3–21 days. Annual plans and free trials longer than a month are the priority.
A fifth item is worth adding for anyone with a retention flow: instrument it. If a consumer who starts a cancellation cannot finish it in the same session without leaving the channel, that is the finding a regulator will make, and session analytics will show it before DCWP does.
Finally, the restitution component changes the calculus on remediation. Fines scale with violations, but restitution scales with subscribers billed after a consumer tried to cancel. The cheaper of the two problems to fix is the one that has a deadline of October 1.
Teams that already rebuilt for California in 2025 should treat this as a delta exercise rather than a programme. The material differences to check are the channel-parity breadth, the online route for in-person enrollments, and the three specific notice windows, which are not identical to California’s.
Teams that did not rebuild for California have a harder three-day problem, and the realistic sequence is to fix the cancellation path first. Disclosure ordering and notice scheduling are both remediable after October 1 without continuing to accrue the violation that a blocked cancellation generates every time a subscriber tries to leave.
Frequently asked questions
When does the NYC click-to-cancel rule take effect?
October 1, 2026. DCWP adopted the final rule on July 10, 2026, giving businesses just under three months of lead time.
Does the rule apply to retailers with no physical presence in New York City?
The rule reaches subscriptions offered in New York City or to New York City consumers, so a merchant selling to residents of the five boroughs can be covered without a local storefront. DCWP has not published a bright-line nexus test, so the conservative reading applies.
What are the penalties for non-compliance?
$525 for a first violation, escalating to $3,500 for a third and subsequent violation, assessed per violation. Each statement, description, or omission can count separately, and restitution to harmed consumers sits alongside the fines.
Is there still a federal click-to-cancel rule?
No. The Eighth Circuit vacated the FTC’s amended Negative Option Rule on July 8, 2025 for procedural failures, including an inadequate preliminary regulatory analysis. The FTC issued an advance notice of proposed rulemaking in March 2026, which is the earliest formal stage of a replacement.
How is the NYC rule different from New York State law?
The requirements largely mirror General Business Law section 527-a. The practical differences reported by practitioners are that the city rule requires an online cancellation route even for in-person enrollments, and that it adds a second enforcement body with higher per-violation penalties.
Are retention offers and save attempts still allowed?
Yes. Merchants may present retention information such as a discount or a pause option. What the rule prohibits is using that flow to obstruct, unreasonably delay, or effectively refuse a cancellation request.
Which businesses are exempt?
Entities regulated by the New York State Department of Financial Services, banks and credit unions, licensed security alarm operators, and sellers of service contracts under New York Insurance Law. Retailers with bank or financing partners are not exempt by association.
Does the separate junk fees rule apply on October 1 as well?
No. The hotel-specific junk fees rule took effect on February 21, 2026, with deposit and hold provisions following on January 22, 2027. The broader industry-neutral junk fees rule remains a proposal following an August 7, 2026 public hearing.
How much is the rule expected to save consumers?
The city estimates annual savings of $21.5 million to $162.5 million for New York consumers. DCWP also cited a Consumer Reports estimate that an average family of four pays roughly $3,200 a year in hidden fees across the economy.