The FTC's "Click to Cancel" Rule Is Dead. Visa and Mastercard's Rules Aren't.

In July 2025, a federal appeals court struck down the FTC's "Click to Cancel" rule — the regulation that would have forced every subscription business to make cancellation as easy as signup. For a lot of recurring billing operators, paysites included, that read like a reprieve. It wasn't. The court vacated the rule on a narrow procedural technicality, not because it disagreed with the substance, and the FTC has already started rebuilding it. More importantly, the rule everyone was watching was never the one actually shaping day-to-day recurring billing compliance in the first place. That's been sitting inside Visa's and Mastercard's own rulebooks for years, and it never depended on the FTC at all. And for merchants operating in the EU, there's a second layer worth understanding too: while the US rule stumbled in court, Europe's own cancellation-button laws didn't slow down at all — they expanded.

What Actually Happened to Click-to-Cancel

On July 8, 2025, the Eighth Circuit Court of Appeals vacated the FTC's amended Negative Option Rule, just days before it was set to take effect. The court's reasoning was procedural: the FTC had failed to conduct a preliminary regulatory analysis required for rules with an economic impact above a statutory threshold, and that defect couldn't be fixed after the fact. The decision said nothing about whether the FTC has authority to regulate negative-option billing, or whether the rule's substance was reasonable — it was a paperwork failure, not a policy defeat.

The FTC didn't let it go. On January 30, 2026, the agency submitted a new proposal to the White House regulatory review office, restarting the rulemaking process with the missing analysis this time. And in the meantime, the FTC has kept bringing enforcement actions against negative-option practices under its existing authority — Section 5 of the FTC Act and the older ROSCA statute — effectively applying the same standards the vacated rule would have required, just through a different legal path. Layered on top of that, several states have their own automatic-renewal laws already in force or landing soon, including Connecticut's taking effect July 1, 2026. The federal rule's court loss didn't create an open field.

The Vacated Rule's Standards Didn't Disappear Either

Worth understanding how the FTC has kept operating in the gap: it has continued bringing cases against negative-option practices by alleging the same underlying conduct — inadequate disclosure of material terms, charging without clear consent, cancellation flows made deliberately difficult — as violations of Section 5's ban on unfair or deceptive practices, rather than as violations of the vacated rule itself. The agency's action against NextMed is a clear example: the complaint tracked the three core requirements of the Click-to-Cancel rule almost exactly, just filed under different legal authority. A merchant reading "the rule was struck down" as "these practices are now fine" is drawing the wrong conclusion from a right fact.

The Rules That Never Went Away

While the FTC rule was making headlines, Visa and Mastercard's own recurring billing requirements kept running in the background, completely independent of whatever happens in federal court. Visa's subscription and free trial rules date back to 2011, with major updates layered on since 2020. Mastercard implemented its own significant modifications effective October 11, 2022. Neither depends on the FTC rule existing, and neither went anywhere when it was vacated.

The requirements are specific. Merchants must disclose the subscription terms — price, billing frequency, and any trial period — clearly at the point of payment collection, and capture the cardholder's affirmative acceptance before completing the order. Every recurring charge needs a confirmation receipt sent to the cardholder. For trials longer than seven days, a reminder notice has to go out three to seven days before the trial ends and billing begins; for subscriptions running six months or longer, that renewal reminder window extends to seven to thirty days ahead. The first charge after a trial period has its own specific requirement: the merchant descriptor on that transaction must include trial-related language — "trial," "trial period," or similar — so it's recognizable on the cardholder's statement, and the transaction has to carry a Recurring Payment Indicator flag even when the amount differs from the trial price.

The Fines Are Real, and They're Not the Only Cost

Card network non-compliance isn't a warning letter. Visa can fine a merchant up to $50,000 per violation; Mastercard's penalty runs up to $20,000 per violation. Both networks also run ongoing merchant monitoring specifically for this — tracking the recurring payment indicator and statement descriptor, watching for excessive disputes tied to subscription billing, and using mystery shopping and transaction review to catch non-compliant checkout flows directly, not just react to complaints.

And the fine is rarely the full cost. A cardholder confused by a trial-to-paid conversion they didn't clearly understand is a cardholder likely to dispute the charge rather than contact support first — which means the same compliance gaps that trigger a card network fine also tend to generate the chargebacks that push a merchant's ratio toward VAMP or Mastercard's own monitoring thresholds. For a recurring billing business, weak trial disclosure doesn't just risk a penalty. It quietly generates the dispute volume that makes every other part of the account harder to manage.

Europe Didn't Slow Down — It Sped Up

Here's the part of this story that matters most for MMG's own audience: while the US federal rule was getting vacated in court, the EU was moving in exactly the opposite direction. Directive (EU) 2023/2673 — which amends the existing Consumer Rights Directive — became binding across the entire EU on June 19, 2026, requiring every online seller to provide a dedicated, clearly labelled electronic button letting consumers exercise their 14-day right of withdrawal directly on-site, with no phone calls, no buried menus, and no forced redirect to customer support. Unlike the FTC's rule, this one didn't get struck down. It's in force right now.

Germany got there even earlier, and went further. Its own cancellation-button law — commonly called the "Kündigungsbutton", codified in Section 312k of the German Civil Code — has applied to ongoing contracts like subscriptions and memberships since July 2022, years before the new EU-wide rule existed. A second provision, Section 356a BGB, extends the same logic specifically to the 14-day withdrawal button required by the new EU directive, with a transposition deadline of June 19, 2026. The penalties are not symbolic: violations can draw fines up to €50,000, or up to 4% of annual turnover for larger companies — in the same range as Visa's own maximum penalty, and potentially steeper. France has a comparable obligation under Article L215-1-1 of its Consumer Code.

One detail worth flagging directly for merchants who assume incorporating elsewhere in the EU provides some distance from German rules: it doesn't reliably. In January 2026, the Regional Court of Karlsruhe confirmed that Germany's cancellation-button law can reach digital service providers established in other EU member states, not just companies headquartered in Germany. For a merchant serving German customers from anywhere in the EU, "we're not a German company" is not the same as "this law doesn't apply to us."

Why This Matters More for Paysites Than Almost Anyone

For a lot of businesses, trial-to-paid conversion is one billing event among many. For paysites, it's close to the entire model — the free or low-cost trial that converts into a recurring membership is the core mechanic the business runs on, not an edge case bolted onto standard checkout. That means the specific rules around trial disclosure, the post-trial descriptor requirement, and the Recurring Payment Indicator aren't a compliance footnote for this vertical. They apply to essentially every paying customer a paysite acquires.

It's also worth building in protection against the quieter form of revenue loss that has nothing to do with disputes: involuntary churn from expired or declined cards. Visa Account Updater and its Mastercard equivalent exist specifically to refresh stored card details automatically before a renewal attempt fails — a subscriber whose card expired shouldn't have to notice and re-enter it manually for billing to continue smoothly. Combined with sensible retry logic on soft declines, this is one of the highest-leverage, least-discussed levers a recurring billing business has for protecting revenue that compliance alone won't touch.

What This Means Going Into TES Season

The lesson from the Click-to-Cancel saga isn't that subscription compliance pressure eased up. It's that the pressure was never concentrated in one place to begin with — US federal rulemaking is one track, US state law is a second, card network requirements are a third that runs independently of both, and EU cancellation-button law is a fourth that's actively expanding while the American one stumbled. For paysite operators and recurring billing merchants heading into TES this year, especially those serving EU customers, the practical takeaway is straightforward: a US federal rule getting vacated is not the same as the compliance bar dropping anywhere else, and the checklist that actually matters day to day has been sitting in Visa's and Mastercard's rulebooks — and, increasingly, in EU and German law — the whole time.

MMG Corporation works with high-risk, recurring billing merchants across EU markets on exactly this kind of card network and regional compliance. If you're not certain your trial, renewal, and cancellation flow actually matches Visa's, Mastercard's, and the EU's current requirements, that's worth checking before an audit or a fine forces the question.

This article was researched and written with the help of AI tools as part of our content process, and reviewed and fact-checked by the MMG team before publication.