FTC Restarts Negative Option Rulemaking After Eighth Circuit Vacatur; Enforcement Under ROSCA Continues as Potential Scope of New Rule Remains in Flux
Client Alert | February 27, 2026
Until the scope of any new proposed rule becomes clear, companies should expect that cancellation design, consent flows, and subscription disclosures will remain under close regulatory scrutiny, including through active enforcement under ROSCA and Section 5 of the FTC Act.
The Federal Trade Commission has renewed its efforts to promulgate a nationwide rule governing subscription cancellation practices, following the U.S. Court of Appeals for the Eighth Circuit’s vacatur of the FTC’s prior “Click-to-Cancel” Rule in July 2025. The vacated rule would have imposed sweeping requirements on subscription and autorenewal programs, extending beyond existing statutory obligations under the Restore Online Shoppers’ Confidence Act (ROSCA). The Eighth Circuit’s ruling came in a case brought by Gibson Dunn on behalf of industry petitioners. Agreeing with Gibson Dunn’s arguments, the Eighth Circuit invalidated the Click-to-Cancel Rule in its entirety, holding that the FTC failed to comply with the procedural requirements of its Magnuson-Moss rulemaking authority. In response to the Eighth Circuit’s ruling, on January 30, 2026, the FTC submitted a draft Advance Notice of Proposed Rulemaking (ANPRM) to the Office of Information and Regulatory Affairs (OIRA), formally initiating a new rulemaking process.
Bottom Line: Although the July 2025 vacatur halted implementation of a sweeping trade regulation rule, it did not reduce federal scrutiny of subscription practices. Any renewed rulemaking proposal must address the deficiencies identified by the Eighth Circuit, including required economic analysis. Until the scope of any new proposed rule becomes clear, companies should expect that cancellation design, consent flows, and subscription disclosures will remain under close regulatory scrutiny, including through active enforcement under ROSCA and Section 5 of the FTC Act.
Key Takeaways
- The Eighth Circuit vacated the prior Click-to-Cancel Rule in litigation brought by Gibson Dunn, requiring the FTC to comply with Magnuson-Moss procedural safeguards in any renewed rulemaking effort.
- The FTC has now initiated a new rulemaking effort.
- The FTC continues to pursue subscription-related conduct under its existing authority, including ROSCA and Section 5 of the FTC Act.
- State autorenewal statutes—and state enforcement of those laws—continue to expand, increasing compliance complexity.
The Eighth Circuit’s Vacatur
In October 2024, the FTC adopted a revised Negative Option Rule—commonly referred to as the Click-to-Cancel Rule—that would have imposed sweeping requirements on companies offering subscription and autorenewal programs. The rule extended beyond online transactions and included, among other things:
- A requirement for separate, express consent to the negative option feature;
- Broad prohibitions on misrepresentations concerning any material aspect of the transaction;
- Restrictions on certain “save” or retention attempts during cancellation; and
- Cancellation mechanisms that were at least as easy as the method used to enroll.
These requirements went beyond the baseline obligations imposed by ROSCA, which applies to online transactions and focuses on clear disclosure, informed consent, and a simple mechanism to stop recurring charges.
In July 2025, the Eighth Circuit vacated the Click to Cancel Rule after petitioners represented by Gibson Dunn demonstrated that the FTC failed to conduct a preliminary regulatory analysis that was required because the Rule’s economic impact exceeded the statutory threshold for major rules under Section 18 of the FTC Act. The court held that the FTC’s later regulatory analysis could not cure that defect. The decision reinforces that FTC trade regulation rules must strictly comply with the procedural and economic requirements of the Magnuson-Moss framework, particularly where projected impact is substantial.
FTC’s Renewed Rulemaking
On January 30, 2026, the FTC submitted a draft ANPRM on negative option practices to OIRA for review pursuant to Executive Order 14215, which requires White House review of independent agency rulemakings. If cleared, the FTC will publish the ANPRM in the Federal Register, opening a new public comment process.
The text of the ANPRM has not yet been released publicly. As a result, it remains unclear whether the FTC intends to re-propose a rule comparable in scope to the vacated Click-to-Cancel Rule or pursue a different approach. In light of the Eighth Circuit’s ruling, the Commission may seek to advance a more tailored proposal centered on defining a “simple” or “easy” cancellation method, rather than re-proposing the broader prohibitions contained in the vacated rule.
The renewed ANPRM confirms continued federal attention to subscription and cancellation practices.
ROSCA Enforcement Remains Active
Even without a new rule in effect, the FTC continues to regulate subscription practices through enforcement under ROSCA and Section 5 of the FTC Act.
FTC leadership has publicly emphasized that unwanted subscriptions and cancellation obstacles remain enforcement priorities. Statements by Chair Andrew Ferguson and Bureau of Consumer Protection Director Chris Mufarrige underscore the FTC’s continued focus on subscription enrollment and cancellation practices under existing statutory authority.
ROSCA requires companies offering online negative option features to clearly and conspicuously disclose all material terms before obtaining a consumer’s billing information, secure the consumer’s express informed consent to the subscription, and provide a simple mechanism to stop recurring charges. These statutory standards remain fully operative and continue to serve as the basis for enforcement actions.
Recent cases reflect a consistent focus on whether subscription programs adequately disclose automatic renewal and fee terms before enrollment, whether consent mechanisms demonstrate informed agreement to recurring charges, and whether cancellation processes introduce friction that could be characterized as unreasonably difficult.
Over the past two years, the FTC and the U.S. Department of Justice (on the FTC’s behalf) have brought actions across multiple industry sectors—including e-commerce, digital services, ed-tech, and subscription-based consumer products—challenging enrollment disclosures, consent flows, and cancellation design. Several matters have resulted in substantial monetary settlements, including a $7.5 million resolution involving alleged concealment of cancellation options, and a $60 million settlement concerning renewal disclosures and refund practices.
The scale of these settlements underscores a central reality: the FTC is already using its existing statutory authority under ROSCA to pursue the same core subscription practices targeted by the vacated Click-to-Cancel Rule.
For businesses, the practical takeaway is that the vacatur of the Click-to-Cancel Rule has not reduced scrutiny of subscription models. The FTC’s enforcement posture reflects continued attention to disclosure, consent, and cancellation design—the very issues likely at the center of the renewed rulemaking effort.
State Law Developments
State legislatures continue to update and expand autorenewal statutes. States including California, Colorado, Minnesota, and New York have strengthened disclosure, reminder, and cancellation requirements. In some jurisdictions, state requirements exceed federal baseline standards under ROSCA.
In addition, like the FTC, states have been active in enforcing their state autorenewal laws. For example, in August, the California Automatic Renewal Task Force—made up of several California District Attorney’s offices—announced a $7.5 million settlement with a meal delivery service to resolve claims under California’s Autorenewal Law. In November 2025, 34 states announced a $4.8 million settlement with an online clothing retailer related to the retailer’s paid membership program.
For businesses operating nationally, compliance therefore requires navigating both evolving federal enforcement standards and increasingly prescriptive state mandates.
Implications for Businesses
Companies offering negative option features should:
- Review subscription disclosures for clarity and prominence;
- Confirm consent flows meet ROSCA’s express informed consent standard;
- Evaluate cancellation pathways to ensure they are straightforward and defensible;
- Assess retention or “save” mechanisms to ensure they do not functionally impede a consumer’s ability to cancel through a simple mechanism; and
- Monitor both federal rulemaking developments and state legislative changes.
Conclusion
The FTC’s renewed rulemaking effort, coupled with ongoing ROSCA enforcement and expanding state regulation and enforcement, underscores that subscription compliance remains a significant regulatory risk for businesses. Companies should evaluate their subscription practices accordingly. Gibson Dunn lawyers are available to assist with compliance strategy, enforcement defense, and engagement in the rulemaking process.
Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding the issues discussed in this update. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any of the following leaders and members of the firm’s Consumer Protection, Administrative Law & Regulatory, Antitrust & Competition, or Privacy, Cybersecurity & Data Innovation practice groups:
Consumer Protection:
Gustav W. Eyler – Washington, D.C. (+1 202.955.8610, geyler@gibsondunn.com)
Svetlana S. Gans – Washington, D.C. (+1 202.955.8657, sgans@gibsondunn.com)
Ashley Rogers – Dallas (+1 214.698.3316, arogers@gibsondunn.com)
Administrative Law & Regulatory:
Stuart F. Delery – Washington, D.C. (+1 202.955.8515, sdelery@gibsondunn.com)
Eugene Scalia – Washington, D.C. (+1 202.955.8673, escalia@gibsondunn.com)
Helgi C. Walker – Washington, D.C. (+1 202.887.3599, hwalker@gibsondunn.com)
Antitrust & Competition:
Rachel S. Brass – San Francisco (+1 415.393.8293, rbrass@gibsondunn.com)
Svetlana S. Gans – Washington, D.C. (+1 202.955.8657, sgans@gibsondunn.com)
Kristen C. Limarzi – Washington, D.C. (+1 202.887.3518, klimarzi@gibsondunn.com)
Cindy Richman – Washington, D.C. (+1 202.955.8234, crichman@gibsondunn.com)
Privacy & Cybersecurity:
Ryan T. Bergsieker – Denver (+1 303.298.5774, rbergsieker@gibsondunn.com)
Cassandra L. Gaedt-Sheckter – Palo Alto (+1 650.849.5203, cgaedt-sheckter@gibsondunn.com)
Vivek Mohan – Palo Alto (+1 650.849.5345, vmohan@gibsondunn.com)
© 2026 Gibson, Dunn & Crutcher LLP. All rights reserved. For contact and other information, please visit us at www.gibsondunn.com.
Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials. The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel. Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.