The FTC Negative Option Rule Is Back in 2026: 5 Things Every Subscription Business Should Already Be Recording
The 8th Circuit killed Click-to-Cancel. The FTC reopened rulemaking in March. Smart subscription merchants are building the evidence now, not after the next rule drops.
The FTC Negative Option Rule was vacated by the 8th Circuit in 2025 and the FTC reopened rulemaking on March 11, 2026. Four core requirements from the vacated Click-to-Cancel rule are near-certain to return: clear and conspicuous disclosure, affirmative express consent, easy cancellation, and no misrepresentation. The smart play is to capture tamper-evident records of all four interactions now, so whatever the new rule looks like, you already have a year of defensible history.
A customer signs up for a 14-day free trial of your subscription product. Eighteen months later, she files a chargeback for every billing cycle since month two, claiming she “never agreed” to be charged. The issuing bank asks for proof of enrollment. Your team produces the terms of service, the sign-up page URL, and a line in a database that says consented = true.
The issuer sides with the cardholder. The chargebacks stick. A week later, you get a letter from a state attorney general asking for your negative option disclosures and consent records. The FTC’s FTC negative option rule subscription enforcement environment is still active, even without a finalized rule. You are now defending a policy rather than a contract.
If you run a subscription, auto-renewal, continuity program, or free-to-paid trial business in 2026, you are operating in a rule gap. The old federal Negative Option Rule remains on the books. The FTC’s 2024 amendments are gone. The new rulemaking is underway. Section 5 enforcement has not slowed down. And card networks have quietly tightened their own expectations for subscription dispute evidence. This is the moment to get your records ready, not react.
What happened: the 8th Circuit, the ANPRM, and what comes next
A short timeline:
The FTC finalizes amendments to the Negative Option Rule, widely known as the Click-to-Cancel rule. Clear and conspicuous disclosure, affirmative consent, simple cancellation, and no misrepresentation become uniform requirements across subscriptions, auto-renewals, and trial-to-paid offers.
The 8th Circuit vacates the 2024 amendments on procedural grounds. The underlying 1973 Negative Option Rule remains in force, but the 2024 expansions are set aside.
The FTC issues an Advance Notice of Proposed Rulemaking, reopening negative option rulemaking. Comments close April 13, 2026.
No finalized replacement rule. Section 5 enforcement of unfair and deceptive practices continues. State “Click to Cancel” laws (California, Colorado, New York, and others) remain in force and are actively enforced.
Reading the room: the FTC’s March ANPRM signals a return to substantially the same substantive requirements the 8th Circuit objected to on process. The commission’s stated priorities include difficult cancellation processes, unlawful retention tactics, and enrollment flows that obscure material terms. These are the same themes that animated the 2024 rule.
There is no safe reading where subscription compliance gets easier in 2026 or 2027. The federal rule is likely to return in similar form. State rules already cover most large subscription bases. And card networks have made dispute representment harder for subscriptions without strong enrollment evidence.
The four requirements likely to return
The four pillars of the vacated Click-to-Cancel rule are also the four themes that show up repeatedly in state laws, network dispute rules, and FTC Section 5 cases. If you build your evidence program around them now, you will be ready for whatever federal rule lands.
Clear and conspicuous disclosure
Material terms, price, billing frequency, renewal cadence, and cancellation path must be unavoidable at enrollment. Not linked. Not buried below the fold. Not behind a tooltip.
Affirmative express consent
A consumer must take an affirmative action that is specific to the negative option feature. Pre-checked boxes and “by continuing you agree” language sitting adjacent to an unrelated button do not count.
Simple, easy-to-use cancellation
Cancellation must be at least as easy as enrollment. If the consumer enrolled online in two clicks, they should be able to cancel online in two clicks.
No misrepresentation
Claims about price, savings, renewal, free trials, guarantees, and cancellation must match the actual offer. Enforcement actions have consistently focused on the gap between marketing language and the billed reality.
The 5 interactions to record starting today
Every subscription lifecycle has five moments where a regulator, a card network, or a plaintiff’s attorney can ask “what did the consumer see and do?” If you cannot answer with a reproduction of the interaction, you are exposed.
The enrollment disclosure
What did the consumer see at the moment of sign-up? The material terms, the pricing, the renewal cadence, the cancellation path. Capture the rendered page, not a reference to a page that may have changed.
The consent click
Which button did the consumer click? In what state were any consent checkboxes? Was the click from the same session as the disclosure above? Capture the interaction state, not just the server-side result.
The renewal notice
If you send pre-renewal notifications, capture when they were sent, to which address, and what they said. If you do not send them, be prepared to explain why under state laws that require them.
The cancellation attempt
When the consumer clicks “cancel,” record the exact path they followed, any retention offers presented, and the final cancellation confirmation. A consumer who “tried to cancel three times” is one of the most dangerous stories a regulator hears.
The dispute origination
When a chargeback lands, you should be able to tie it back to the enrollment and cancellation records in one query. A disconnected evidence trail is the single fastest way to lose a representment.
Most subscription compliance stacks capture interaction 1 (enrollment disclosure) and interaction 5 (dispute handling). The gap is interactions 2 through 4. Without the consent click state, a renewal notice audit trail, and a cancellation path record, your enrollment evidence sits in isolation and your cancellation story is built from customer service notes.
Why “we have terms” is not evidence
The most common answer subscription merchants give when asked about negative option evidence is some version of “we have terms of service, and the consumer agreed to them at signup.” That is necessary. It is not sufficient.
Regulators and card networks are asking a more specific question: did this consumer see these terms at this moment, and did they take an affirmative action that was specific to the negative option feature? A link to a terms page, a database flag, and a timestamp do not answer that question. They answer a smaller one: “this account has a row.”
A subscription dispute is not won by the existence of your terms. It is won by your ability to reproduce the moment the consumer accepted them.
The structure of the expected federal rule, the live state laws, and the current network representment requirements all converge on the same expectation: a reproducible record of the consumer’s interaction with the negative option disclosure.
| Question a regulator or issuer asks | What “we have terms” delivers | What a captured interaction delivers |
|---|---|---|
| What disclosure did this consumer see? | Current live version of the page | Rendered page as shown to the specific consumer |
| What action did they take? | A database flag set to true | Click-level interaction state with before and after |
| When did it happen? | A server timestamp | An externally verifiable, tamper-evident timestamp |
| Was it actually this person? | An account ID | IP, user agent, and bot-detection score on the session |
| What happened at cancellation? | Customer service notes | Full path record including retention offers and confirmation |
Building a defensible record for 2027 enforcement
The reason to act now, while federal rulemaking is still open, is leverage. If a new rule finalizes in late 2026 or 2027, merchants who started capturing evidence in April 2026 will be able to demonstrate a year or more of consistent, tamper-evident records. Merchants who wait will be starting from zero with an active enforcement environment.
There is also a second lever most subscription teams underweight: card network dispute outcomes. Visa’s Compelling Evidence 3.0 framework and Mastercard’s Dispute Resolution Initiative both favor merchants who can produce structured, consistent, session-linked evidence of enrollment and cancellation. The exact same record that satisfies a future FTC rule also wins more chargebacks today.
The practical retention target is four to five years of enrollment, renewal, cancellation, and dispute records for every subscriber. That is long enough to cover federal and state statutes of limitations, late-arriving chargebacks, and any enforcement inquiry that reaches back into the 2026 to 2027 window.
How digital interaction evidence protects subscription merchants
Capturing all five interactions with the rigor a regulator or network expects is not a manual exercise. It is a platform problem. You need session-level capture of the rendered page, the interaction state, the device and network context, and a tamper-evident timestamp, applied consistently across enrollment, renewal notice delivery, and cancellation.
This is what Evidora was built for. A single line of code on your checkout, renewal, and cancellation pages captures a court-ready record of every consumer interaction, with the exact disclosure language shown, the consent action taken, the device context, and a trusted timestamp. Retain what you need for four or five years, let the rest expire, and produce a complete reconstruction on demand when a chargeback, FTC inquiry, or state enforcement letter arrives.
For background on the live FTC rulemaking, see the FTC’s Negative Option Rule page and the March 2026 ANPRM press release. For the payments side of subscription disputes, see our guide to what actually wins chargeback disputes and the Evidora product overview.
Frequently asked questions
Is the FTC’s Click-to-Cancel rule currently in effect?
No. The 8th Circuit vacated the FTC’s 2024 negative option amendments in 2025. The FTC reopened rulemaking in March 2026 with an Advance Notice of Proposed Rulemaking. A new rule has not been finalized, but Section 5 enforcement of unfair and deceptive practices continues in the interim.
What is the FTC Negative Option Rule?
The Negative Option Rule governs marketing programs where a consumer’s silence or inaction is treated as acceptance of goods, services, or a continued subscription. It covers auto-renewals, continuity plans, free-to-paid trials, and prenotification negative option features.
Should subscription merchants wait for a new rule before changing anything?
No. Waiting is the expensive path. Four requirements from the vacated 2024 rule are near-certain to return in some form: clear and conspicuous disclosure, affirmative express consent, easy cancellation, and no misrepresentation. Capturing evidence of all four now means you will already have a year of defensible records when the next rule takes effect.
What counts as clear and conspicuous disclosure?
Disclosure of material terms, including price, billing frequency, renewal cadence, and cancellation process, that is unavoidable at the point of enrollment. Fine print buried below the fold or linked through multiple clicks is consistently treated as insufficient by both the FTC and state attorneys general.
Does having terms of service protect me from a dispute?
Having terms is necessary but not sufficient. The question a regulator or card issuer will ask is whether the specific consumer saw and affirmatively accepted the specific terms in force at the moment of enrollment. Without a tamper-evident record of that interaction, you are left defending a policy rather than a contract.
How long should subscription consent records be retained?
A practical floor is the statute of limitations for the relevant consumer protection laws, which is typically four years. Many subscription merchants retain for five years to account for state variations and late-arriving chargebacks. Records should cover enrollment, renewal notices, cancellation attempts, and dispute origination.
How does Evidora support negative option compliance?
Evidora captures tamper-evident records of each checkout and subscription interaction, including the disclosures shown, the consent action taken, the device context, and a trusted timestamp. When a dispute or enforcement inquiry arrives, you can reproduce exactly what the consumer saw and did at enrollment, renewal, or cancellation.
Turn every subscription interaction into a defensible record
Evidora captures court-ready evidence of every enrollment, renewal notice, and cancellation. One line of code. Retain what matters, expire what does not, produce a reproduction when an inquiry or chargeback arrives.
See how it works →