NYC Click to Cancel Rule: A Compliance Checklist for SaaS and Apps

New York City's Click to Cancel rule took effect on October 1, 2026. It applies to any business that sells automatically renewing or continuous subscriptions to people in New York City, wherever the business itself is based. If someone signs up online, you have to let them cancel online, about as easily as they signed up. You also have to show the key terms before you ask for payment and send reminders on set schedules. Fines start at $525 per violation and rise to $3,500 for repeat violations, and the city can make you refund what you charged after the customer first tried to cancel.

For most self-serve SaaS products, AI apps and consumer subscriptions, this is a product and engineering job more than a legal one. Below: what the rule says, where the law firm summaries disagree, and a checklist you can work through in a sprint. This is a summary of public sources, not legal advice. If NYC customers are a meaningful share of your revenue, have counsel read the rule text.

What the NYC Click to Cancel rule actually requires

The Department of Consumer and Worker Protection (DCWP) adopted the rule on July 10, 2026. Skadden calls it "the first municipal rule of its kind in the U.S." According to the city's announcement, the work started with Mayor Zohran Mamdani's Executive Order 10, signed on January 5, which told DCWP to prioritise deceptive subscription practices. The rule covers automatic renewals and continuous-service offers, and it specifically calls out free trials that convert into paid plans.

The core obligations, drawn from Skadden, Davis+Gilbert and Subscription Insider:

1. Show the material terms before you ask for consent or payment details. That means the amount and frequency of charges, the deadline to cancel before the next charge, and how to cancel. For a free trial or introductory price, you also have to say how and when the price changes.
2. Make cancellation as easy as signup, through the same channel. If someone subscribed on your website, they must be able to cancel on your website. Businesses that enroll people in person must also offer an online way to cancel, such as a website or email.
3. Don't get in the way. The rule names specific practices, including hiding cancellation instructions, imposing unreasonable conditions, hanging up on people who call to cancel, ignoring cancellation requests, giving false information about how to cancel or what cancelling means, and unreasonably delaying the process.
4. Send reminders on time before renewals, material changes and trial conversions (windows in the table below).
5. Treat unsolicited products as gifts. Anything shipped without the consumer's agreement is an unconditional gift, and you can't make people pay to send it back.

Retention offers are still allowed, with limits

Many founders will want to know this. Subscription Insider and Davis+Gilbert both say retention offers are permitted as long as they don't obstruct or unreasonably delay the cancellation. Davis+Gilbert's advice: keep save flows short, make them easy to skip, and never let one sit between the customer and a finished cancellation.

Who is covered, and who isn't

Location. Subscription Insider reports that DCWP's authority covers companies doing business with NYC residents, including companies outside the city. Davis+Gilbert says compliance is triggered by the consumer being in New York City, so a Berlin startup with Brooklyn subscribers is in scope.

Exemptions. Skadden lists the exempt categories: banks, credit unions, entities regulated by the NY Department of Financial Services, NY-licensed security alarm operators, and sellers of service contracts under NY Insurance Law. DCWP specifically declined to exempt FCC-regulated wireless and telecom providers, according to Davis+Gilbert.

B2B. None of the summaries we read addresses B2B contracts directly. The rule is written around consumers, so an annual enterprise contract signed by a procurement team is probably not the target. Our reading, not a legal conclusion: the grey area is the self-serve "Pro" plan an individual buys on a personal card. Many AI tools and prosumer SaaS products sell exactly that way. If your checkout doesn't distinguish business buyers from consumers, the safe assumption is that the rule applies.

Notice windows, penalties and how enforcement works

Reminder notice windows

The sources describe the renewal-notice trigger differently. Skadden says it applies to plans with an initial paid term of at least one year that renew for at least six months. Loeb & Loeb describes it as initial terms of six months or more. If you sell semi-annual plans, check the rule text or ask counsel before relying on either. The windows also don't line up with other states'. Skadden notes that Florida, for example, requires notice 30 to 60 days before the cancellation deadline.

A practical point for monthly plans: a 7- or 14-day trial is under a month, so the trial-reminder requirement as Skadden describes it wouldn't apply. A 30-day trial sits right on the boundary. Sending a reminder 3–21 days before conversion anyway costs almost nothing and fits most state regimes.

Penalties

According to Davis+Gilbert and Subscription Insider:

The per-violation amounts look small, but they add up. Each deceptive statement, description or omission can count as a separate violation, and DCWP can also seek restitution of everything charged after the consumer's first cancellation attempt. If your flow quietly failed for three months, you would owe three months of refunds plus fines. The city's own page only says penalties "start at $525"; the escalating tiers come from the law firm and trade press summaries.

How complaints reach you

On October 1 the city launched a complaint portal that its Office of Technology and Innovation built in 10 weeks, per the Mayor's Office. It's available in every major language spoken in NYC. Complaints can also come in by mail, fax or 311. DCWP may assign a mediator, who forwards the complaint to the business for a written response and then negotiates a resolution. Davis+Gilbert warns that a pattern of complaints against one company can lead to a broader investigation.

So the first sign of trouble is likely to be a mediator's email to whatever address you list for legal or support. Make sure someone actually reads that inbox.

How the NYC rule compares to state and federal rules

The obvious question: "We already comply with California and New York State. Isn't that enough?" Skadden says plainly that "compliance with the New York state law alone should not be considered sufficient."

Sources: Skadden, Davis+Gilbert, Loeb & Loeb, Cooley.

For software companies, the "obscuring" provision matters most. Davis+Gilbert points out that a cancel link that is technically accurate but buried (grey 10px text, three menus deep under "Billing > Manage > More options") could break the NYC rule even if it passes the state law.

At the federal level, the FTC's amended Negative Option Rule was vacated by the Eighth Circuit in July 2025. On March 11, 2026 the agency issued an advance notice of proposed rulemaking, with comments due April 13, 2026. Cooley reports that the notice asks about the old rule's "at least as easy" cancellation standard and specifically whether save offers are unfair or deceptive. ROSCA is still fully enforceable, and Cooley counts five FTC negative-option cases and six settlements since January 2025. Skadden adds that roughly 30 states have their own auto-renewal or click-to-cancel laws.

A one-sprint compliance checklist for subscription products

You don't need to build one flow for NYC and another for everyone else. Davis+Gilbert recommends a single national baseline, and engineering teams will want that too, because location-specific cancel flows are fragile and hard to test.

1. Audit checkout order. Price, billing frequency, renewal date, trial end date and how to cancel should all appear above or next to the card field, not in a terms link. Screenshot it for your records.
2. Use separate consent. Use an explicit checkbox or a clearly labelled button ("Start trial, then $20/month") rather than burying auto-renewal in the general terms.
3. Put "Cancel subscription" one or two clicks from account settings. Count the clicks for signup and for cancellation. If cancelling takes more steps, cut steps until it doesn't.
4. Remove channel mismatches. If cancellation currently requires emailing support or booking a call, add a self-serve button. App-store subscriptions cancel through Apple or Google, but deep-link to those settings rather than telling people to "contact us".
5. Limit retention offers to one screen. One offer (a discount, a pause or a downgrade) with an equally prominent "No thanks, cancel" button. Don't put a mandatory survey before the confirm button; make it optional, or show it after cancellation.
6. Confirm immediately. Show an on-screen confirmation and send an email with the effective end date. Under the rule, an ignored or unacknowledged request is a violation.
7. Log every attempt. Davis+Gilbert recommends keeping records of cancellation requests, including chat logs, call records and abandoned online flows. Because restitution runs from the first attempt, timestamped event logs (for example cancel_flow_started, save_offer_shown, cancel_confirmed) are your evidence.
8. Wire up notices in your billing system. Set renewal reminders (15–45 days before), price-change notices (5–30 days before) and trial-end reminders (3–21 days before) per the table above. Stripe, Paddle and Chargebee all support scheduled emails or webhooks you can trigger from.
9. Handle support-channel cancellations. If an AI support bot or human agent gets "please cancel my plan", it must either cancel or hand the customer to a working cancel link, not argue with them. Check your support bot's prompts for over-eager retention instructions. If you're choosing a support tool, compare options in our AI customer support tools directory.
10. Name an owner. Pick one person to respond to DCWP mediator requests within days, not weeks.

What it does to your metrics

Easier cancellation usually raises measured churn, especially among dormant subscribers who never used the product but never found the exit. Plan for it rather than being surprised in next month's board update. Our SaaS Churn & LTV Calculator shows what a few points of extra monthly churn do to LTV and CAC payback. If you're also planning a price change, the 5–30 day notice window now has to fit into your rollout, and the Price Increase Calculator shows how much churn the increase can absorb.

There's an upside: revenue from people who would leave if they could find the button is not reliable revenue, and chargebacks and app-store refund requests from those users cost money too.

What to watch next

• DCWP's first enforcement actions. No grace period or priority industries have been announced, per Subscription Insider. The first published settlements will show whether DCWP targets gyms and telecoms first or goes after online subscriptions.
• FTC next steps. After the March 2026 advance notice, the Commission can propose a rule, propose narrower amendments or drop the effort. Any rule that limits save offers would affect every US subscription business.
• Other cities copying NYC. The city cites Roosevelt Institute estimates of up to $162.5 million a year in savings for residents. Numbers like that make it likely other municipalities will follow, each with slightly different notice windows.

What to do now: run steps 1–7 of the checklist this week. They're mostly UI and logging changes and cover the largest risks. Then schedule the billing-notice work. Building to the strictest common standard (same-channel cancellation, disclosure before payment, prompt confirmation) covers you in New York City and most of the roughly 30 states with their own rules.