INDUSTRYPAYMENT PROCESSING
Subscription billing in 2026: click-to-cancel is gone, the card network rules are not
P
Payment Review Editorial Team
Payment Review Editorial Team
In July 2025 a federal appeals court threw out the Federal Trade Commission's click-to-cancel rule days before its compliance deadline. A lot of subscription businesses read the headline, cancelled the compliance project, and moved on. That was a mistake, and not a subtle one: almost everything the FTC rule would have required was already required of you by Visa, by Mastercard, or by the state your customer lives in.
This piece separates the four sets of rules that actually govern recurring billing in the United States, says which are in force today, and then deals with the practical question underneath — whether you should be the merchant of record for your own subscriptions at all.
The court vacated the rule, which is stronger than staying it: the rule is void, nationwide, as though it had not been issued. The reasoning was procedural rather than substantive. The FTC Act requires a preliminary regulatory analysis once an agency determines a rule will impose compliance costs above $100 million, and the FTC did not publish one. The court did not rule that requiring easy cancellation is unlawful.
That distinction matters because the Commission went straight back to rulemaking. It issued an advance notice of proposed rulemaking on 11 March 2026, published it in the Federal Register on 13 March, and closed comments on 13 April 2026. The notice asks whether the existing rule should be amended, what the alternatives are, and which parts of the vacated version are worth reviving. A replacement is a live possibility, and a business that dismantled its cancellation flow in 2025 will be rebuilding it. As of September 2026 the only federal negative-option rule in force is the original prenotification rule at 16 CFR Part 425, which addresses book-club-style plans and reaches very few subscription businesses.
The Restore Online Shoppers' Confidence Act — ROSCA — is a statute, not a rule, and nothing in the Eighth Circuit's decision affects it. It requires clear disclosure of the material terms before you obtain billing information, express informed consent, and a simple mechanism to stop recurring charges. The FTC has continued to bring negative-option cases under it. If your defence to a bad cancellation flow was "the rule was vacated", ROSCA is the answer you will get.
State law is the other half. California amended its automatic renewal law in 2024 through AB 2863, and the amendments apply to any contract entered into, amended or extended on or after 1 July 2025. The statute requires that cancellation be available in the same medium the consumer used to sign up, or the medium in which they are accustomed to dealing with the business — so an online sign-up cannot be funnelled into a phone call or a retention queue. It also expands consent requirements, mandates annual reminders and requires clear notice of material price or service changes. California is not unusual in having such a law; it is unusual in how specific and how recently updated it is, and a national subscription business ends up building to the strictest state anyway.
Visa published its updated policy for subscription merchants offering free trials and introductory promotions in June 2019, effective 18 April 2020. It applies equally to physical and digital goods. The requirements, in Visa's own framing, are these:
Visa paired this with expanded issuer dispute rights under the misrepresentation condition, for cases where a cardholder was not clearly told about further billing. The flip side is documented in the same bulletin: a merchant that can show express agreement to future transactions and can show it notified the cardholder before charging has a defence. That is the practical argument for keeping the notification logs — they are dispute evidence, not just compliance paperwork.
Mastercard's standards took effect on 22 September 2022 and differ from Visa's in ways that will catch you if you build to one and assume the other matches. Mastercard's own summary document is not readable without an account, so what follows is drawn from two acquirers' independent published guidance — PayPal's Braintree and Checkout.com — which agree on every point below.
Note the asymmetry on scope: Mastercard's negative-option trial requirement is specific to digital goods and services, while Visa's applies to physical and digital alike. If you sell a physical product on a free trial, Visa's reminder obligation is the one that binds.
Every requirement above attaches to the merchant of record: the legal seller on the transaction. For most businesses that is the business itself, and the obligations are yours to build. There is another model, and for cross-border digital sellers it is often the better one.
A merchant of record becomes the legal seller of your product. Paddle publishes 5% plus 50¢ per checkout transaction for that, with tax compliance, subscription billing and fraud screening inside the price. FastSpring does not publish rates at all, which is a real drawback, but takes on VAT, sales tax and GST registration across a very wide set of jurisdictions. Xsolla does the same thing narrowly for games, where the alternative is an app store's own cut. Stripe now sells the model too, as Managed Payments, priced at 3.5% on top of its ordinary processing fees and covering indirect tax compliance and remittance in more than 75 countries. In each case the network's subscription obligations, the tax registrations and the chargebacks sit on the provider's account rather than yours.
The trade is cost and control. A merchant of record charges several times what a card processor charges, settles on its own schedule rather than daily, and owns the customer payment relationship — which is felt most sharply when you want to leave, because you then have to establish the tax registrations you had been renting. If your revenue is domestic, that is a lot to pay for a problem you do not have.
The alternative is to stay the merchant of record and buy the billing logic. Braintree handles subscription plans, proration, retries and dunning rather than making you build them. Stripe sells the same capability as a separately priced product — Billing at 0.7% of billing volume on its pay-as-you-go plan, and Tax from 0.5% per transaction. Note what Tax does and does not do: it calculates the tax, but the liability stays with you, because you remain the seller of record. At the top end, Spreedly vaults the credentials independently of any one gateway, so that the processor becomes replaceable; it is an enterprise tool with enterprise pricing and not a fit for a small business.
The rules above govern the customers who want to leave. Most subscription businesses lose more revenue to the ones who did not: expired cards, reissued cards, insufficient funds. The countermeasures are unglamorous and largely purchasable — account updater services that refresh stored card numbers, network tokens that survive reissue, and dunning schedules that retry at sensible intervals rather than hammering a declined card.
Bank debit is the other lever, and it cuts both ways. GoCardless collects recurring payments straight from bank accounts, which sidesteps card expiry entirely and costs a fraction of card interchange on its standard plan. But bank debit fails more often than cards do, usually for insufficient funds, and each failure carries a $5 fee. For a low-value monthly subscription that arithmetic can go the wrong way; for a high-value annual one it rarely does.
