The Cancellation Gap: Who Actually Has a Right to Cancel Online

Correction, 19 August 2026

This article first published with a count of eight states and a covered share of 29.6 percent. Both were wrong, and wrong in the direction that flattered the finding.

A second pass read statutory text for every state rather than trusting published compilations. It found four more states with a symmetric-cancellation requirement, including Florida, and two states whose requirement does not reach an ordinary monthly subscription at all. The corrected figures are below. The section below on why the first pass was wrong explains how the error happened, because that turned out to be the most useful finding in the piece.

TL;DR

• The Eighth Circuit vacated the FTC's click-to-cancel rule in its entirety on 8 July 2025, six days before full enforcement was to begin. The defect was procedural. The FTC skipped a required preliminary regulatory analysis.
• The replacement rulemaking is at its earliest stage. An advance notice of proposed rulemaking was published on 13 March 2026 and the comment period closed on 13 April 2026. As of August 2026 there is no proposed rule.
• Ten states require that a consumer who signed up online for an ordinary monthly subscription be able to cancel online. They hold 108,607,137 people, 31.8 percent of the United States.
• Two more require symmetric cancellation but only for longer contracts, so it does not reach a month-to-month subscription: Florida, for service contracts running past six months, and Vermont, for contracts with an initial term of a year or more. That is another 24,107,181 people whose protection has a hole in exactly the shape of a streaming subscription.
• 209,070,539 people, 61.2 percent, have no such requirement at all.
• The exemptions matter as much as the coverage. Connecticut's law excludes "any global or national service largely or predominately consisting of audiovisual content," which is to say it exempts streaming.
• Eight of the ten took effect within the last fifteen months. Two took effect within the last three. This is a fast-moving map, not a stable one.
• Abundera Research will publish a merchant-level cancellation-flow audit in Q2 2027. This article pre-registers that methodology.

What happened to the federal rule

In October 2024 the FTC finalized amendments to its Negative Option Rule, known almost everywhere as the click-to-cancel rule. It required express informed consent, disclosure of material terms before billing, and a cancellation path as simple as the signup path. Trade groups challenged it, and on 8 July 2025 the Eighth Circuit vacated it in full in Custom Communications, Inc. v. FTC.

The court did not reach the merits. Section 22 of the FTC Act requires a preliminary regulatory analysis for any rule with an estimated annual economic effect of at least $100 million. The FTC did not conduct one. The Eighth Circuit held that the omission was prejudicial error and that vacatur of the entire rule was the remedy. Full enforcement had been scheduled to begin on 14 July 2025.

The Commission restarted the process, publishing an advance notice of proposed rulemaking on 13 March 2026 and closing comments on 13 April 2026. An advance notice is the stage before a proposed rule, which is itself the stage before a final rule. Nothing in that sequence binds a business today.

What survives federally is the 1973 prenotification rule the 2024 amendments were meant to modernise, which reaches book-of-the-month-style clubs and little else, plus the Restore Online Shoppers' Confidence Act, which requires a "simple mechanism" to stop recurring charges on online negative-option sales. ROSCA does not specify which channel that mechanism has to use, and it is enforced by the FTC rather than by consumers directly.

The question we tested

Most state automatic renewal laws are disclosure laws. They govern what the seller must tell you and when. A smaller number govern the cancellation mechanism itself, and a smaller number again do so for the kind of subscription an ordinary person actually wants to escape.

So we tested one narrow, checkable question:

If a consumer accepted an automatically renewing offer online, does state law require the seller to let them cancel it online, or through the same channel they used to sign up?

Then a second question, which turned out to matter just as much:

Does that requirement reach an ordinary month-to-month online subscription, or only longer contracts?

We read the operative statutory or regulatory text for every state we classify either way. Where text was ambiguous, we classified conservatively.

The ten states where the right reaches an ordinary subscription

The language is unusually consistent. Illinois: a consumer who accepts an offer online "must be allowed to terminate the automatic renewal or continuous service exclusively online." Arkansas, in a statute passed six years later: "shall allow a consumer to terminate the automatic renewal or continuous service exclusively online." Connecticut requires the consumer be able to act "online and without requiring such consumer to take any offline action." Maryland requires the mechanism "be available through the same medium the consumer used to consent." Maine requires cancellation "using the same method and in the same manner by which the consumer initially agreed."

New York's version arrived buried in Part W of the FY2026 budget bill, S3008-C, signed 9 May 2025 and effective 5 November 2025. It prohibits failing to provide "a simple cancellation mechanism that is as easy to use as the mechanism that the consumer used to provide consent and that is through the same medium that the consumer used to provide consent."

Two more states, but not for a monthly subscription

Florida and Vermont both require symmetric cancellation, and both write it plainly. Florida: a seller "must allow the consumer to cancel the service contract in the same manner, and by the same means, as the consumer manifested his or her acceptance." Vermont: "if the consumer accepted the contract online, permit the consumer to terminate the contract exclusively online."

Neither reaches a monthly subscription.

Florida's rule sits inside a definition of "automatic renewal provision" that only bites where renewal is "for a specified period of more than 1 month" and carries the contract past six months. Vermont's applies to a contract "with an initial term of one year or longer that renews for a subsequent term that is longer than one month."

A Florida resident has a statutory right to cancel a two-year alarm-monitoring contract the same way they signed it. They have no such right for the streaming service they signed up for last night. That is 24,107,181 people holding a protection shaped to fit the contracts they complain about least.

The carve-outs are where the money is

Coverage is not the same as protection, because every one of these laws exempts something.

Connecticut is the clearest case. Its definition of "consumer agreement" excludes agreements "concerning any global or national service largely or predominately consisting of audiovisual content." The state that requires cancellation "without requiring such consumer to take any offline action" has written Netflix, Disney+ and Max out of the statute. It also exempts utilities, anything regulated by the FCC, insurers and banks.

Maine's law does the opposite and lists what it covers: online magazines and periodicals, online media players, mobile apps, social networking services, internet game services, online software, and health club memberships. Streaming is in. A meal-kit box is not.

A right that stops at the edge of the category you actually subscribe to is a narrower thing than a map of covered states suggests.

Any count of states, including this one, overstates real protection for this reason. The table above is the ceiling, not the floor.

The arithmetic

Using Census Bureau Vintage 2025 population estimates for 1 July 2025, against a national total of 341,784,857 for the fifty states and the District of Columbia:

Two states sit in a conditional tier and are counted in neither. Minnesota requires an online termination election under Minn. Stat. § 325G.60, but only where the seller already operates a website with profile or subscription-management capabilities. New Jersey requires a direct cancellation link only where the seller has chosen to offer online cancellation at all. Both are real. Neither guarantees that signing up online buys you a way out online.

Everywhere else, the automatic renewal statutes we read are disclosure statutes. Georgia's law, O.C.G.A. § 13-12-3, requires notice 30 to 60 days before the cancellation deadline and disclosure of "the methods by which the consumer may obtain details of the automatic renewal provision and cancellation procedure." It says nothing about what those methods have to be. North Carolina's § 75-41 has the same shape. The District of Columbia's § 28A-203 requires active weblinks, but only inside a renewal notice sent by email. A seller can satisfy all three while accepting cancellations only by certified mail.

Why the first pass was wrong

This article's first version said eight states and 29.6 percent. It was built by taking published compliance guides as a candidate list and then verifying each candidate against statutory text. Verification worked. The candidate list did not.

Florida, Arkansas, Connecticut and Maine were all missing from it. Connecticut's online-cancellation subsection has been law since October 2023 and appeared in none of the guides consulted. Florida's same-manner requirement has been on the books far longer and was described by several sources as a notice-only statute. Meanwhile one 2026 guide asserted that only California, Colorado and Virginia require online cancellation, and another listed Delaware, Georgia and Tennessee as states that do, when Georgia's law is notice-only and the Tennessee section those roundups cite governs health clubs and bars automatic renewal clauses outright. A third attributed Maryland's requirement to Com. Law § 14-1212.1; the 2025 act added § 14-1328.

We are not naming the publishers, because the point is not about any one of them. Several are marketing assets for subscription-management vendors, which is a poor incentive structure for legal accuracy, and at least two read as machine-generated. The lesson is structural: a compilation is a fine starting point for what to check and a terrible source for what is true. Anything derived from one inherits its silences, and silences do not announce themselves during verification.

The fix, applied here, is to enumerate from the statutes rather than from the summaries. It is slower and it changed the headline by 7.6 million people.

Why this is worth measuring

Abundera Research published the Subscription Creep Index review in April 2026. Consumers underestimate their own subscription spending by wide margins, a large share are paying for something they have forgotten, and an FTC and ICPEN sweep of 642 subscription sites and apps found 76 percent used at least one dark pattern to retain subscribers.

Cancellation friction converts those findings into money. A subscription you meant to cancel in March and cancelled in July is four months of revenue that a design choice produced. The vacated federal rule was an attempt to price that friction out of existence. Its absence is a transfer, and its size is an empirical question nobody is currently answering.

Pre-registration: the cancellation-flow audit

In Q2 2027, Abundera Research will publish a merchant-level audit of cancellation flows. Methodology, registered here in advance:

1. Sample. A fixed list of consumer subscription merchants drawn from the categories most common in our users' recurring charges, selected before measurement begins and published with the report.
2. Channel inventory. For each merchant, every channel that can start a subscription and every channel that can end one, and whether each is reachable without speaking to a person.
3. Symmetry score. Whether cancellation is available in each channel that accepts signup. The same test applied to merchants that we applied to statutes here.
4. Step count and elapsed time. Screens, clicks and confirmations from account home to confirmed cancellation, and wall-clock time to written confirmation.
5. Retention interstitials. Count and type of offers, surveys or warnings interposed before cancellation completes.
6. Jurisdictional comparison. Whether merchants present different flows in the covered states, and whether merchants inside a carve-out behave differently from those outside one. This is the finding we most want, because it tests whether these statutes change behaviour or only paperwork.

We will publish per-merchant results, not just aggregates, along with the dates measured. We will publish the state-law classification in this article as a maintained dataset and correct it when readers show us we are wrong, as we have already had to do once.

If the audit finds that merchants behave the same everywhere, that is a finding against the value of the state laws catalogued here, and we will report it that way.

Limitations

This is a classification of what is written down, not of what happens. Enforcement is a separate question, and a statute with no enforcement record may protect less than a well-drafted terms page.

The scope judgment is ours. "Reaches an ordinary monthly online subscription" is a reading of each statute's definitions and thresholds, not a phrase any of them use. Florida and Vermont are excluded from the headline on that basis, and a reader who disagrees can move them and add 24,107,181 people back.

Effective dates matter and several are recent. Maryland's requirement has been in force since 1 June 2026 and Virginia's since 1 July 2026, so a study of merchant behaviour conducted today is measuring compliance with rules that are weeks old in two of the ten.

These laws generally attach to the consumer's residence rather than the seller's, but scope, exemptions and definitions vary, and several exempt regulated industries. Nothing here is legal advice.

References

• Custom Communications, Inc. v. Federal Trade Commission, No. 24-3137 (8th Cir. 8 July 2025)
• FTC, Negative Option Rule
• Federal Register, Rule Concerning the Use of Prenotification Negative Option Plans, 13 March 2026
• Restore Online Shoppers' Confidence Act, 15 U.S.C. § 8403
• California AB 2863 (2024)
• Arkansas Act 652 of 2025 (HB1820)
• Colorado Revised Statutes § 6-1-732
• Connecticut General Statutes § 42-158ff
• Illinois Automatic Contract Renewal Act, 815 ILCS 601
• Maine SP 650 / LD 1642
• Maryland Senate Bill 49, 2025 Md. Laws ch. 204
• Massachusetts 940 CMR 38.00
• New York General Business Law § 527-a
• Vermont 9 V.S.A. § 2454a
• Virginia Code § 59.1-207.46
• Florida Statutes § 501.165
• Minnesota Statutes § 325G.60
• Georgia Code § 13-12-3
• North Carolina General Statutes § 75-41
• D.C. Code § 28A-203
• U.S. Census Bureau, State Population Totals 2020-2025 (Vintage 2025)

Abundera Research is the independent research arm of Abundera, Inc. Statutory text was read on 19 August 2026. Corrections to the state classification are welcome and will be published. Press and data-access inquiries: research@abundera.ai.