NYC's click-to-cancel rule is a CRO wake-up call

Every conversion optimization post you have read is about removing friction to get more people in. On July 10, 2026, New York City adopted the country's first municipal rule forcing businesses to remove friction on the way out, and it takes effect October 1. Most CRO teams have never audited a cancellation flow the way they audit a checkout. That is about to become a mistake with a dollar figure attached.

What NYC's rule actually requires

On July 10, 2026, Mayor Zohran Mamdani and Department of Consumer and Worker Protection Commissioner Samuel Levine announced New York City's Click to Cancel rule, the first municipal-level rule of its kind in the US. It takes effect October 1, 2026. The core requirement is symmetry: if a customer signs up online, they must be able to cancel online. If a business accepts sign-ups through multiple channels, it must offer cancellation through all of them, and businesses that enroll customers in person still have to provide an online cancellation option.

The rule specifically bans hanging up on someone trying to cancel, hiding or falsifying cancellation instructions, misrepresenting the cost or consequences of cancelling, and unreasonably delaying a cancellation request. Retention offers are still legal, a business can still ask a cancelling customer to stay, as long as the offer does not obstruct or slow the actual exit. Violations carry civil penalties starting at $350, plus liability for any charges made after the first cancellation attempt.

The federal rule is not actually in force

It is worth being precise here because a lot of coverage conflates NYC's rule with a federal one. The FTC's original Click to Cancel Negative Option Rule was finalized in October 2024, then vacated by the Eighth Circuit Court of Appeals on July 8, 2025 for violating rulemaking procedure. The FTC opened a new rulemaking process in March 2026 to try to revive it, but as of this writing there is no enforceable federal click-to-cancel rule. Roughly 30 states now have their own automatic-renewal laws filling that gap, some stricter than the vacated federal version, and state attorneys general in California, New York and Massachusetts have publicly expanded enforcement against subscription dark patterns.

Why this is a CRO problem, not just a legal one

An academic usability study testing dark-pattern-heavy cancellation flows against transparent ones found a 28 percent reduction in user trust and a 54 percent decrease in usability scores for the dark-pattern version. Separately, roughly 35 percent of cardholders say cancelling a subscription is somewhat or very difficult, and subscription chargebacks run 1 to 2 percent of transactions, above standard ecommerce norms, largely because a frustrated user who cannot find the cancel button disputes the charge with their bank instead. A chargeback costs more than a clean cancellation ever would, in fees, in dispute time, and in the account-standing risk that comes with a rising chargeback ratio.

This is the same logic every conversion optimization program already applies to sign-up and checkout, just pointed at the exit instead of the entrance. Baymard Institute's latest large-scale checkout research, built on 54 rounds of benchmarking across 327 top-grossing sites, still finds an average of 32 unresolved checkout friction issues per site. Form-length data tells the same story from a different angle: conversion falls from 23.1 percent at 3 fields to 11.4 percent at 7 fields, and removing a single field lifts conversion by roughly 11 percent. Cancellation flows have simply never been measured with the same rigor, and NYC's rule is forcing the comparison.

How to audit your cancellation flow before October 1

1. Time and count the exact steps required to sign up, from landing page to confirmed subscription.
2. Time and count the exact steps required to cancel, using the same account, on the same device.
3. Flag any step in the cancel flow that has no equivalent in the sign-up flow, such as a mandatory phone call or a multi-screen retention offer with no visible exit.
4. Confirm cancellation is available through every channel you accept sign-ups through, including in-app, web and any in-person enrollment path.
5. Fix the biggest gap first. A single blocking step, like a phone-only cancellation path for an online-only sign-up, is both the highest compliance risk and the highest trust cost.

Frequently asked questions

Does NYC's click-to-cancel rule apply to my business if we're not based in New York?

Likely yes if you sell subscriptions to customers located in New York City, since consumer protection rules like this apply based on where the customer is, not where the company is headquartered. Any US subscription business with New York City subscribers should assume coverage.

Is the federal FTC click-to-cancel rule currently in effect?

No. The original rule was vacated by the Eighth Circuit Court of Appeals on July 8, 2025 for procedural violations. The FTC opened a new rulemaking process in March 2026 to try to revive it, but as of August 2026 there is no enforceable federal click-to-cancel rule.

What counts as an illegal cancellation dark pattern under the new rule?

Hanging up on someone trying to cancel, hiding or falsifying cancellation instructions, misrepresenting the cost or consequences of cancelling, and unreasonably delaying a cancellation request. Retention offers remain legal as long as they do not block or slow down the exit.

Does making cancellation easier actually hurt revenue?

The data suggests the bigger risk runs the other way. Friction-heavy cancellation flows are linked to a 28 percent drop in user trust in academic testing, and subscription chargeback rates of 1 to 2 percent, well above standard ecommerce norms, as frustrated users dispute the charge with their bank instead of cancelling directly.

What is the fastest way to audit our cancellation flow before October 2026?

Count the clicks and form fields required to sign up, then do the same for cancelling. If cancelling takes more steps, requires a phone call, or forces users through a retention gauntlet before reaching an exit, it is likely non-compliant with NYC's rule and a conversion and trust risk regardless.

Should mobile cancellation get the same design attention as mobile checkout?

Yes. The same friction-reduction logic that lifts checkout conversion, where removing a single form field lifts conversion by roughly 11 percent, applies directly to shortening a mobile cancellation flow, and mobile is where friction costs the most because users abandon faster.

The takeaway

CRO has always been framed as a game of removing friction to convert more. NYC just legislated the other half of that logic: friction at the exit is not neutral, it is a trust and revenue problem dressed up as a retention tactic. Audit your cancellation flow with the same rigor you already apply to checkout, fix the biggest gap first, and you will be ahead of both the October 1 deadline and the chargebacks a bad exit flow is already quietly generating.