On October 1, New York City becomes the first city in the country where hiding your cancel button is illegal. The rule the mayor's office announced on July 10 requires any business selling a subscription to let customers end it as easily as they started it. Bury the cancel link, route people to a phone line that conveniently disconnects, or misrepresent what canceling costs, and the fines start at $525 and climb to $3,500 for repeat violations. The city estimates the rule will save New Yorkers up to $162.5 million a year, which is another way of saying that is roughly how much friction was quietly earning.

This isn't a big-company problem

If your first thought is that this is a Netflix and Planet Fitness problem, read the rule again. It applies to anyone billing on a recurring basis. The neighborhood gym. The SaaS tool with forty customers. The membership site, the coaching program, the lawn-care plan that auto-renews every spring. Size is not the line. Recurring billing is the line, and a surprising number of small businesses are on the wrong side of it without ever having decided to be.

The federal rule died. The rules didn't.

New York is also not an outlier. It is the newest tile in a patchwork that has been forming for two years. The FTC finalized its own "click-to-cancel" rule in October 2024, requiring sellers to make canceling as simple as signing up. A federal appeals court vacated that rule in July 2025, days before it was to take effect, on a procedural technicality rather than the merits. The FTC has since moved to bring a revised version back. So the federal floor wobbled, but it did not disappear, and the states never waited for it.

California is the clearest example. Its Automatic Renewal Law, amended by AB 2863 and in force since July 1, 2025, already requires businesses to offer cancellation through the same medium a customer used to sign up. Subscribe online, cancel online, with a visible path and no obstacle course in between. It even folds free trials and free-to-paid conversions into the rule, and if you get it wrong, the auto-renewal itself can be treated as invalid, which opens the door to refunds. That is the pattern spreading: cancel the way you signed up, prove you got real consent, and stop pretending the exit is optional.

So "the federal rule died" is not the reprieve some owners are treating it as. The floor is rising state by state and now city by city, and the older statutes never went anywhere. The Restore Online Shoppers' Confidence Act and Section 5 of the FTC Act still give regulators room to pursue deceptive cancellation, rule or no rule. Betting your business on the idea that nobody will bother is a strange bet to make when the fix is cheaper than the fine.

Your cancel flow was a business decision first

Here is the part worth sitting with, though, because compliance is the small reason to care. The cancel flow was a business decision long before it was a legal one.

A hard-to-cancel design does exactly one thing well. It buys you one more billing cycle from someone who has already decided to leave. In exchange, you get a customer who will never come back, who is now likely to dispute the charge with their bank instead of clicking a button, and who will tell the story to anyone who mentions your category. Chargebacks cost you the revenue plus a fee and count against your merchant account. The one-star review outlives the one payment. The math only looks good on a spreadsheet that has been taught not to see reputation.

Easy cancellation flips all of that. A clean exit is the last impression you leave, and last impressions are the ones people repeat. Customers who leave without a fight come back more often than customers who had to escape. This is the same logic we wrote about in the first impression your website makes isn't your homepage: trust is built at the friction points, not the polished ones. Making the exit graceful is not charity. It is retention wearing a different outfit.

What a compliant, humane exit looks like

What does a flow that is both compliant and humane actually look like? A few things, none of them expensive.

Cancel where they subscribed. If someone signed up on your website, they can cancel on your website, logged in, in plain sight. No "call during business hours," no email-us-and-wait. If you accept sign-ups through more than one channel, every one of those channels needs a working exit.

Match the effort. Count the clicks it takes to subscribe, then count the clicks it takes to cancel. If canceling takes noticeably more steps, you have your redesign brief. Roughly equal is the target the new rules are all circling.

Offer once, then stop. One honest retention offer is fair. A five-screen maze of "are you sure," downgrade pitches, and guilt copy is the exact "unreasonable delay" these rules name. Ask once, respect the answer, move on.

Confirm in plain language. Tell them it worked, tell them the last day of access, tell them they will not be charged again. Silence after a cancel request is how disputes start.

None of this is a legal project first. It is a design and engineering project. The cancel path is UI and UX, and behind it sits billing plumbing that has to actually stop the charge, update the subscription state, and fire a confirmation. That is the same craft as building the signup, which is why we treat both ends of the subscription as interface and design work sitting on top of software that has to behave correctly. A cancel button that looks right but does not reliably halt the billing is worse than no button, because now you have a promise and a broken one.

There is a version of this where you also make the exit feel a little too easy and lose people you could have kept with a better product. That is a real tension, and it is worth naming. But the answer is a better product, not a worse door. Friction that keeps people who want to leave is the faster-but-worse trap in another form: a number that improves on the dashboard while the actual experience gets worse.

The businesses that will shrug at October 1 are the ones who already made canceling easy, because they were never leaning on friction to keep anyone. That is the whole play. Build the exit as carefully as the entrance, and the new rules become a formality you already passed instead of a fire drill you have to run.