NYC's Click-to-Cancel Rule: What Shopify Merchants Need to Know

Search "click to cancel" today and most of what comes back tells you the rule died: the FTC's version was vacated by the Eighth Circuit in July 2025, six days before its cancellation requirements would have taken effect. That's true, and it's also not the rule that matters right now. On July 10, 2026, New York City's Department of Consumer and Worker Protection finalized its own "Click to Cancel" rule, a separate, city-level requirement that takes effect October 1, 2026, with no exemption for small businesses and no exemption for any industry that asked for one, including telecom, which asked and was refused in writing.

What the rule actually requires

Any business offering an automatic renewal or continuous service to a New York City consumer must disclose terms clearly before billing, let the customer cancel through the same medium they used to sign up, and offer cancellation through every medium the business accepts consent through, not just one. The rule, codified at 6 RCNY §§ 5-110 through 5-110.3, per NYC's official Click to Cancel page, requires that material terms (price, frequency, the deadline to act, and how to cancel) appear clearly and in visual proximity to the request for payment, before billing information is collected.

Two separate cancellation requirements are easy to conflate. One says cancellation must be as easy as signup, through the same channel that customer used. The other, broader requirement says the business must offer cancellation through every medium it accepts consent through at all, according to Auteur's detailed breakdown of the rule. A merchant who closes some memberships over the phone and others through checkout needs a working cancellation path on both channels, not just the one the specific customer used.

The three notice windows that matter most for a membership program

The rule sets three separate advance-notice requirements, each with both a minimum and a maximum number of days, which is easy to miss if you only read the "at least" figure. For any initial paid term of a year or longer that renews for six months or longer, notice must go out at least 15 days but no more than 45 days before the renewal deadline. For any material change to the terms, including a price increase, notice must go out at least 5 business days but no more than 30 days before the change takes effect. For a free gift or trial running longer than a month, notice before the first charge must go out at least 3 days but no more than 21 days before the deadline to cancel, per the same Auteur analysis of the rule text.

That's a materially more specific requirement than "send a reminder before renewal." A brand that sends its annual renewal notice 60 days out, thinking earlier is always safer, is actually outside the window on the high end just as much as a brand that sends it 5 days out is outside it on the low end. Both notices need to explicitly include cancellation instructions, not just a heads-up that a charge is coming.

Why the restitution clause matters more than the civil penalty

The civil penalties, $525 for a first violation, $1,050 for a second, $3,500 for a third or subsequent, are modest. The restitution provision has no such ceiling, and it's triggered by an attempted cancellation, not just a completed one. Under the rule, a business found to have violated any provision is liable for the amount charged to the consumer after that consumer's first attempt to cancel, according to Covington & Burling's analysis of the rule. That's a notably different, and stricter, measure than New York State's existing autorenewal law, which leaves restitution to a court's discretion rather than defining it directly.

The practical implication: the moment a customer first tries to cancel, whether that attempt succeeds immediately or gets delayed, deferred, or dropped, is the clock that starts counting toward exposure. A support ticket that sits unanswered for two billing cycles isn't just a service failure. Under this rule, it's the exact window the restitution measure is built around.

Does this apply if your business isn't based in New York City?

The rule doesn't contain an explicit geographic-scope provision either way, which means neither "I have NYC customers so it applies to me" nor "I'm not based there so it can't reach me" is something the text directly supports. This is a genuinely open question rather than a settled one, and it's worth treating it that way rather than guessing in either direction. What is settled: the rule's substantive requirements largely mirror New York State's existing autorenewal statute, GBL § 527-a, which already applies based on where the consumer is located rather than where the business sits. A Shopify merchant selling memberships or subscriptions to New York City customers is already likely covered by the state law regardless of how the city rule's geographic reach eventually gets interpreted.

What to check in a Shopify membership or subscription flow before October 1

Map every channel your business accepts a "yes" through (checkout, phone sales, in-person signup, a sales call) against every channel that offers a "no." The rule requires the second list to be at least as long as the first. If in-person enrollment only offers phone-based cancellation, that specifically doesn't satisfy the rule, which calls for an online mechanism like a website or email instead of a phone number for in-person signups.

Confirm your renewal and price-change notices land inside the actual windows, not just after some minimum delay. A 15-day renewal reminder is fine; a 60-day one, sent out of an abundance of caution, technically isn't. Check that both the renewal notice and the price-change notice explicitly tell the customer how to cancel, not just that a charge is coming.

Verify that nothing ships without a recorded, affirmative consent tied to it. Under the rule, goods shipped without that consent are deemed an unconditional gift, with no obligation on the customer's part, including no obligation to cover return shipping. That's a stricter standard than "we'll refund it if they complain."

FAQ

When does NYC's Click-to-Cancel rule take effect?

October 1, 2026. The rule was finalized and adopted by the Department of Consumer and Worker Protection on July 10, 2026.

Is this the same as the federal click-to-cancel rule that was struck down?

No. The FTC's Negative Option Rule was vacated by the Eighth Circuit in July 2025 on procedural grounds, and its cancellation requirements never took effect. NYC's rule is a separate, city-level requirement built on the city's existing consumer protection law, and it is unaffected by the federal vacatur.

Are small businesses exempt from NYC's Click-to-Cancel rule?

No. The rule's exemption list contains five categories, and all five are tied to existing regulatory licenses or government-granted franchises (financial institutions, licensed security alarm operators, and similar entities). There is no exemption based on business size or revenue.

What's the penalty for violating the rule?

Civil penalties run $525 for a first violation, $1,050 for a second, and $3,500 for a third or subsequent violation. Separately, a business found in violation is liable for restitution equal to whatever it charged the consumer after that consumer's first attempt to cancel, a measure with no fixed ceiling in the text.

Does the rule apply to businesses located outside New York City?

The rule text doesn't explicitly address this either way. Businesses with New York City customers are likely already covered by New York State's existing autorenewal law regardless, since that law applies based on the consumer's location rather than the seller's.

Subscribfy's paid membership platform runs through Shopify's native checkout and supports renewal reminder cadences and deferred cancellation flows built around exactly this kind of regulatory timing. Book a call to review your current notice windows and cancellation paths before October 1.