The global shift toward “Click-to-Cancel”
If you sell subscriptions, memberships, or any auto-renewing service to consumers online, a pattern is emerging across multiple jurisdictions at once: regulators are converging on the principle that cancelling a contract should be no harder than entering into one. The EU has just implemented a formal “withdrawal button.” The US has an active “easy exit” push at both federal and state level. The UK has a subscription-cancellation regime in the pipeline.
There's a common thread worth understanding upfront: in every jurisdiction discussed below, what triggers the obligation is where your consumers are located — not where your company is incorporated, headquartered, or hosts its servers. A Delaware LLC, a Cayman entity, or a Cyprus-registered affiliate gets no exemption if it is actively marketing to consumers in the EU, the UK, or California.
Why this matters regardless of where you're based
The clearest illustration of this principle in practice is a June 2026 US Federal Trade Commission enforcement action. In *FTC v. Genesis Tech* (complaint filed June 17, 2026, in the U.S. District Court for the Northern District of California), the FTC obtained a temporary court order halting a network of 15 corporations and eight individuals accused of running deceptive subscription schemes — including fitness apps, PDF editing tools, and horoscope/psychic-chat services. According to the FTC's complaint, the enterprise operated through Cyprus-incorporated marketing affiliates running out of Ukraine, which accessed US payment processing through separate Delaware-incorporated entities, and allegedly generated close to a quarter billion dollars in revenue from these products between early 2023 and mid-2025.
The FTC alleges violations of the FTC Act and the Restore Online Shoppers' Confidence Act (ROSCA), citing, among other things, that the defendants failed to provide simple cancellation mechanisms — omitting cancellation options from websites and apps, requiring consumers to explain why they wanted to cancel, and in some cases continuing to charge consumers even after they had confirmed a cancellation.
The jurisdictional point is the one worth internalizing: none of the defendants' offshore corporate layering mattered to the FTC's ability to bring the case, because the conduct targeted US consumers. The same logic runs through the EU regime described below.
The EU: a formal "withdrawal button" (Article 11a CRD)
The EU has taken the most prescriptive approach. Directive (EU) 2023/2673, adopted on 22 November 2023, amends the Consumer Rights Directive (2011/83/EU, the "CRD") by inserting a new Article 11a. Member States were required to transpose it into national law by 19 December 2025, and the rules apply from 19 June 2026.
The obligation falls on traders that conclude distance contracts with EU consumers through an online interface — a website or app — wherever a statutory right of withdrawal exists under the CRD. It applies whether or not the trader is established in the EU: non-EU businesses are caught if they direct their commercial activity toward EU consumers, for example through an EU-language site, euro pricing, or EU-targeted advertising. Purely B2B traders, and interfaces that don't facilitate contract conclusion, fall outside the rule, which applies regardless of turnover or headcount.
In practice, the directive requires a clearly labelled electronic withdrawal function — a "cancel subscription" button or unambiguous equivalent — that stays continuously available and prominently displayed throughout the withdrawal period. It must operate as a two-step process: an initial withdrawal statement (name, contract details, preferred confirmation channel), followed by a separate confirmation step, with an automatic acknowledgment of receipt sent to the consumer on a durable medium such as a confirmed email.
Because the CRD is a directive rather than a regulation, the precise wording and procedural mechanics are set at Member State level. Germany, for example, implemented the requirement through a new Section 356a of its Civil Code.
What this means in practice
If you sell subscriptions to EU consumers through a website or app, you'll need a genuine withdrawal function live by 19 June 2026 — and you should check the transposing law in each Member State you target, since the exact labelling and flow can differ from country to country.
The United States: no single rule, but plenty of enforcement
Unlike the EU, the US does not have a single nationwide "Click-to-Cancel" law. Instead, businesses face a combination of federal consumer protection laws and state-specific requirements.
The FTC's 2024 "Click-to-Cancel" Rule was vacated by the U.S. Court of Appeals for the Eighth Circuit in Custom Communications, Inc. v. FTC (July 8, 2025) due to procedural deficiencies, so it is not currently in force. However, the FTC is considering a revised rule following its March 2026 Advance Notice of Proposed Rulemaking.
That does not mean businesses are free to implement difficult cancellation flows. The FTC continues to enforce subscription practices under the Restore Online Shoppers' Confidence Act (ROSCA) and Section 5 of the FTC Act, which require businesses to:
- clearly disclose subscription terms;
- obtain the consumer's express informed consent before charging; and
- provide a simple mechanism to stop recurring charges.
The FTC generally expects cancellation to be available through the same channel used for sign-up. The recent FTC v. Genesis Tech case illustrates that these obligations are actively enforced.
At the state level, California's Automatic Renewal Law (Cal. Bus. & Prof. Code §§ 17600–17604) already requires businesses to obtain expressed consent, retain consent records, and provide a prominent "click-to-cancel" option using the same medium through which the consumer subscribed. Numerous other states have adopted similar automatic renewal laws.
What this means in practice
If you sell subscriptions to US consumers, don't wait for a new federal rule. A simple online cancellation process is already the safest compliance approach.
The United Kingdom: similar Direction, different rules
The UK's Digital Markets, Competition and Consumers Act 2024 (DMCCA) introduces a new subscription contracts regime covering pre-contract disclosures, renewal reminders, cooling-off periods, and consumer cancellation rights.
Although the Act received Royal Assent in 2024, the subscription-specific provisions are not yet in force. Following several delays, the UK Government is currently targeting Spring 2027, subject to secondary legislation.
Unlike the EU, the UK does not require a specific "withdrawal button." Instead, the focus is on making subscriptions easier to exit through clearer information, cooling-off rights, and straightforward cancellation.
What this means in practice
Even before the regime takes effect, businesses should review their subscription journeys to ensure customers can easily understand, manage, renew, and cancel their subscriptions. Doing so will likely satisfy both future UK expectations and broader international consumer protection trends.
👉 Check out: Non-UK Founders’ Guide to Tax Implications of Setting Up a Company In the UK
What non-compliance can mean — by jurisdiction
- EU: Under the CRD's general enforcement framework, Member State consumer authorities can impose fines of up to 4% of a trader's annual turnover in the Member State(s) concerned for widespread infringements — subject to national implementation.
- US (California): Non-compliance with the ARL can result in enforcement by the California Attorney General and district attorneys, as well as private litigation.
- UK: Once in force, DMCCA non-compliance exposes a business to CMA fines of up to 10% of global turnover, plus “redress orders” that can require a business to contact all affected consumers and offer cancellation with a full refund — a mechanism that can create financial exposure independent of any formal CMA investigation (e.g., through consumer-driven claims once non-compliance becomes public).
What founders should do?
The good news is that compliance here rarely means a legal overhaul — it usually comes down to a handful of concrete, low-cost steps. Wherever your paying customers are based, this is a solid place to start:
✅ Identify where your paying customers live.
✅ Add a visible Cancel Subscription button where legally required.
✅ Make cancellation no harder than sign-up.
✅ Contact Legal Nodes to improve your Terms, Subscription Policy, and Refund Policy.
✅ Keep records of customer consent and cancellation requests.
✅ Don't assume an offshore company avoids consumer laws.
The bottom line
The specifics differ — a mandatory button in the EU, active enforcement in the US, a regime still warming up in the UK — but the direction of travel is unmistakable and one-way: cancelling should be as easy as signing up, and the obligation follows your customers, not your corporate structure. For a subscription business selling across borders, that means the relevant question is no longer "which law applies to us?" but "which of our users triggers which regime, and does our cancellation flow satisfy all of them at once?"
That's precisely the kind of multi-jurisdictional problem Legal Nodes is built to solve. Through a single point of contact, we help founders map where their paying users actually sit, align their Terms, Subscription Policy, and Refund Policy to each applicable regime, and put a compliant cancellation flow in place — before an enforcement action or a consumer complaint makes it urgent. If you're scaling a subscription app into new markets, get in touch to pressure-test your setup against the rules that are now coming into force.
