Subscription law for telehealth in 2026: click to cancel and auto-renewal

Anyone checking the click-to-cancel rule status in 2026 finds a federal rule that is not in force and a state picture that very much is. The Federal Trade Commission's 2024 amendments to its Negative Option Rule, the ones that would have required cancellation to be as easy as signup, were vacated by the Eighth Circuit, and in March 2026 the FTC started over with an advance notice of proposed rulemaking. An operator who reads that as "subscription rules are on hold" is making a mistake. The Restore Online Shoppers' Confidence Act, Section 5 of the FTC Act and a set of state auto-renewal statutes already require clear disclosure, express consent and an easy way out, and California's version spells out what easy means. A telehealth membership should be designed to those requirements now, with the federal rule treated as a later tightening rather than the standard.

This post sets out where the federal rule stands, what still applies, the state law that matters most, how to design cancellation and pause flows to it, what changes when the subscription includes a prescription, and what enforcement has looked like.

Where the federal click-to-cancel rule stands

The FTC finalized amendments to its Negative Option Rule in late 2024. They would have applied to almost any program with recurring charges and would have required clear disclosure of material terms before billing information is collected, express informed consent to the recurring charge, and a cancellation mechanism at least as simple as the one used to sign up, in the same medium. Industry groups challenged the rule and the Eighth Circuit vacated it. On March 11, 2026, the FTC published an advance notice of proposed rulemaking asking the public what a replacement rule should contain.

An advance notice is the earliest stage of rulemaking. It precedes a proposed rule, which precedes a final rule, and each step takes a comment period and usually much longer. As of this writing, no federal click-to-cancel requirement is in effect, and the older negative option rule, written decades ago for prenotification plans like book clubs, is what remains on the books at the federal level. A brand planning a launch in the next year should assume the federal picture will not settle before it does.

What still applies: Section 5, ROSCA and state auto-renewal laws

Three things bind a subscription business regardless of the fate of the FTC's rule. Section 5 of the FTC Act prohibits unfair or deceptive acts or practices, and the FTC has said in policy statements and complaints that undisclosed recurring charges and obstructed cancellation are exactly that. ROSCA, the Restore Online Shoppers' Confidence Act passed in 2010, applies specifically to online negative option sales and requires three things: clear and conspicuous disclosure of all material terms before the seller obtains the consumer's billing information, the consumer's express informed consent before the charge, and a simple mechanism to stop recurring charges. Most of what the vacated rule would have added was detail on what those three requirements mean.

Then there are the states. A growing list of them have auto-renewal statutes, each with its own disclosure wording, consent mechanics, reminder schedule and cancellation requirement. They overlap heavily but not perfectly, and a brand selling nationally is subject to the law of the state where each patient lives. The practical approach is to design one flow that satisfies the strictest statute the brand is likely to face and to treat that as the floor, with counsel reviewing the states where the brand concentrates. The strictest published set of requirements, and the one with the longest enforcement history, is California's.

The state law that matters most

California's automatic renewal law sits in Business and Professions Code section 17600 and following, and section 17602 carries the operative requirements. Its most recent amendments apply to contracts entered into, amended or extended on or after July 1, 2025. Read the statute directly; the summary below is what a telehealth membership has to satisfy.

• The automatic renewal terms must be presented clearly and conspicuously before the agreement is fulfilled, in visual or temporal proximity to the request for consent, including the price and how the price changes when any trial or promotional period ends.
• The business must obtain the consumer's affirmative consent to the agreement containing the automatic renewal terms before charging, and the contract may not include language that interferes with, detracts from, contradicts or otherwise undermines the consumer's ability to give that consent.
• An acknowledgment must be provided that includes the automatic renewal terms, the cancellation policy and information on how to cancel, and the business must keep verification of consent for at least three years or one year after the contract ends, whichever is longer.
• A consumer who accepted the offer online must be able to terminate exclusively online, at will, without engaging any further steps that obstruct or delay cancellation, through a prominently located direct link or button, or an immediately accessible termination email.
• A retention or discount offer may be presented during cancellation only if a prominently located, continuously and proximately displayed "click to cancel" link or button is shown at the same time, so the consumer can proceed without obstruction.
• For a free trial or promotional price lasting more than 31 days, notice must be sent at least 3 days and at most 21 days before it expires. For annual terms, notice must be sent at least 15 days and not more than 45 days before renewal.
• An annual reminder must go out disclosing the product, the frequency and amount of the charge, and the means of cancellation, delivered through the same medium the consumer used to sign up.

Two of those items are where telehealth memberships most often fail. The first is the retention offer, because a save flow that hides the cancel button behind a chat, a call or a "talk to your provider first" step is exactly what the statute forbids. The second is the trial conversion notice, because introductory pricing is common in weight-loss marketing and the reminder window is specific. Other states' statutes vary in the details; the state pages on this site and counsel are the place for the rest.

Cancellation and pause design

Designed to those requirements, a compliant membership flow is not complicated, and it is better for retention than the alternative. The checkout page carries a short block next to the payment button stating the price, the billing frequency, the term, what happens when any introductory price ends, and how to cancel. Consent to that block is a separate affirmative action from accepting the general terms, with the box unchecked by default. The confirmation email repeats the block and includes a working cancellation link. Reminders go out before any trial converts, before any annual renewal, before each rebill as a matter of good practice, and once a year regardless.

Cancellation lives in the patient portal as a button, completes in the same session, and produces a confirmation email that states the last billing date and what happens to any shipment already in progress. A save offer, if the brand wants one, appears on the same screen as the cancel button and never in place of it. The whole flow is logged, because the consent record and the cancellation record are what a regulator or a card network dispute will ask for.

A pause is a change to the agreement rather than an end to it, and it should be treated as a new consent. The pause screen states when billing and shipments stop, when they resume, and what the price will be on resumption. A reminder goes out before billing resumes, and the patient can cancel outright from the pause screen. Done this way, a pause keeps a large share of would-be cancellations inside the program without creating the surprise charge that turns into a dispute. The retention mechanics in from visits to recurring care assume this kind of design; a membership that retains by making cancellation hard is borrowing against an enforcement action.

A membership that retains by making cancellation hard is borrowing against an enforcement action.

The prescription wrinkle in a medication subscription

A telehealth membership differs from a streaming subscription in one respect that the statutes do not address: cancelling the membership is not the same as cancelling the treatment. The prescription was written by a licensed provider to a patient, the record belongs to the patient, and the medication in the pharmacy queue or in a cold-chain box on a truck does not stop existing because a billing flag changed. The membership design has to handle the clinical consequences without turning them into cancellation obstacles.

Several rules follow. The cancel button must work without a provider visit; the brand can offer a closing consult, and for some medications the treating provider may want one, but that is a clinical decision made available to the patient and never a step required before cancellation completes. Cancellation must stop the next refill from shipping and the next charge from posting, with the two events linked in the platform rather than handled by separate teams. A shipment already dispatched should be disclosed on the confirmation screen along with the refund policy for it. The provider should be notified, so that the patient's record shows the program ended and any continuity issues can be raised by the clinician. And the patient's records, including the prescription history, should be available to them on request after cancellation, which is a matter of medical records law as much as subscription law.

Marketing claims around the subscription matter here too. An introductory price that converts to a higher one, a "first month" offer, or a price that changes with dose all require fresh disclosure, and in weight-loss programs the same claims are subject to advertising rules covered in the weight-loss marketing claims guide. A brand that treats its pricing page, its checkout consent block and its cancellation screen as one document, drafted together, avoids the gap between what was promised and what was billed that most complaints describe.

What enforcement has looked like

The FTC's own press releases over the past several years describe a steady series of complaints against subscription sellers for undisclosed recurring charges, trial conversions without notice, and cancellation flows that required calls, chats or repeated confirmations, with several ending in settlements that included consumer refunds. Those cases were brought under Section 5 and ROSCA, not under the vacated rule, which is the clearest evidence that the vacatur changed little about the FTC's ability to act. At the state level, California's law is enforced by public prosecutors and through private actions, and announcements from district attorneys' offices in that state have described settlements with subscription businesses over disclosure and cancellation practices. The pattern in both sets of announcements is the same: the problem was rarely the existence of the subscription and almost always the gap between what the consumer was shown and what happened afterwards.

For a telehealth brand the exposure is compounded by the fact that regulators looking at subscription practices and regulators looking at prescribing practices tend to arrive together. A complaint about a cancellation flow invites a look at the consent, the marketing and the clinical documentation. A membership designed to the disclosure and cancellation rules is also a membership whose records survive that look.

Tessic Health's platform runs subscription billing with failed-payment recovery inside a storefront and patient portal that carry the brand's name, with the pharmacy and prescribing workflow on the same platform as the billing. Its own client terms follow the same principle: month to month after a one-time setup fee, and a client who leaves takes the brand, the legal entity, the patients, the records and the data, as the leaving-the-platform guide describes. A brand evaluating any platform should ask to see the checkout consent block, the cancellation screen and the pause screen as a patient would, and should check that a cancellation actually stops the refill.

Questions operators ask

• Does the vacated federal rule mean click to cancel is not required? At the federal level there is no rule with that name in force. ROSCA still requires a simple mechanism to stop recurring charges, and California's statute requires online cancellation without obstruction for anyone who signed up online. Designing to those covers the federal requirement whenever it returns.
• Is a checkbox required for consent? California requires affirmative consent to the agreement containing the renewal terms and forbids language that undermines it. A separate, unchecked box next to the disclosure block is the conservative reading and the one that produces a clean record.
• Can a save offer be shown at cancellation? Yes, with the cancel button displayed at the same time and in the same place, so the patient can decline the offer and finish in one step.
• Does a pause need its own consent? Treat it that way. A pause changes the billing schedule and sometimes the price on resumption, and the reminder before billing restarts is what keeps the resumed charge from being disputed.
• What about patients in states with no auto-renewal statute? ROSCA and Section 5 apply everywhere, and the card networks' rules for recurring billing apply to every charge. One flow, designed to the strictest state, is simpler than fifty.

The federal rule will return in some form; the advance notice makes that likely, and the timing unknown. A telehealth membership built to ROSCA and California's statute today needs nothing changed when it does. The design is the same either way: say what the charge is before the card is entered, get a real yes, remind before the price changes, and let the patient leave with one click and their records in hand.