A federal rule vacated, a city rule in force
On 1 October 2026, New York City's Department of Consumer and Worker Protection (DCWP) began enforcing the first municipal "click to cancel" rule in the country, 6 RCNY 5-110. Mayor Zohran Mamdani and DCWP Commissioner Samuel Levine announced its adoption on 10 July 2026, according to Covington's Inside Privacy summary. The rule requires businesses to let consumers cancel through the same medium they used to sign up, and it treats deceptive subscription practices as violations.
The rule exists because the federal version died. On 8 July 2025 the Eighth Circuit vacated the FTC's Click-to-Cancel Rule. The ruling was procedural. The FTC had not prepared a required preliminary regulatory analysis, and the court found the omission prejudicial. It did not decide whether easy cancellation was good policy. Cities and states have since moved to fill the space.
The strongest case for the rule
The case for regulating is substantial. Subscription traps are a textbook dark pattern: the business makes signing up take one click and cancelling take a phone call, a chat queue or a retention maze. Consumers face a real information and friction asymmetry. When the FTC finalized its rule in October 2024, it reported that it received nearly 70 consumer complaints per day on average in 2024, up from 42 per day in 2021. A symmetry rule is also easy to explain: if you can join online, you can leave online. Mayor Mamdani put it this way in April: "if you can sign up with a click, you must be able to cancel with one".
This is a defensible kind of intervention. It targets a specific, observable behavior rather than regulating product design in general, and it does not restrict anyone's speech.
Where the design is sound
The city rule is narrower than the sweeping "dark patterns" bills that worry innovation advocates. It does not ban persuasion or retention offers outright, and it does not dictate interface layouts. It sets a functional test about whether the exit route matches the entry route.
It also does not create a wholly new regime. Per Covington, the rule's substance largely mirrors New York State's autorenewal law, General Business Law § 527-a, which already covers in-person sign-ups. For compliant businesses, the incremental burden should be modest. That matters, because the most credible objection to local rulemaking is a patchwork of incompatible obligations. Here, a company that already follows state law is largely covered.
Where the risk lies
Three features deserve scrutiny.
First, the penalties are stiffer than the state's and lack a safety valve. Covington reports a fixed schedule of $525 for a first violation, $1,050 for a second and $3,500 for a third or subsequent one. State penalties start at $100. The state statute also has a bona fide error defense, which the city rule lacks. A small subscription business that misconfigures a cancellation flow for a week could therefore face per-violation exposure with no good-faith defense. Large platforms can absorb that. A two-person newsletter or a local gym cannot.
Second, the rule tightens the state's in-person requirement. Where a consumer signs up in person, the state statute accepts an online mechanism or a telephone number. The city rule mandates an online mechanism and drops the telephone option. That is a reasonable default for most businesses. It is a harder fit for providers whose customers are older or less connected, and who may prefer to call. The rule should be read with that audience in mind.
Third, there is a refund exposure tied to the first cancellation attempt. A violating business is liable for the amount charged after the consumer's first attempt to cancel. That aligns incentives well, but it creates disputes over what counts as an "attempt." Clear guidance and evidence standards from DCWP will determine whether this is predictable or litigious.
What the federal government is doing
Washington has not abandoned the field. On 11 March 2026 the FTC issued an advance notice of proposed rulemaking on the Negative Option Rule. It asks about practices that deter consumers from cancelling and floats options including keeping the current rule, adopting provisions of the vacated 2024 rule, or using non-regulatory alternatives. The FTC page does not use the phrase "dark patterns," and the outcome is open.
That sequencing is the real policy lesson. A federal rule that skips its own procedural steps gets vacated, and the result is not deregulation but a migration of the question to cities and states. If Washington wants uniform national cancellation standards, the way to get them is a rule that survives judicial review. Preemption by a clean federal standard would serve businesses and consumers better than fifty variants.
A proportionate path
The sensible response is neither to attack the city rule nor to treat it as a template for every interface mandate. The symmetry principle is narrow, testable and aimed at a documented harm. Enforcement should start with notice and cure for first-time, good-faith errors, and DCWP should publish examples of compliant flows. Policymakers elsewhere should keep the rule's structure of one behavior, one measurable test and no design micromanagement. They should reconsider whether strict liability with no error defense is necessary to achieve the goal.
The test of the next year is whether New York's rule produces fewer trap subscriptions without turning compliance into a trap of its own.