If you sell subscriptions to customers in New York City — SaaS seats, subscription boxes, meal kits, gym memberships, streaming add-ons, annual maintenance plans — your compliance obligations changed overnight on October 1. The city's Department of Consumer and Worker Protection (DCWP) has begun enforcing the nation's first municipal click-to-cancel rule, and the consumer complaint portal is already live. Every renewal you bill from here on out is billable only if your sign-up disclosures, cancellation path, and renewal notices meet the new standard.
This is not a re-run of the federal rule that died last year. It is a separate city enforcement regime with its own penalty schedule, its own notice windows, and — critically — no good-faith-mistake defense. Here is what the rule requires, how it differs from New York State law you may already follow, and the compliance checklist to work through now.
What the Rule Covers
The rule applies to automatic-renewal and continuous-service subscriptions for goods and services offered to NYC consumers. The trigger is where your customer is, not where your business sits: a subscription seller in Texas with New York City subscribers is in scope for those accounts. If any meaningful share of your subscriber base lives in the five boroughs, assume the rule reaches you.
A few categories are expressly exempt, including banks, credit unions, entities regulated by the New York Department of Financial Services, New York-licensed security alarm operators, and sellers of service contracts under New York Insurance Law. Everyone else selling recurring billing into the city — from solo founders with a Stripe subscription product to national gym chains — should assume coverage and confirm any exemption claim with counsel rather than guessing.
Violations are treated as deceptive trade practices under the NYC Consumer Protection Law, which means DCWP enforces them directly with per-violation civil penalties. City enforcement plus a public complaint portal is exposure enough to take seriously from day one.
The Three Core Requirements
1. Disclose material terms before asking for payment
Before requesting consent or billing information, you must clearly and conspicuously disclose the material terms: the amount and frequency of charges, the cancellation deadline for stopping further charges, and the available cancellation methods. For free trials or temporary pricing, you must also explain how and when the price will change — the trial-to-paid conversion terms cannot live in fine print three screens away from the card field.
"Before requesting billing information" is the operative phrase. A checkout page that collects the card number first and explains the renewal terms on the confirmation page has the sequence backwards. Audit your sign-up flow with fresh eyes: every material term visible, in plain language, ahead of the payment fields.
2. Make cancellation as easy as enrollment
Cancellation must be as simple as enrollment and available through the same avenues. Signed up online in two clicks? The customer must be able to cancel online in comparably few steps. And there is a specific trap for in-person sellers: where enrollment happens face to face, you must also provide an online cancellation mechanism, such as a website or email address. A gym or studio that signs members at the front desk and cancels them only by phone or in person is now noncompliant for its NYC members.
3. Do not obstruct the exit
The rule spells out prohibited obstruction in unusual detail: obscuring cancellation instructions, imposing unreasonable conditions, hanging up on consumers, failing to acknowledge cancellation requests, or unreasonably delaying processing. Retention offers ("save" screens, pause options, discount counter-offers) are not banned outright, but every additional screen between the customer and confirmation is litigation surface. If your cancellation flow has more than one intervening offer wall, simplify it now — the revenue you save on a retained subscriber is not worth a per-violation penalty stack.
The Three Notice Windows
Beyond disclosures and cancellation mechanics, the rule prescribes advance-notice timing for three situations. These are calendar obligations your billing system must execute automatically:
- Long renewals. For subscriptions with an initial paid term of at least one year that renew for at least six months, notify the customer 15 to 45 days before the cancellation deadline. Think annual SaaS contracts, yearly memberships, and multi-month service plans.
- Material changes. Price increases and other material term changes require notice 5 to 30 days before the change takes effect. If you are planning a January price increase, the notice machinery must be built now, not in December.
- Trial conversions. When a free gift or trial lasting more than one month converts to a paid period, notify the customer 3 to 21 days before the cancellation deadline for the first chargeable period. Short trials of a month or less escape this window, but the trial-to-paid pricing disclosure at sign-up still applies.
Notice windows vary across the roughly 30 states with their own auto-renewal laws, so if you sell nationally, configure your system to satisfy the strictest applicable window per customer rather than maintaining fifty billing calendars. Your billing platform's dunning and reminder emails are the natural place to implement this — but verify the timing math against the NYC windows specifically.
Why New York State Compliance Is Not Enough
If you already comply with New York's amended Automatic Renewal Law (General Business Law Section 527-a), you are close — but the city rule deliberately tightens three things:
Online cancellation is mandatory for in-person sign-ups. State law lets businesses offer cancellation by telephone or online for in-person enrollments. The city rule drops the telephone option: an online mechanism is required. Phone-only cancellation for front-desk sign-ups fails the city test.
Penalties are higher and uncapped per incident. State law caps penalties at $100 for a single violation and $500 for multiple violations arising from one act (rising to $500 and $1,000 for knowing violations). The city schedule runs $525 for a first violation, $1,050 for a second, and $3,500 for a third or subsequent violation — per violation, with each deceptive statement, description, or omission counting separately. A single noncompliant checkout page shown to thousands of NYC subscribers is not one $525 ticket; it is per-violation exposure that scales with your subscriber count.
There is no bona fide error defense. State law excuses unintentional violations resulting from genuine mistakes despite reasonable procedures. The city rule contains no equivalent safe harbor. "Our vendor's template was wrong" is a conversation, not a defense.
Restitution is formulaic. Under state law, restitution is left to court discretion in Attorney General actions. The city rule defines the measure: a violating business owes the amounts charged to the consumer after the consumer's first attempt to cancel. Note the word "attempt" — a cancellation request your system failed to acknowledge still starts the restitution clock. Timestamped cancellation-attempt logs are now a financial control, not just a support nicety.
The Federal Backdrop in 60 Seconds
The FTC finalized a national click-to-cancel rule in October 2024, but the Eighth Circuit vacated it in July 2025 on procedural grounds. In March 2026 the FTC issued an Advance Notice of Proposed Rulemaking signaling a possible replacement, with no timetable announced. Meanwhile, states have filled the gap — around 30 now have auto-renewal or cancellation statutes, with new or amended laws taking effect in 2026 alone in states including Colorado, Connecticut, Maine, Maryland, and Virginia. NYC's rule adds a municipal layer on top of that patchwork. Separately, City Hall paired the click-to-cancel rollout with a proposed junk-fees rule requiring upfront all-in pricing, which went to a public hearing in August — subscription sellers should watch that proceeding too, since drip-priced fees at checkout are its target.
Your Compliance Checklist
Work through these in order. The first three close the highest-risk gaps; the rest harden the operation.
- Screenshot and audit every sign-up flow. Capture each enrollment path — web, mobile, in-person, phone — and verify that amount, frequency, cancellation deadline, and cancellation methods appear clearly before any billing information is requested. Fix trial-to-paid pricing disclosures at the same time.
- Map every enrollment medium to a cancellation medium. For each way a customer can sign up, confirm an equally simple cancellation route exists in the same medium. Add an online cancellation channel (web flow or monitored email inbox) for every in-person enrollment path.
- Strip obstruction from the cancellation flow. Remove multi-screen retention mazes, repeal any policy of transferring canceling callers to retention queues that hang up or stall, and make sure every cancellation request — including emailed ones — gets a prompt written acknowledgment.
- Program the three notice windows. Configure 15-to-45-day renewal notices, 5-to-30-day material-change notices, and 3-to-21-day trial-conversion notices in your billing system, and log every sent notice with its timestamp.
- Log cancellation attempts immutably. Because restitution runs from the first attempt, your support and billing systems must record every cancellation request the moment it arrives — including failed, partial, and disputed ones — with timestamps you can produce to an examiner.
- Confirm exemptions in writing. If you believe banking, DFS-regulation, alarm-operator, or service-contract exemptions cover you, get that conclusion from counsel in writing. Do not self-certify an exemption on a blog post's summary.
- Train front-line staff. Anyone who handles cancellations by phone or in person needs to know the acknowledgment and no-obstruction rules. One rogue retention script can create per-violation exposure across every affected subscriber.
The Bookkeeping Side: Reserves, Restitution, and Nondeductible Penalties
Compliance is a legal project, but the exposure lands on your books. Three accounting implications deserve attention before year-end.
Restitution reserves. Because the city defines restitution as everything billed after the first cancellation attempt, each unresolved NYC cancellation dispute is a measurable contingent liability: months billed since the attempt, times the subscription rate. Track disputed NYC accounts in a separate subledger so you can estimate a refund-and-restitution reserve instead of discovering the number during an enforcement action. Your June-vintage subscription accounting — deferred revenue as a contract liability, refund liabilities for cancellation rights — now needs a NYC-specific overlay driven by attempt timestamps.
Penalty exposure and deductibility. Civil penalties paid to a government for violating the law are generally nondeductible for federal income tax purposes, and restitution follows a different, fact-specific analysis — get your CPA's read before assuming either treatment. If DCWP opens an inquiry, evaluate whether a loss contingency is probable and estimable enough to accrue. Either way, keep penalty and restitution accounting strictly separate from ordinary refund accounting; they tell different stories to a lender or acquirer reading your statements.
Systems and notice costs. Notice-window automation, cancellation-attempt logging, and flow rebuilds are real implementation costs hitting this quarter. Capitalize versus expense under your normal software-cost policy, and keep the invoices organized — if enforcement ever turns on whether your procedures were reasonable, documented investment in compliance systems is the exhibit you want.
Dashboards that break out subscription liabilities, refund reserves, and dispute aging by jurisdiction turn this from a scramble into a routine close item — the Fava dashboards visualize exactly these liability accounts from your ledger data.
Keep Your Subscription Revenue Audit-Ready
The era of treating cancellation flows as a growth-hack surface is over in the country's largest city — and with 30 states running their own variants, the compliant flow you build for NYC is the flow you should run everywhere. Getting the disclosures, notices, and attempt logs right now protects both your renewal revenue and your balance sheet.
As you tighten up subscription compliance, maintaining transparent financial records for recurring revenue, refund reserves, and dispute liabilities is essential. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and see why developers and finance professionals are switching to plain-text accounting.
