A lot of what gym owners have read about “click to cancel” is now out of date, and not by a little. The rule that made headlines in 2024 was struck down by a federal appeals court in mid-2025. Several widely shared gym-industry articles on the topic were updated after that date and still don’t mention it.
That gap matters, because “the federal rule is gone” is not the same thing as “gyms don’t have to worry about this anymore.” A separate federal law was already covering most of the same ground before the rule existed, and it still is. So is a growing list of states, and at least one city.
This piece skips the general explainer most gym software blogs already cover (what click-to-cancel meant, why it existed) and goes straight at what’s actually confusing right now: the current legal status, why “vacated” doesn’t mean “safe to ignore,” and what the layered reality looks like in a state like New York, where three separate rules now stack on top of each other.
The short answer: the rule is dead, the obligations aren’t
On July 8, 2025, the Eighth Circuit Court of Appeals vacated the FTC’s amended Negative Option Rule, commonly called the click-to-cancel rule, in Custom Communications, Inc. v. FTC. Per Mayer Brown, the court didn’t rule on the substance of the rule at all. It found the FTC had failed to complete a required preliminary regulatory analysis before finalizing it, a procedural failure the court called prejudicial regardless of whether it would have changed the outcome.
Then, on February 12, 2026, the FTC published a notice in the Federal Register formally restoring the Negative Option Rule to the version that existed before the 2024 amendment took effect. The FTC was explicit that this wasn’t a new rulemaking process. Per the Federal Register, the agency described the action as “simply undertaking the ministerial task of conforming these Rules to the results ordered by the circuit courts,” and treated it as exempt from public comment because it was responding directly to a court order rather than proposing anything new. There’s no announced timeline for a replacement rule, and no comment period underway.
So the practical status today: the 2024 click-to-cancel rule doesn’t exist. The pre-2024 version of the Negative Option Rule is back in force, which has a narrower set of requirements than the vacated 2024 version. And none of that changes what else already applied.
Why “vacated” doesn’t mean you’re off the hook
The 2024 rule was never the only thing standing between a gym and a cancellation complaint. The Restore Online Shoppers’ Confidence Act, ROSCA, has required clear disclosure, informed consent, and an easy cancellation path for online subscriptions since 2010, and the Eighth Circuit’s ruling didn’t touch it. The FTC has kept bringing ROSCA cases through the vacatur rather than around it.
A recent example makes the point without needing to be specific to gyms. Chegg, an online subscription education company, paid $7.5 million to settle FTC allegations that it hid how to cancel a subscription and made stopping the charges harder than starting them, exactly the pattern ROSCA is built to catch.
Per the FTC, the agency used the case to remind every subscription business, regardless of industry, that ROSCA’s three core requirements haven’t changed: disclose all material terms before collecting billing information, obtain express informed consent to the subscription itself, and provide a simple way to stop the charges. A gym billing members on a recurring cycle through an online signup falls squarely within that definition, rule or no rule.
State law is the real compliance floor now
With the federal rule narrowed back to its 2024-era baseline, state auto-renewal laws now carry more of the compliance burden than they did a year ago, and they vary more than a single generic list suggests. Per a Wiley Rein alert on the trend, several states have requirements that go beyond what any federal version of click-to-cancel ever demanded:
| State | What it actually requires |
| California | Annual reminder notice for indefinite-term memberships, with a working link or electronic method to cancel |
| Colorado | A genuine one-step online cancellation path for anyone who signed up online |
| Massachusetts | Internet cancellation available on the same website or app used to sign up, not a separate portal |
| Maryland | 14 days’ notice before a free trial converts into a paid membership |
| Minnesota | Annual reminder for indefinite memberships, and no “save” attempt unless the member affirmatively agrees to hear one |
| New York | A working cancel option inside any mobile app used for signup, on top of the state’s separate health club law |
| Utah | Only 3 days’ notice required before a free trial converts, the shortest window on this list |
That’s seven states with materially different rules, not one federal standard with local footnotes. A gym operating in two or three of these states is really complying with two or three different playbooks at once, and a cancellation flow copied from a generic national template will miss the specifics in most of them.
A closer look at New York, where three layers stack up
New York is worth walking through in detail because it shows what “state law is the real floor” actually looks like in practice, layer by layer.
The baseline is decades old. New York’s Health Club Services Act, General Business Law Article 30, already required a right to cancel within three days of signing, plus ongoing cancellation rights if a club closes, relocates more than 25 miles away, or a member has a doctor-certified disability lasting three months or more. The statute’s definition of a covered “health club” is broader than most gym owners assume. Per Article 30, Section 621, it explicitly names “martial arts and self-defense schools” alongside gyms, health spas, and figure salons, so a dojo or self-defense studio in New York is not exempt from health club cancellation law just because it doesn’t look like a typical gym.
A 2025 amendment modernized the cancellation channels. The law now requires clubs to accept cancellations through the club’s website, email, telephone, mail, or in person, not just through whichever single channel a club prefers, and tightens refund processing to within ten business days of a valid cancellation request.
And a city rule now sits on top of the state rule. New York City’s Department of Consumer and Worker Protection issued compliance letters to gyms tied to Executive Order No. 10, signed January 5, 2026, requiring any business that lets a consumer sign up online to accept a cancellation notice through that same website, and to secure affirmative consent for the subscription itself and for any price increase. Per the DCWP’s own compliance letter, violations “will result in civil penalties, as appropriate.” The letter doesn’t publish a specific dollar figure, so a New York City gym is better served checking current DCWP guidance directly than trusting a fixed number repeated secondhand.
The same Wiley alert cited above notes that New York has already brought enforcement action under this statute, flagging an action against Aneva Gym over an in-person-only cancellation requirement. A separate, larger example shows the stakes even more plainly.
In May 2025, the New York Attorney General secured $600,000 from Equinox Group, plus refunds for affected members, after finding the company buried membership terms in dense fine print, didn’t secure proper consent for auto-renewal, and made cancellation “complex, difficult, and time-consuming.” Per the NY Attorney General, Attorney General James put it directly: “New Yorkers should be able to cancel a membership they no longer use or want without breaking a sweat.” That’s a large, well-known fitness brand, not a small operator, which is itself worth noting: size doesn’t appear to have bought Equinox any leniency here.
Self-audit: where does your cancellation flow actually stand
Before changing anything, it’s worth answering these honestly, since the gaps that cause real complaints are usually specific and fixable:
- Can a member who signed up online cancel through that same website or app, without calling or visiting in person?
- Is your notice period, cancellation fee, and refund timeline written down and shown before someone signs, not just in a contract clause they’ll read later?
- Does your team ever require a retention conversation to happen before processing a cancellation, rather than alongside it?
- If a free trial converts to a paid membership, how much notice does the member actually get, and does it meet the shortest window that could apply to them?
- Do you have a dated, retrievable record of when and how each member consented to auto-renewal, not just that they’re currently billed?
- If your gym operates in more than one state, does your cancellation policy actually differ by state, or is it one national policy that satisfies the strictest state and ignores the rest?
Turning the audit into a fix
None of this requires reinventing a cancellation process from scratch. It requires ensuring the process matches how members actually signed up and that it leaves a record.
The consistent thread across every enforcement example above, federal or state, is the same: cancellation was harder than signup, consent was buried instead of disclosed, or there was no clean record of what a member agreed to. Fixing that means matching the cancellation channel to the signup channel, putting notice periods and fees in front of a member before they sign rather than after, keeping dated proof of consent that isn’t just “they’re on the billing list,” and making sure a save offer is something a member can decline in one step, not a gate they have to get through first.
Where Wellyx fits
Wellyx doesn’t replace legal review of your specific state and city obligations, but it removes a lot of the operational friction that turns a compliant policy into a working one. Members manage their own bookings, cancellations, and reschedules from the same self-service portal they use for everything else, rather than being routed to a phone line or front desk.
Notice periods, cancellation fees, and refund rules are configurable per membership type, so a gym running memberships across more than one state isn’t stuck applying one national policy everywhere. Freeze management gives members a genuine pause option for injury, travel, or a temporary move, without forcing a full cancellation and re-signup later.
On the billing side, every payment, void, write-off, and refund is searchable and exportable to PDF, CSV, or Excel, which is exactly the kind of dated, retrievable record a state investigator or a member dispute tends to ask for. Failed-payment handling runs through configurable retry logic and dunning reminders rather than an immediate lockout, with a grace period that keeps a member’s access intact while the payment issue gets resolved. None of it is a substitute for knowing what your specific state requires, but it’s built so that once you do, the software isn’t the reason your policy and your practice don’t match.
Owner action checklist
- Confirm whether your gym’s cancellation channel matches its signup channel in every state you operate in, not just your home state.
- Pull your current membership agreement and check that notice periods, fees, and refund timelines are disclosed before signup, not buried in a later clause.
- If you’re in New York, confirm your cancellation intake accepts website, email, phone, mail, and in-person requests, and that refunds process within ten business days.
- If you’re a martial arts, self-defense, or similar training business in New York, don’t assume the health club law doesn’t apply to you; per the law’s own definition, it likely does.
- Review any free-trial-to-paid conversion flow against the shortest notice window that could apply to your states (currently 3 days in Utah).
- Keep a dated record of consent for every auto-renewal, not just an active billing status.
Frequently asked questions
Is the FTC’s click-to-cancel rule still in effect?
The 2024 version isn’t. The Eighth Circuit vacated it in July 2025, and the FTC’s February 2026 action restored the earlier, narrower version of the Negative Option Rule rather than writing a new one. ROSCA and state laws still apply regardless of this rule’s status.
Does ROSCA still apply to gym memberships after the click-to-cancel rule was vacated?
Yes. ROSCA is a separate 2010 law that the Eighth Circuit ruling didn’t touch. It requires clear disclosure, informed consent, and a simple cancellation mechanism for any online subscription, including recurring gym memberships, and the FTC continues to enforce it actively.
Which states require gyms to offer online cancellation?
California, Colorado, Massachusetts, Maryland, Minnesota, New York, and Utah all have specific requirements, though they differ in scope. Colorado and Massachusetts require a genuine online cancellation path; others focus on renewal notices or trial-conversion timing instead. State requirements continue to change, so check your own state directly rather than assuming it isn’t covered.
Does New York’s health club law cover martial arts and self-defense schools?
Yes. New York’s General Business Law Article 30 defines “health club” broadly enough to explicitly name martial arts and self-defense schools alongside gyms and health spas, so those businesses are subject to the same cancellation and refund rules as a traditional gym.
What happens if a gym doesn’t comply with cancellation laws?
Consequences vary by jurisdiction. New York’s Attorney General secured $600,000 from Equinox Group in 2025 over hard-to-cancel memberships, and the FTC settled with subscription company Chegg for $7.5 million under ROSCA. NYC’s Executive Order No. 10 also allows civil penalties, though it doesn’t publish a fixed schedule.
The bottom line
The rule that made “click to cancel” a household phrase in the gym industry is gone. The obligations that existed before it, along with newer state requirements, are not. Treating the vacatur as the end of the story is the single most common mistake in how this topic gets covered right now, and it’s an easy one to avoid: match your cancellation channel to your signup channel, disclose terms before someone signs rather than after, and keep a dated record of consent. That covers most of what ROSCA, the restored federal rule, and the state laws above all require.
For the wider legal picture beyond cancellations, including waivers, ADA access, and employment rules, see Wellyx’s gym legal compliance guide.
