Negative option billing is the arrangement where your silence counts as a yes. You signed up once, or maybe you signed up for a free trial, and from then on the seller treats every month you fail to cancel as a fresh agreement to be charged. That is the whole mechanism. It sounds too simple to need a name, but the name is worth knowing, because two things follow from it that most people get wrong: canceling is difficult on purpose rather than by accident, and as of September 2026 no federal rule defines how difficult a company is allowed to make it.
The Federal Trade Commission has had a Negative Option Rule on the books since 1973. It covered almost nothing useful. The 1973 version addressed prenotification plans, the old book-and-record-club model where a company mails you a notice saying a shipment is coming and your failure to send back a card means you’ve bought it. Then subscriptions moved online and the model split into shapes the rule never anticipated: automatic renewals, continuity plans that keep shipping until you stop them, and free-to-pay conversions where a trial quietly becomes a charge.
The model is priced around the people who forget
A subscription business does not think of cancellation as a customer service event. It thinks of it as a rate. If a company knows that a predictable share of subscribers will keep paying past the point of using the service, that share is revenue it can forecast, borrow against, and report to investors. Every extra step between a customer and the cancel button moves the rate.
Amazon’s internal name for its Prime cancellation process was the Iliad Flow, after Homer’s epic, because getting through it took so long. The FTC sued over it, and in September 2025 Amazon agreed to a $2.5 billion settlement: a $1 billion civil penalty plus up to $1.5 billion in refunds to consumers the agency said were enrolled in Prime without their consent and then obstructed when they tried to leave. That case was brought under Section 5 of the FTC Act and a 2010 statute called ROSCA, not under any click-to-cancel rule. Nobody needed one.
The settlement is still paying out. On September 17, 2026, a federal court approved a revised order that expands the pool of eligible consumers, makes all future payments automatic, and raises the maximum any one person can receive from $51 to $200. Amazon had issued more than $845 million by that point. At the old $51 ceiling, $845 million works out to roughly 16.5 million payments, which gives you a sense of how many households were involved. Now scale the new ceiling down to a monthly bill: $200 across twelve months is $16.67 a month, about one mid-priced streaming service. The largest payment the government can arrange for you, in the record settlement the FTC has obtained over a subscription, is roughly what one forgotten subscription costs in a year.
Negative option billing survives your new card number
A common household strategy for killing a stubborn auto-renewal subscription is to let the card expire, or to report it lost and get a fresh number, on the theory that a dead card number kills the charge. It usually doesn’t work, and the reason is a piece of payments infrastructure most cardholders have never heard of.
Visa runs a service called Visa Account Updater, and Mastercard runs an equivalent called Automatic Billing Updater. When your issuer reissues a card, for expiration, loss, or fraud, it submits the new account number and expiration date to the network. Merchants who store your card on file and who have enrolled through their processor query the network and get the update. The subscription bills the new number, and nobody tells you it happened.
Cardholders are enrolled by default, and no action is required on your part to be included. That is the design intent, and it is not sinister on its face: the service exists so your gym membership and your phone bill do not fail every time a card gets replaced. The side effect is that a merchant you are trying to escape gets the same update your utility company does. Ask your issuer whether you can block the updater for a specific merchant, and keep in mind that stopping a payment at the bank is a different mechanism from ending the agreement with the seller, which is why a stop payment order does not cancel what you owe.
Federal law requires simple cancellation without saying what simple means
ROSCA, the Restore Online Shoppers’ Confidence Act, is the operative federal statute here. It requires a seller to clearly disclose all material terms before taking your billing information, to get your express informed consent before charging you, and to provide simple mechanisms for stopping recurring charges. Amazon’s $2.5 billion settlement came out of that statute, so the teeth are not theoretical.
The wording is, though. ROSCA does not say what counts as a material term, and it does not say what makes a cancellation mechanism simple. It also reaches only transactions made over the internet, so a subscription you signed up for by phone sits outside it. The 2024 Click-to-Cancel Rule was written to fill exactly that gap by requiring separate consent for the recurring charge and a cancellation path no harder than the sign-up path. On July 8, 2025, days before it took full effect, the Eighth Circuit vacated the rule in its entirety, finding the FTC had skipped a preliminary regulatory analysis the law required. The court did not rule on whether the requirements were good policy. It ruled on procedure.
The agency did not walk away. In March 2026 the FTC issued an advance notice of proposed rulemaking to build a replacement, with comments due April 13, 2026, and it has kept charging companies under Section 5 in the meantime. In its case against NextMed, as Jones Day noted in May 2026, the FTC alleged the same three failures the vacated rule described and simply called them deceptive practices instead. So the standard survives in enforcement even though it does not exist as a rule, which is a strange place for a consumer to stand.
Which state you live in decides how hard canceling is allowed to be
Roughly 30 states have their own automatic renewal statutes, and some of them are stricter than the federal rule that got struck down. California’s Automatic Renewal Law requires businesses to send periodic reminders disclosing the upcoming renewal, the price, and how to cancel. Amendments that took effect July 1, 2025 added a same-method cancellation requirement: sign up online and the business must let you cancel online, sign up by phone and it must take your cancellation by phone, including voicemail.
Your rights, in other words, depend on your address. A California subscriber and a subscriber in a state with no auto-renewal statute can hold identical accounts with the same company and have very different standing when they want out. Large national companies often build to the strictest state standard, since maintaining fifty cancellation flows costs more than maintaining one, and that is how people in states with no protection sometimes end up covered by a law that does not apply to them. It is not something to count on.
Once you see negative option billing as a pricing decision rather than a customer service failure, the practical response changes. Cancel on the same channel you signed up on, get a confirmation in writing, and check the card statement one full cycle later rather than assuming silence means it worked. If the charge reappears, that is a billing dispute with a defined process behind it, not a customer service problem, and the Fair Credit Billing Act gives you a written path your card issuer has to answer. The company is counting on you not bothering. That expectation is in the forecast.