Frames NYC as the first US jurisdiction to enact a serious ban on deceptive subscription practices after the FTC's federal rule was vacated by the Eighth Circuit in July 2025. Emphasizes that the ordinance reaches any company selling to NYC residents, giving it de facto national scope despite being municipal.
Submitted the Guardian piece to HN where it hit 492 points in six hours, signaling developer-community consensus that this ordinance matters as the first credible post-FTC-vacatur replacement. The rapid velocity of the submission reflects a shared view that municipal action is now the frontline for consumer-protection rulemaking.
Argues that California's SB-313 only mandates an 'online mechanism' to cancel, while NYC requires the cancel flow to mirror the sign-up flow in channel and click-count. This symmetry standard removes the wiggle room companies have exploited under weaker laws by burying cancellation behind phone trees or hidden menus.
Contends that dark-pattern cancellation flows are not UX oversights but deliberately A/B-tested retention mechanisms with KPIs like 'saves per cancel attempt.' The whole subscription economy depends on a soft floor of accidental revenue from users who forget to cancel, and the ordinance's renewal-notice and one-retention-offer caps directly attack that floor.
On July 10, the New York City Council passed the nation's first municipal ban on deceptive subscription practices, and Mayor Adams signed it the same afternoon. The ordinance takes effect in 90 days and applies to any company that sells a recurring-billing product to a New York City resident — meaning it reaches well past the five boroughs. Federal-scale enforcement, city-scale scope.
The rules are specific enough to be operationally meaningful. Cancellation must be available through the same channel the user signed up on: if they subscribed on the web, they must be able to cancel on the web, in the same number of clicks or fewer. Companies must send a renewal notice between 15 and 45 days before any auto-renewal of a term longer than one month. Free trials that auto-convert must disclose the exact conversion date and price on the sign-up screen, not in a footer. And retention offers — the "wait, take 50% off" interstitial — are capped at one, after which the cancel button must be honored without further friction.
The FTC's federal "click-to-cancel" rule was struck down by the Eighth Circuit in July 2025 on procedural grounds; NYC's ordinance is the first serious replacement to show up in US law. California's SB-313 covers some of the same ground but only requires an "online mechanism" — NYC requires symmetry with the sign-up flow, which is a materially stricter standard.
Subscription friction is not a UX accident. It is a modeled, A/B-tested revenue lever, and everyone in the room knows it. Retention teams have KPIs on "saves per cancel attempt." Growth teams have dashboards for trial-to-paid conversion that assume a non-trivial share of users forget to cancel. The whole subscription economy has a soft floor of accidental revenue underneath it, and this law goes directly at that floor.
The HN thread on the Guardian piece hit 492 points in about six hours, which is roughly what you'd expect for a story that lets developers vent about a fight they've been having with their own PMs for a decade. The top comments are not about civil liberties or regulatory overreach — they are engineers describing the specific dark patterns they were asked to build and refused, or built and regretted. That's the tell. This is a policy the practitioner class was already rooting for.
The interesting part isn't the rule itself — it's that "cancel flow" now moves from the growth team's backlog to the legal team's audit checklist, and those two teams optimize for opposite outcomes. Expect a quiet reorganization of who owns the billing surface inside every mid-sized SaaS. The PM who used to run experiments on the retention modal is now negotiating with counsel over how many words the confirmation copy is allowed to contain.
There's also a jurisdictional wrinkle worth taking seriously. The law applies to any company billing an NYC resident, not just companies headquartered in New York. Geofencing your cancel flow to only be simple for NYC IPs is technically possible and legally suicidal — the ordinance explicitly treats jurisdiction-based UX discrimination as evidence of the deceptive practice itself. In practice, if you comply for NYC, you comply for everyone. Which is, transparently, the point.
If you ship a subscription product, three concrete things need to happen in the next 90 days.
First, audit the cancel path. Count the clicks from a logged-in user's dashboard to a confirmed cancellation. Compare that number to the clicks from the marketing site to a successful checkout. If the cancel number is bigger, you have a compliance problem, not a UX problem. Same for channel symmetry: if your sign-up is web and your cancel requires calling a 1-800 number that's only staffed 9-5 Eastern, that path is now illegal for NYC customers, and you cannot detect NYC customers reliably enough to carve them out.
Second, the renewal notice requirement is going to break a lot of billing stacks quietly. Stripe, Chargebee, and Recurly all support scheduled reminder emails, but almost nobody has them turned on for monthly plans because monthly plans are exempt under the ordinance — the 15-to-45-day window only applies to terms longer than one month. Annual plans, though, are where the accidental-revenue math actually lives, and those now require a dated, itemized notice with the renewal price and a one-click cancel link. If your annual renewal email currently says "Your subscription will renew soon," it is not compliant. It needs the exact date, the exact amount, and a working link.
Third, and this is the one most teams will miss: your retention flow analytics need to change, because the metric you were optimizing is now capped by law. You get one save attempt. That's it. Any dashboard tracking "saves per attempt" as an unbounded number is measuring something that no longer exists. Rebuild the funnel around "one-shot save rate" and accept that the number will be lower, because it has to be.
One underrated implication for engineering teams: the audit trail matters more than the UX. The ordinance gives the NYC Department of Consumer and Worker Protection subpoena power over cancellation logs. If a customer complains, the city can ask for the timestamped event stream showing when the cancel button was rendered, clicked, and confirmed. If you don't log that today — and most product analytics setups don't, because "cancel" is a negative event nobody wanted a dashboard for — you're going to want to.
New York City is the opening move, not the closing one. California, Washington, and Colorado all have draft bills in committee that borrow language directly from the NYC ordinance, and the FTC is expected to refile its federal rule with the procedural defects addressed by end of year. The regulatory floor for subscription UX is rising, and it's rising fastest in exactly the jurisdictions where most of your paying customers live. The teams that treat this as a 90-day compliance sprint will be fine. The teams that treat it as an attack on their retention KPIs will spend the next two years relearning that dark patterns are, at best, a short-term loan against customer trust that the regulators are now calling due.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.