Total:
$0.00
If you sell contact lenses, you probably sell a replenishment plan. It is the best subscription product in eyewear: the customer’s need is genuinely recurring, the reorder is genuinely tedious, and the lifetime value of a solved reorder is the reason half the direct-to-consumer lens brands exist.
Signing up for one takes about forty seconds. That is not an accident — it is the single most optimised flow in the business.
On 1 October 2026, a New York City rule took effect that turns those forty seconds into a legal standard. Not a standard for how you sell. A standard for how you must let people leave.
The rule that was supposed to be dead
Most merchants stopped paying attention to click-to-cancel in the summer of 2025, and they had a good reason. The Federal Trade Commission’s Negative Option Rule — the federal click-to-cancel rule, the one with the compliance countdown in every e-commerce newsletter — was vacated in its entirety by the Eighth Circuit in July 2025, on procedural grounds, before its enforcement date.
That was widely reported as the end of the subject. It was the end of one instrument. The obligation went somewhere else, in three directions at once.
First, the FTC restarted. It submitted an Advance Notice of Proposed Rulemaking to the Office of Information and Regulatory Affairs on 30 January 2026, which is the beginning of a replacement rather than a replacement.
Second, and more immediately, the FTC kept bringing cases without the rule, under the Restore Online Shoppers’ Confidence Act and section 5 of the FTC Act. The cases are instructive about what a regulator considers too hard: the amended complaint against Uber, December 2025, alleges a cancellation path running to as many as 23 screens and 32 separate actions. Chegg settled for $7.5 million in September 2025 over buried multi-step cancellation flows and billing after cancellation. There is a pending action against LA Fitness over cancellation available only in person or by certified mail.
Update, 7 October 2026: that enforcement route has now reached this industry. On 2 October 2026 the FTC and the Utah and Nevada Attorneys General filed a joint complaint against a contact lens retailer, pleading ROSCA among six statutes, over checkout fee presentation and an auto-refill plan. We cover that complaint, and how ROSCA’s standard differs from this rule’s, here. The allegations are untested and no finding has been made.
Third — and this is the part nobody sent a newsletter about — cities and states filled the gap. New York City’s Department of Consumer and Worker Protection adopted its own rule on 8 May 2026, and it took effect on 1 October 2026.
It is in force. It has been for five days as this is published.
What the rule actually says
The citation, for your counsel: Title 6 of the Rules of the City of New York, Chapter 5, Subchapter A, new Part 8 — sections 5-110, 5-110.1, 5-110.2 and 5-110.3 — together with an amendment to section 6-47. The authority is sections 1043 and 2203(d), (f) and (h)(1) of the City Charter and sections 20-702 and 20-703 of the Administrative Code. The effective-date provision is one sentence: “This rule takes effect October 1, 2026.”
Here is the duty, in the rule’s own words:
“A person making an automatic renewal or continuous service offer to a consumer must provide the consumer with the option to cancel at any time using a simple cancellation mechanism that is as easy to use as the mechanism that the consumer used to provide consent and that is through the same medium that the consumer used to provide consent.”
Read that sentence twice, because it does something unusual.
It does not tell you what your cancellation flow has to look like. There is no maximum number of clicks in it. No required button. No prescribed page. Nothing you can build once, certify, and forget.
It tells you that your cancellation flow has to be as easy to use as your sign-up flow, and in the same medium as your sign-up flow. The standard is not in the rule. The standard is in your checkout.
The consequence, stated plainly
Two merchants can have byte-for-byte identical cancellation pages and be on opposite sides of this line, because the line is drawn by what each of them did at the other end of the relationship.
And it runs in the direction nobody wants:
Every piece of friction you removed from signing up is friction you are now forbidden to add to cancelling.
One-tap subscribe at checkout is the conversion win every subscription vendor sells you. Under this rule, one-tap subscribe buys you a one-tap cancellation obligation. Accept a subscription through an express wallet button in two seconds, and a cancellation flow that takes a phone call during business hours is not a near miss — it is in a different medium entirely, which is the second limb of the sentence and the easier one to fail.
The better your funnel, the stricter your duty. That is a genuinely strange incentive, and it is the rule’s actual design rather than an accident of drafting: the city has declined to set an absolute standard and has instead held each merchant to its own.
Is a lens subscription in scope? Yes, twice over
The rule defines its two triggers, and both are quoted here verbatim:
“Continuous service” means a plan or arrangement in which a subscription or purchasing agreement continues until the consumer cancels the service.
“Automatic renewal” means a plan or arrangement in which a paid subscription or purchasing agreement is automatically renewed at the end of a definite term for a subsequent term.
A contact lens replenishment plan that ships every 30 or 90 days until cancelled is a continuous service on the face of the first definition. A twelve-month supply plan that renews for another twelve months is an automatic renewal under the second. Most lens programmes are one or the other and a good number are both.
There is an exemption list, at section 5-110.3, and it is worth knowing exactly what is on it, because merchants tend to hope. The exempt categories are: businesses operating under a franchise issued by a political subdivision of New York State; entities regulated by the Department of Financial Services; security system alarm operators licensed by the Department of State; banks, bank holding companies, credit unions and other licensed financial institutions; and sellers and administrators of service contracts as defined by section 7902 of the Insurance Law.
Utilities, finance, alarms and warranties. There is no retail exemption, no small-business exemption, no out-of-state exemption and no health-products exemption. If you sell a lens plan to somebody in New York City, you are inside this.
The money, and where it is measured from
The penalty schedule got the attention, and it is a ladder rather than a number — the amendment to section 6-47 prices by violation number: $525 for a first violation, $1,050 for a second, $3,500 for a third and subsequent. Worth getting right, because both the low figure and the high figure circulated this year as though each were the whole schedule, and each is one rung of it.
But the penalties are not the exposure. This is:
“If a person is found to have violated any provision of this part, such person is liable for the monetary amount charged for the automatic renewal or continuous service offer after the consumer’s first attempt at cancellation.”
That is section 5-110.2, and it is the most commercially significant sentence in the rule.
Notice what the clock starts on. Not a complaint. Not a notice of violation. Not a finding, an investigation, or a letter from the city. The consumer’s first attempt at cancellation.
Every charge after a customer first tried to leave and could not is recoverable. On a $40-a-month lens plan where the customer tried to cancel in a chat window in March and finally got through on the phone in September, that is six months of charges — per customer, and the number of customers is not something you get to estimate, because the trigger is an event that already happened in systems you already run.
Your support desk logged it. Your chat transcripts have it. Your subscription app recorded the failed portal session. The measure of liability is sitting in your own tooling, timestamped, and it was accruing before anybody told you this rule existed.
How the rule reaches a remedy
The rule does not create its own cause of action. It does something more economical, at section 5-110.1:
“It is a deceptive and unconscionable trade practice for any person to offer or provide an automatic renewal or continuous service to a consumer except in accordance with the requirements of this section.”
“Deceptive and unconscionable trade practice” is the operative category of the City’s Consumer Protection Law. The rule creates the duty and then borrows that law’s remedies wholesale, which is why the citation at the top includes section 20-703 of the Administrative Code.
So: what remedies does that classification carry, and in particular is there a private right of action for a consumer, or is this the Department of Consumer and Worker Protection alone?
Updated 7 October 2026. When this article was first published we could not establish the answer and said so. We have since read the relevant sections, and the position has three parts.
The City’s Consumer Protection Law does not appear to grant one. Reading sections 20-700 to 20-706 of the Administrative Code section by section, the enforcement mechanisms run through the Commissioner and the City; no sentence in those sections permits an injured consumer to bring their own action for damages. One caveat: the published texts available to us are not certified as the current enacted text, and the penalty figures in them are lower than the current rules schedule, so we report the structure rather than today’s numbers.
The State automatic renewal statute is explicitly Attorney General enforcement. General Business Law section 527-a provides that “an application may be made by the attorney general in the name of the people of the state of New York” for an injunction, with restitution at the court’s direction. It names no private claimant, and it carries a bona fide error defence.
But New York has a general consumer statute that does grant one. General Business Law section 349(h) lets “any person who has been injured by reason of any deceptive act or deceptive practice made unlawful by this section” sue in their own name, for actual damages or fifty dollars whichever is greater, trebled up to one thousand dollars for a willful or knowing violation — and critically, “the court may award reasonable attorney’s fees to a prevailing plaintiff”. That fee-shifting sentence is what makes a small claim worth bringing.
The live question is the qualifier. Section 349(h) reaches a deceptive act made unlawful by section 349 itself, not a breach of any other statute or city rule. So whether a bare breach of this cancellation duty, with no other deception, is pleadable as a section 349 deceptive act is not something we can answer, and we are not going to assert it in either direction. That is the question to put to your counsel, and it is a more useful one than the question we left here last week.
Correction, 7 October 2026. This article originally said that New York State’s automatic renewal statute was described only in secondary commentary as requiring cancellation “as simple as signing up”, and that the City rule was the instrument that added same medium to as easy as. That was wrong. We have now read General Business Law section 527-a directly. Its subsection 1(d) makes it unlawful to
“fail to provide the consumer with the option to cancel at any time using a simple cancellation mechanism that is as easy to use as the mechanism that the consumer used to provide consent and that is through the same medium that the consumer used to provide consent”
— which is the City rule’s sentence word for word, in a State statute, in force since 13 December 2023 on secondary commentary’s dating, and scoped to “a consumer in this state” rather than to the five boroughs. The exemption lists match as well. So the duty described in this article is not six days old and is not a City innovation; what the City added was the penalty ladder, the first-cancellation-attempt liability measure, and no visible bona fide error defence. We set out the State statute, its bona fide error defence and its unconditional-gift provision in full here. Nothing in this correction reduces what you have to do — it means you have owed it for longer, in more of New York.
What this looks like in the eyewear market right now
Two facts, both checked rather than reasoned, because a rule about interfaces can only be assessed against real interfaces.
Fact one: a major lens subscription cancels by telephone
Hubble is among the best-known contact lens subscription brands. Its published help page, read on 6 October 2026, states:
“You may cancel your subscription by calling us at 1-844-334-1640 between 9AM and 5PM EST, Monday through Friday, and 1PM and 5PM, Saturday, excluding federal holidays.”
The page adds that “California customers may also cancel their subscriptions via email”.
We are describing a public page, not alleging a violation: we do not know whether a different flow is offered to New York City customers, and the page may change. But look at the shape of it against the sentence quoted earlier. Consent is given on a website, in a minute, at any hour. Cancellation is a telephone call inside business hours on weekdays and four hours on a Saturday. That is not a harder version of the same medium. It is a different medium, which is the limb of section 5-110 that does not require anyone to argue about degrees of difficulty.
And note what the California sentence tells you. A jurisdiction-specific cancellation channel already exists in that business, because California’s automatic renewal law required one. The engineering is not the obstacle. The obstacle is that each jurisdiction asks for something slightly different, and a channel built to satisfy California — email — does not obviously satisfy a rule that asks for the same medium as consent.
Fact two: your subscription app probably has a switch for this, and churn advice says to flip it
If you run subscriptions on Shopify, cancellation is a configuration, not a capability question.
Shopify Subscriptions supports customer self-service cancellation in the customer portal, and it is immediate: “If customers cancel their subscription, then billing and delivery ends immediately. Canceling a subscription cannot be undone.” Whether those controls are surfaced to the customer depends on your account and checkout pages, which the documentation describes as something you customise. We could not establish from the documentation what the default state is, which is itself the point: if you cannot tell from the docs, you cannot tell from the docs, and you need to open your own storefront as a logged-in customer and look.
Third-party apps are more explicit, and one of them states the compliance problem better than we could. Seal Subscriptions’ own guidance on the customer portal says of the pause and cancel controls:
“If you wish to, you can also disable these in the settings, however, keep in mind that disabling them prevents your customers from pausing and canceling their subscriptions and they will have to contact you to cancel their subscriptions instead.”
That is a documented setting, in a mainstream app, which converts a compliant flow into a non-compliant one with a checkbox. The same guidance notes that merchants can stop customers editing a subscription until a minimum number of payments is reached.
Nobody ticked that box maliciously. It gets ticked because a retention consultant pointed out that customers who have to ask a human to cancel sometimes do not, and that is true, and it was an entirely ordinary thing to do in 2024. As of 1 October it is the configuration most likely to put a New York City customer’s subsequent charges on the wrong side of section 5-110.2.
If you do one thing after reading this, open your own store in a private window, subscribe to something, and then try to cancel it the way a customer would. Most merchants have never done this. The ones who have usually find the answer in under four minutes.
Six things to do
1. Time your own two flows and compare them. How many screens and actions to subscribe; how many to cancel. Write both numbers down. That comparison is the legal test, which makes this the rare compliance exercise you can run yourself in an afternoon without counsel.
2. Check the medium before you check the difficulty. If a customer can subscribe on the website and cannot cancel on the website, stop optimising and fix that. The same-medium limb requires no argument about relative ease, and it is the one most flows fail.
3. Find the cancellation toggle in your subscription app and look at its value. Not what you remember setting. Its current value. If it is off, you have a decision to make that is now a legal decision rather than a retention one.
4. Pull your failed-cancellation data before anyone asks for it. Support tickets, chat transcripts and portal sessions where a customer tried to cancel and was still billed afterwards. Section 5-110.2 measures liability from that moment, so you want to know the size of the number. Ask your counsel about retention and privilege before you build a report.
5. Do not rely on a 2025 memo that says click-to-cancel is dead. It was accurate about the federal rule and says nothing about this one. If your compliance file closed in July 2025, it closed on the wrong instrument.
6. Ask whether you need a geography switch at all. Many merchants will find that complying everywhere is cheaper than detecting New York City customers and treating them differently — particularly since the rule’s standard is set by your own sign-up flow, so a single compliant cancellation path satisfies it for everyone. Jurisdiction-specific cancellation flows are how businesses end up with the Hubble shape: one channel per statute and no channel that works for the customer in front of them.
The line is drawn by what you already built
Something worth noticing about where this rule sits in the year’s pile.
Most of the rules landing on eyewear in 2026 draw their line somewhere you can look up. Whether the frame is a medical device. What you printed on the case. Where you are established. Who holds the right to sue you over a script. In each case the line is in the instrument, and you work out which side you are on by reading it.
This one is not like that. Section 5-110 is a complete duty with its content left blank, to be filled in by the merchant’s own prior design decisions. The nearest relative in this series is the British complaint-handling duty that turns on what your own terms already promised — the same self-referential move, where your past conduct sets the standard your present conduct is judged against. What is new here is the thing doing the measuring. Not your terms and conditions. Your interface.
That is a meaningful change in where compliance lives. A duty defined by your own checkout cannot be discharged by the legal team, because the legal team did not build the checkout, and it cannot be audited from a document, because the document is a Figma file that no longer matches production. It can only be discharged by someone opening the storefront and trying to leave.
There is also a quieter point for anyone running a subscription at all. The reason cancellation friction works is that it converts indifference into revenue, and the reason it is being regulated city by city is that regulators have decided that is not a business model. Every instrument in this area — the vacated federal rule, the ROSCA cases, the state statutes, this rule — is pointed at the same thing: the gap between how hard you made it to say yes and how hard you made it to say no. Closing that gap voluntarily is the only version of this that does not need redoing each time a city adopts a rule.
And if a subscription only holds customers because they cannot work out how to leave, the subscription was never the asset. The reorder being genuinely easy is the asset.
Frequently asked questions
We are not in New York. Does this apply to us?
It turns on where the consumer is, not where you are. A rule in the City’s consumer protection code reaches offers made to consumers in the city, and nothing in the exemption list carves out out-of-state sellers. The State statute is scoped the same way, to “a consumer in this state”. If you ship lens subscriptions to the five boroughs, assume you are in scope and take advice.
Our cancellation flow is three clicks. Is that compliant?
Unanswerable in the abstract, and that is the whole character of this rule. Three clicks to cancel against a one-click express-wallet subscribe is a worse ratio than five clicks to cancel against a five-step configured sign-up. Compare the two flows you actually have.
Can we keep a retention offer in the cancellation path?
Not a question this rule answers cleanly, and we are not going to pretend otherwise. The duty is that the mechanism be “as easy to use” as the consent mechanism and in the same medium. A single clearly skippable offer on the way out is a different thing from a sequence of interstitials that must each be dismissed, and the Uber complaint’s 23 screens shows where a regulator’s patience ends. Where the boundary sits between those two is for counsel.
Does pausing count as cancelling?
No. The rule gives the consumer “the option to cancel at any time”. A pause control is a useful retention tool and a good thing to offer, but a portal that offers pause and not cancel does not provide the option the rule requires.
Is there a private right of action?
Not on the face of the City’s Consumer Protection Law, and not under the State automatic renewal statute, which is Attorney General enforcement. But New York’s general consumer statute, General Business Law section 349(h), does give an injured person their own action with attorney’s fees available to a prevailing plaintiff. The open question is whether a breach of the cancellation duty alone can be pleaded as a deceptive act under section 349, which reaches conduct made unlawful by that section rather than by this rule. We do not assert an answer either way. See the updated section above, and ask your counsel.
What about the FTC rule — is it coming back?
Something probably is. The rule was vacated in July 2025 and the Commission put an Advance Notice of Proposed Rulemaking into interagency review on 30 January 2026, which is an early step with no fixed timetable. In the meantime the FTC is bringing cancellation cases under ROSCA and section 5 of the FTC Act, which it was always able to do and is plainly still doing — including, since 2 October 2026, against a contact lens retailer.
Our subscription is for a prescription product. Does that change anything?
Not under this rule. The exemptions are franchises, Department of Financial Services entities, licensed alarm operators, financial institutions and service contract sellers. There is no health or prescription carve-out. A lens subscription’s prescription obligations are a separate body of law with separate requirements, and the two do not offset each other.
Does this have anything to do with the privacy rules you have written about?
No, and the distinction is worth holding. The biometric cases are about what you may collect from a customer and on what consent. This rule is about what a customer may do to end a contract. Different statutes, different regulators, different remedies — and this one has the unusual property that your own storefront supplies the standard.
This article is general information about regulatory developments, not legal advice. It quotes the rule as adopted and read on 6 October 2026, and was updated and corrected on 7 October 2026. Whether and how it reaches you depends on your subscription terms, your sign-up and cancellation flows, your platform configuration and where your customers are. One significant question is expressly left open here: whether a breach of the cancellation duty alone is actionable as a deceptive act under General Business Law section 349. Take advice on your own position before changing or keeping a cancellation flow.
VisioncarePro adds structured prescription capture and lens selection to any Shopify product page, so the step that actually determines order value happens where the customer already is. Free to install.
Install VisioncarePro free on the Shopify App Store →
New to selling prescription eyewear online? Start with our complete guide to selling prescription glasses on Shopify.
Sources: New York City Department of Consumer and Worker Protection, Notice of Adoption, “Click to Cancel Rule”, nyc.gov, read directly — Title 6 RCNY Chapter 5, Subchapter A, Part 8, sections 5-110, 5-110.1, 5-110.2 and 5-110.3 and the amendment to section 6-47; adopted 8 May 2026; authority NYC Charter ss. 1043 and 2203(d), (f) and (h)(1) and Administrative Code ss. 20-702 and 20-703. The cancellation-mechanism sentence of section 5-110, the whole of section 5-110.1, the liability sentence of section 5-110.2, the five exempt categories in section 5-110.3, both definitions and the effective-date sentence were each quoted verbatim from that document · penalty amounts of $525, $1,050 and $3,500 by violation number, from the amended section 6-47 · Eighth Circuit vacatur of the FTC Negative Option Rule, July 2025, from contemporaneous law firm analyses (Cooley, Crowell, Steptoe, National Law Review); the opinion itself not read · Goodwin, “FTC’s ‘Click-to-Cancel’ Rule Gets New Life”, 13 February 2026, for the Advance Notice of Proposed Rulemaking submitted to OIRA on 30 January 2026, for continued enforcement under ROSCA and section 5 of the FTC Act, and for the Uber (amended December 2025, 23 screens and 32 actions), Fitness International (August 2025) and Chegg ($7.5 million, September 2025) matters · Federal Trade Commission press release, 2 October 2026, for the joint FTC, Utah and Nevada complaint against a contact lens retailer in the District of Nevada; allegations only, no finding made · Hubble Contacts published help page, read 6 October 2026, for the telephone cancellation instruction and the California email alternative, quoted verbatim · Shopify Help Center, Shopify Subscriptions customer experience documentation, for the immediate-cancellation behaviour of the customer portal and for account page customisation; the default visibility state of those controls is not established by that documentation · Seal Subscriptions customer portal guidance, for the documented setting that disables the pause and cancel controls, quoted verbatim, and for the minimum-payments restriction · New York General Business Law section 527-a, read directly on 7 October 2026 — subsection 1(d), the Attorney General enforcement and civil penalty provision, the bona fide error defence and the exempt categories quoted verbatim; the 13 December 2023 effective date is from secondary commentary and was not confirmed against the session law · New York General Business Law section 349(h), quoted verbatim · New York City Administrative Code sections 20-700 to 20-706, reviewed section by section on two published sources, neither certified as the current enacted text. Whether a breach of the cancellation duty alone is actionable under section 349: not established.
