Gym Membership Cancellation and Auto-Renewal Law in 2026: What Actually Applies After Click-to-Cancel Was Struck Down

Here is the short version: the federal “click-to-cancel” rule that most gym articles still tell you to prepare for does not exist anymore. A federal appeals court threw it out on July 8, 2025, days before it took effect. What governs your membership cancellations, auto-renewals, and marketing in 2026 is a stack of older federal laws (ROSCA, the FTC Act, the telemarketing and email rules) plus state auto-renewal laws, and state law is the layer that bites hardest. For a standard gym or studio the to-do list is small but non-optional: disclose renewal terms clearly, get real consent before you charge or text, let members cancel without a fight, and keep records. This post walks it, with sources, plus copy you can paste and a self-check you can run in ten minutes.

It is the first Monday of the month and a member emails to cancel. Your front desk offers a form, then a phone call, then “come in during staffed hours,” and the member replies with a screenshot of a headline about a federal law that says gyms have to let people cancel with one click. Your staffer freezes, because nobody at the desk knows if that law is real. Here is the honest answer, and why it still leaves you with work to do.

Table of contents

1. What actually changed: the click-to-cancel rule is gone
2. So what governs your gym now?
3. State law is the layer that bites
4. The marketing rules that carry the most risk
5. Does HIPAA apply to my gym? (Almost certainly not)
6. Steal this: compliant copy you can paste
7. Run it for your size: solo, studio, multi-location
8. Objections operators raise
9. The 10-minute compliance check
10. FAQ

What actually changed: the click-to-cancel rule is gone

For most of 2024 and 2025, the fitness press told gym owners the same thing: the FTC is about to force you to make cancellation as easy as signup, so get ready. That rule was real. It was the FTC’s 2024 Negative Option Rule, nicknamed “click-to-cancel.”

Then it died. On July 8, 2025, the U.S. Court of Appeals for the Eighth Circuit vacated the entire rule in Custom Communications, Inc. v. FTC, days before its main requirements were set to take effect on July 14. The court did not rule on whether easy cancellation is good policy. It threw the rule out on procedure, because the FTC skipped a required preliminary regulatory analysis after its own estimate showed the rule would cost more than $100 million a year (Mayer Brown, 2025; Latham & Watkins, 2025).

So in 2026 there is no federal click-to-cancel rule in effect. But the story is not over. In March 2026 the FTC opened a fresh advance notice of proposed rulemaking on negative-option marketing, with comments due April 13, 2026 (FTC, 2026). A new version could land within a year or two. This is the point most gym content misses: the federal rule is not “coming soon,” it is gone for now and may come back later. Either way the smart move is the same, make cancellation genuinely easy, because state law already leans that way and a rebuilt federal rule will too.

1. •
   Oct 2024

   FTC finalizes click-to-cancel

   The 2024 Negative Option Rule requires cancellation as simple as signup, with a mid-2025 compliance date.

2. •
   Jul 8, 2025

   Eighth Circuit vacates the rule

   Custom Communications, Inc. v. FTC throws out the entire rule on procedural grounds, days before it took effect.

3. •
   2025 to 2026

   State laws fill the gap

   A majority of states already have auto-renewal laws; several enacted or updated them in 2025.

4. •
   Mar 2026

   FTC restarts rulemaking

   The FTC opens a new advance notice of proposed rulemaking, with public comments due April 13, 2026.

So what governs your gym now?

With the flashy federal rule gone, the quieter laws that were always there are what you answer to. Four matter for a gym.

ROSCA (the Restore Online Shoppers’ Confidence Act) governs almost any recurring charge sold online: disclose all material terms clearly before you take payment details, get the buyer’s express informed consent before charging, and give a simple way to stop the charges (Cooley, 2024). If your website sells memberships, ROSCA already applies to you, and it did before click-to-cancel.

The Telemarketing Sales Rule (16 CFR Part 310) sets rules for recurring billing sold over the phone, including capturing express agreement to be charged (eCFR, 16 CFR Part 310). It bites hardest if you run a phone-sales team.

Section 5 of the FTC Act (15 U.S.C. 45) is the backstop. It bans “unfair or deceptive acts or practices,” and the FTC uses it when no specific rule fits (Congressional Research Service). A cancellation maze, a hidden auto-renewal, or a “results guaranteed” claim you cannot back up can all be a Section 5 problem with click-to-cancel gone.

State auto-renewal laws are the big one, covered next.

State law is the layer that bites

Here is what changed the most when the federal rule fell: nothing, at the state level. States never waited for the FTC. A majority already have automatic-renewal laws, and several enacted or tightened theirs in 2025, including Arkansas, California, Colorado, Connecticut, Maryland, Massachusetts, Minnesota, Utah, and New York (American Bar Association, 2025). If you sell an auto-renewing membership, you are almost certainly under one of them now.

California is the strictest, and it sets the bar the rest copy. California’s Automatic Renewal Law (Business and Professions Code section 17600 and following) requires clear and conspicuous disclosure of renewal terms, affirmative consent before you charge, and, for anyone who signed up online, the ability to cancel online without jumping through hoops. The state amended it again in 2025 (California Legislative Information; Wilson Sonsini, 2025). One California member means online cancellation is required, not optional.

New York regulates gyms specifically, and the penalty has teeth. General Business Law Article 30 (Health Club Services) is one of the most detailed health-club statutes in the country. What every operator with a New York location should know:

• Consumer money is protected. Depending on how you collect, you may have to hold prepaid member funds in escrow or post a bond, letter of credit, or certificate of deposit, with a carve-out for small prepaid amounts (NY GBL 622-a).
• Contracts are limited. Article 30 restricts how long a health-club contract can run and how much you can collect up front (NY GBL 623).
• Members have cancellation rights written into the statute, not just your contract.
• Non-compliant contracts can be void and unenforceable, and a member harmed by a violation can sue (NY GBL Article 30).
• You may need an AED on site. A club with 50 or more members has to keep an automated external defibrillator on the premises with certified staff during staffed hours (NY GBL 627-a).

That “void and unenforceable” line should get your attention. In New York, an agreement that breaks Article 30 is not a contract with a fine attached, it can be a contract you cannot enforce at all, which means dues you counted on may not be collectible. Other states are lighter, but the direction is the same everywhere: disclose, get consent, let people leave.

The marketing rules that carry the most risk

Ask most gym owners about compliance and they think about the membership contract. The bigger day-to-day risk is usually the marketing, because you do it constantly and at volume.

Texting: the TCPA and 10DLC. The Telephone Consumer Protection Act requires prior express written consent before a marketing text. The member has to agree in writing (a checkbox or e-signature counts) to receive marketing texts, and the agreement has to say clearly that agreeing is not a condition of buying anything. Separately, to send business texts over a normal 10-digit number in the US you have to register for A2P 10DLC through The Campaign Registry, and carriers now block unregistered traffic (Infobip, 2026). Why this matters more than the contract: TCPA damages run $500 to $1,500 per message. Do the math on one non-compliant blast.

Illustrative maximum TCPA exposure for a single non-compliant marketing blast, at the willful statutory rate of $1,500 per message (47 U.S.C. 227). One list of a thousand contacts is a seven-figure risk, which is why written consent and 10DLC registration are not optional.

Email: CAN-SPAM. Every marketing email needs accurate “from” and subject lines, a clear way to unsubscribe, and a real physical mailing address, and you have to honor an opt-out within 10 business days (FTC CAN-SPAM guide). A drip that keeps emailing someone who unsubscribed last week is the classic violation, easy to avoid with software that suppresses opt-outs automatically.

Results claims and testimonials: the FTC Endorsement Guides. This one catches fitness businesses more than any other, because transformation photos are the whole playbook. The Endorsement Guides (16 CFR Part 255) say a “results not typical” disclaimer does not cure a misleading atypical result. You either have proof the result is typical or you clearly disclose what a normal member can expect. You also have to disclose material connections, so if a member got a free month for their testimonial, or an influencer is paid, say so plainly (eCFR, 16 CFR Part 255).

For the deeper texting rules, our 2026 SMS playbook for gyms covers consent capture and no-show sequences in detail.

Does HIPAA apply to my gym? (Almost certainly not)

Short answer: no, not for a standard gym or PT business. HIPAA only binds “covered entities,” which are health plans, health-care clearinghouses, and providers that send health information electronically in standard HIPAA transactions, plus their business associates (HHS). A gym that stores member names, phone numbers, and workout notes is none of those.

The exception is real, though. The moment you add medical integration you can cross the line: an on-site physical therapy clinic that bills insurance, a physician-supervised program, or any setup where you transmit standard health-care transactions. If that is your model, get specific advice. For everyone else, do not let a vendor sell you a “HIPAA-compliant” upgrade you do not need. Good data hygiene is smart. HIPAA is not your rulebook.

Steal this: compliant copy you can paste

This is the part to bookmark. Real, usable copy for the five places compliance actually lives. Adapt the bracketed parts, and for anything contract-related, have your attorney confirm it fits your state.

1. SMS opt-in consent (put this next to the phone-number field):

By entering your number and checking this box, you agree to receive
recurring marketing and account texts from [GYM NAME] at the number
provided, including messages sent by autodialer. Consent is not a
condition of any purchase. Message and data rates may apply. Reply
STOP to opt out or HELP for help. See our Privacy Policy and Terms.

2. Membership auto-renewal disclosure (near the signup/pay button, clear and conspicuous):

Your [MONTHLY/ANNUAL] membership of $[PRICE] renews automatically
each [TERM] until you cancel. We will charge the card on file on
[RENEWAL DAY]. You can cancel anytime at [CANCEL LINK] or by
replying to any billing email. No cancellation fee.

3. Auto-renewal reminder (send before an annual or long-term renewal, which several states require):

Subject: Your [GYM NAME] membership renews on [DATE]

Hi [FIRST NAME], a heads-up that your [PLAN] membership renews on
[DATE] for $[AMOUNT]. No action needed if you want to keep training.
Want to change or cancel? Do it in two clicks here: [CANCEL LINK].

4. Cancellation confirmation (send the moment a member cancels, no “come in during staffed hours”):

Subject: You're cancelled, and you're welcome back anytime

Hi [FIRST NAME], your [GYM NAME] membership is cancelled as of
[DATE]. You won't be charged again. Your access runs through
[END DATE]. Nothing else to do. If this was a mistake, reply and
we'll fix it.

5. Testimonial and results disclosure (under any before/after or income claim):

Individual results vary and are not typical. [MEMBER]'s results
reflect their own effort over [TIME PERIOD]. [If applicable:]
This member received [free month / discount] in exchange for
sharing their story.

Run these through software instead of a staffer for one reason: consistency. A cancellation flow that works at 9 p.m. on a Sunday, an opt-out that suppresses across every future campaign, and a renewal reminder that fires automatically are exactly what a busy front desk forgets. That is the case for automating the compliant path, not just the sales path. Our failed-payment recovery guide shows the same idea applied to dunning.

Run it for your size: solo, studio, multi-location

The rules are the same for everyone. The priorities are not.

The solo or small PT team (20 to 100 clients)

You are the marketer, the closer, and the front desk. Your top two risks are texting and results claims, because you do both personally and often. Fix the two that matter: put a real written-consent checkbox on every intake form before you text a lead, and add the “results vary” line under every transformation post. If you sell any auto-renewing package online, add the renewal disclosure and an easy cancel link. You do not need a compliance department, you need a consent checkbox and a cancel link, both an afternoon’s work.

The boutique studio (80 to 250 members, 2 to 8 instructors)

Now volume is the risk. Class reminders, waitlist texts, win-back campaigns, and a real email list mean TCPA and CAN-SPAM exposure scales with your member count. The fix is systemic: capture consent at signup, register for 10DLC, and make opt-outs suppress automatically across every send. Add the auto-renewal reminder before annual renewals. Any California members means online cancellation has to actually work online. This is the size where “the front desk handles cancellations” quietly becomes a liability.

The mid-size or multi-location gym (250 to 500-plus members)

You have a studio’s volume and a small business’s contract complexity. If any location sits in a heavily regulated state like New York, Article 30 is a real project: escrow or bonding where required, contract terms inside the legal limits, statutory cancellation rights honored, and an AED on site past 50 members. Multi-state operators comply with the strictest state they run in, usually California for auto-renewal and New York for the contract. Standardize one compliant contract and one compliant marketing stack across every location rather than letting each site improvise.

Objections operators raise

“Isn’t this just a problem for the big chains?” No. State auto-renewal laws and the TCPA apply by the transaction, not by revenue. A solo trainer who sends one non-compliant text blast has the same per-message exposure as a chain, and small operators get caught more because they improvise consent and cancellation.

“The federal rule is gone, so why bother?” Because it was never your only exposure and it may return. State laws already require most of what click-to-cancel would have, the FTC reopened its rulemaking in March 2026 (FTC, 2026), and Section 5 covers a cancellation maze regardless. Build the compliant path now and you never have to scramble.

“Won’t an easy cancel button cost me members?” Usually the opposite. A hard cancellation does not save the member, it saves this month’s dues and earns a chargeback, a bad review, and a member who never returns. An easy cancel plus a genuine save offer at the moment of exit keeps more members than a maze, which is the whole idea behind a proper save flow.

“Do I need a lawyer?” For the contract, yes, once, in your state, especially in New York or California. For the marketing copy and cancellation flow, follow the patterns above and use software that enforces them. One legal review plus an operational fix.

The 10-minute compliance check

Run this today. If you cannot answer yes to each, that is your to-do list.

1. Does every form that collects a phone number have a clear written-consent checkbox that says consent is not required to buy?
2. Are you registered for A2P 10DLC so your texts actually deliver and are traceable?
3. Does an “unsubscribe” or “STOP” suppress that contact across every future campaign, automatically?
4. Do your marketing emails have a real physical address and a working one-click unsubscribe?
5. Is your auto-renewal disclosed clearly and conspicuously, right where the member agrees to pay?
6. Can a member who signed up online cancel online, without a phone call or a visit?
7. Do you send a renewal reminder before long-term or annual renewals?
8. Does every transformation photo or results claim carry a “results vary” line and any paid-connection disclosure?
9. If you operate in New York, does your contract fit Article 30, and do you have an AED once you pass 50 members?
10. Has a licensed attorney in your state reviewed your current membership agreement in the last two years?

The bottom line

The headline is that the federal click-to-cancel rule is gone. The reality is that almost nothing about your job changed, because state auto-renewal laws, ROSCA, the TCPA, CAN-SPAM, and the endorsement rules were always the layers that mattered, and they are all still here. The FTC is already drafting a replacement, so the easy-cancellation direction is not going away.

So do not wait for a rule to tell you to be clear and fair. Disclose your renewals, get real consent before you charge or text, let people leave without a fight, and keep records. Back at that front desk on Monday, the right answer to the member with the screenshot is simple: “You are right that the federal rule is gone, and you can still cancel right now, here is the link.” That is good compliance and good business at once. If you want the platform our own compliant system runs on, you can sign up for GoHighLevel through our partner link.

Written by Bryce Kendrick, Fitness Growth Strategist and GHL Snapshot Lead. Bryce spent eight years running the floor and front desk at a fast-growing CrossFit box before moving into GoHighLevel automation for gyms, where contracts, cancellations, and consent are daily front-desk problems. He writes direct, numbers-first, and allergic to fluff. This article is operational guidance, not legal advice.

Related posts

• How to Reduce Gym Membership Cancellations: The Save-Flow Playbook
• Text Message Marketing for Gyms: The 2026 SMS Playbook
• What Gym Software Actually Costs in 2026
• Failed Payment Recovery for Gyms