Legal

Compliance posture

Effective June 22, 2026

Retention that won't get you sued. Backstop is built so that easy cancellation is the default and your save flow can never quietly become a dark pattern. This page is the plain-English version of how we think about it and what we enforce. It is not legal advice — if you have questions, email support@trybackstop.com.

The legal landscape — stated accurately

  • The FTC's “Click-to-Cancel” Rule was vacated by the U.S. Court of Appeals for the Eighth Circuit on July 8, 2025, and is not in force. We don't market compliance with a rule that no longer exists — and you shouldn't rely on one.
  • The live obligations come from elsewhere: ROSCA(the federal Restore Online Shoppers' Confidence Act, which requires a simple cancellation mechanism), state automatic-renewal laws (ARLs) — California, New York, and a growing list of others, several of which require cancellation at least as easy as sign-up — and the EU cancellation button (the Consumer Rights Directive as amended, mandatory from June 2026).
  • The common thread across all of them: a customer must be able to cancel at least as easily as they signed up. That is the bar Backstop designs to.

What we enforce

  • A one-tap cancel on every step.Survey, save stories, offer, confirm — every step of every hosted cancel flow shows a persistent “cancel anyway” exit. Cancellation is never gated behind answering a survey or interacting with an offer.
  • The builder refuses to publish a trap.A cancel flow that can't reach cancellation — no confirmation step, no cancellation destination — is rejected at publish time, server-side, not just by convention. You cannot ship a flow that strands a customer.
  • Save offers are always optional and one-tap-declinable.Regulators (including the FTC) increasingly scrutinize “save” offers themselves, so the enforced exit is deliberate risk-reduction: the offer is a choice, never a toll booth.
  • EU customers get an explicit withdrawal affordance. When we can tell a customer is in the EU/EEA, the hosted cancel page surfaces a clear, immediate cancellation control in line with the EU cancellation-button requirement.
  • Everything is logged. Every cancellation, pause, plan switch, and accepted offer is written to your immutable audit log, so you can show your work if a regulator or a customer ever asks.

What this is — and isn't

Backstopgives you the controls and enforces the easy-cancel invariant; you choose your offers and the jurisdictions you operate in. We don't provide legal advice and we can't certify your specific setup against every state ARL — talk to your counsel for that. What we can promise is that the platform won't let you build a flow that buries the cancel button, and that the customer-facing copy here reflects the law as it actually stands.