Leaving takes two steps

What the pledge says

Pledge P-2 is one of the five pledges a director signs and publishes on every member’s record. It reads, in substance:

• a customer can cancel online, from the account page;
• it takes two steps or fewer;
• no one has to phone, open a chat or talk to anyone;
• confirmation arrives straight away, on screen and by email.

It sits in a data standard because a subscription people can’t leave is a way of keeping them, and their data, without their say. A customer who can walk away easily is a customer who chose to stay.

Why we count steps, not parity

The common slogan is “as easy to leave as to join”. The UK government used it when it announced its subscription rules in August 2026. We like the idea, but it doesn’t measure well.

Signing up has work in it that cancelling doesn’t need: choosing a plan, entering a card, giving a delivery address, agreeing to terms. Some of that is there to protect the customer. A strict parity test either lets a long sign-up excuse a long exit, or asks you to strip out checks that do real work.

So we count. From the signed-in account page:

1. Step one: a clearly labelled “Cancel subscription” control.
2. Step two: a confirmation screen that says what ends and when, with one button to confirm.

That’s it. A single retention offer is fine if it sits on the confirmation screen, beside the confirm button, and doesn’t replace it. A separate offer page, a survey you must fill in, or a “call us to finish” is a third step, and the pledge is broken.

Two steps is a number a reviewer can check by clicking through, which fits how we work: proof beats promises.

Where the law stands

Several jurisdictions have now written similar rules. The detail differs, so check the ones that apply to you.

Germany. Since 1 July 2022, §312k of the German Civil Code (BGB) has required a cancellation button for consumer contracts for ongoing services made through a website. The first button is labelled “Verträge hier kündigen” (cancel contracts here) or something equally clear. It leads to a confirmation page with a “jetzt kündigen” (cancel now) button. The business must confirm the cancellation electronically, straight away, with the date and time and when the contract ends.

European Union. Directive (EU) 2023/2673 added Article 11a to the Consumer Rights Directive. Member states had to transpose it by 19 December 2025, and it has applied since 19 June 2026. For distance contracts concluded online, traders must offer a “withdraw from contract here” function, then a “confirm withdrawal” step, and send an acknowledgement on a durable medium such as email without undue delay. Note the scope: this is the 14-day statutory right of withdrawal, not cancelling a subscription later on. The function has to stay available for the whole withdrawal period, and commentators read it as meaning a customer who is already signed in shouldn’t have to identify themselves again. If you sell to consumers in the EU, it applies to you wherever you are based.

United Kingdom. The Digital Markets, Competition and Consumers Act 2024 creates a new subscription contracts regime: clearer information before sign-up, renewal reminders, a cooling-off period after trials and renewals, and an easier exit. Commencement has moved several times. In April 2026 the government said spring 2027. On 9 August 2026 it announced that the rules will come into force in January 2027. As of mid-September 2026, commentators note that the secondary legislation and CMA guidance still have to be published, so the exact date and the detailed cancellation requirements aren’t final. Expect a duty to let people end a contract online in a straightforward way, without phoning or emailing.

United States, federal. The FTC’s 2024 “click-to-cancel” amendments to its Negative Option Rule were vacated by the Eighth Circuit on 8 July 2025 (Custom Communications, Inc. v. FTC), on procedural grounds: the FTC hadn’t done the preliminary regulatory analysis the law requires. The FTC restarted: an advance notice of proposed rulemaking was published on 13 March 2026, with comments due 13 April 2026. At the time of writing no new proposed rule has been published. The FTC still brings cases under the Restore Online Shoppers’ Confidence Act (ROSCA).

California. AB 2863 amended the state’s Automatic Renewal Law from 1 July 2025. If a customer signed up online, they must be able to cancel online, at will, without steps that obstruct or delay, through a direct link or button (or a pre-written termination email). If you show a save offer, a “click to cancel” button has to appear alongside it. There is also a yearly reminder requirement.

None of these is our standard, and our pledge doesn’t depend on them. But a member that keeps P-2 will find most of the work for these laws already done.

Fine and Never

Deleting the account

Cancelling a subscription and deleting an account are different things, and both should be easy. For deletion, asking the customer to re-enter their password or confirm by email is fine. That protects them from someone who has picked up an unlocked phone. What’s not fine is sending them to support, asking for a reason before you’ll act, or turning “delete” into “deactivate” without saying so.

Leaving means the data goes too

Cancelling isn’t the end of the job. Pledge P-3 asks members to keep only what they need and to state how long they keep it. When someone leaves:

• delete or anonymise their profile, preferences and behavioural data on the schedule in your data map;
• keep invoices and order records only for as long as tax and accounting law requires, and say so;
• remove them from email tools and any other processors listed on your data map, not just your own database.

There is one thing to keep: a suppression record. If someone has told you to stop marketing to them, keep just enough to make sure you don’t contact them again, usually an email address or a hash of it held only for this purpose, and a date. The UK Information Commissioner’s Office says suppression involves “keeping just enough information about someone to ensure you respect their preferences in the future”, and that people have no automatic right to have that list deleted, because it isn’t used for marketing. Don’t let it grow into a list of former customers.