This is an opinion piece. It sets out the view of NerdBible's editors; the facts it relies on are sourced below.
Our position is simple: any paid protection plan you can start online in a few clicks should be cancellable online in a few clicks, whether or not a federal rule says so. That applies to identity theft protection, where, in our view, a plan is easy to forget once it is running. It applies equally to every other software subscription. The practice we object to is cancellation friction: phone-only exits, repeated retention screens, and renewal terms that are easy to miss at sign-up.
A recent enforcement story shows why this is not a niche complaint. To be clear about scope, nothing here is a claim about any identity protection vendor. The case below involves a retailer, and we cite it only for what the regulator itself says.
What the regulator said in September
On 17 September 2026 the Federal Trade Commission announced that Amazon will speed up and widen refunds under last year's $2.5 billion settlement. According to the FTC, that settlement resolved allegations that the retailer enrolled millions of consumers in Prime subscriptions without their consent and knowingly made it difficult for them to cancel. The money is split into up to $1.5 billion in consumer redress and a $1 billion civil penalty, and the FTC says more than $845 million in redress had been paid out as of September.
The revised court order, which the FTC says a federal court approved that week, changes three things. More people qualify, including consumers who used between 11 and 20 Prime benefits in a year. The cap on total payments rises from $51 to $200. And future payments are made automatically, so nobody has to file a claim. The FTC also warns that it is not contacting people about these refunds, and that anyone who claims to be from the FTC is likely a scammer.
The lesson for buyers is the size of the bill. When enrolment and exit are not symmetrical, the cost is measured in hundreds of millions of dollars, and in this case it took a federal agency to put right.
The rule that was meant to prevent this is not in force
You might assume a general federal "click to cancel" rule now covers this. It does not. According to a summary from the subscription-tracking company SubTracker, the FTC's 2024 amendments to its Negative Option Rule were vacated in full by the Eighth Circuit in July 2025 on procedural grounds, and the FTC opened a fresh rulemaking with an advance notice in March 2026. The same summary says nothing has replaced the rule yet. This is a commercial site's reading of the law, so treat it as a secondary source, and the FTC's own rulemaking pages are the place to check the current position.
What still applies, per that summary, is the Restore Online Shoppers' Confidence Act, which requires clear disclosure, informed consent and a simple way to stop recurring charges, along with the FTC Act's ban on unfair or deceptive practices and a growing set of state auto-renewal laws. In other words, the Amazon case was brought under existing law. The gap is not that the law is silent. It is that rules are slow, uneven by state, and enforced after the money has been taken.
Why a protection plan should lead, not follow
Regulators are also working on the other half of the problem, which is showing people the real terms up front. The FTC's press release page lists, in recent weeks, a settlement with an auto dealership group described as a price transparency win and a set of price transparency FAQs for auto dealers. Those are different industries, but the principle travels: the number and the exit route should be visible before you commit.
Protection services have a particular reason to take it seriously. In our view, people buy them for peace of mind and then stop thinking about them, which is exactly the situation in which an auto-renewal quietly continues. Our view is that vendors in this category should do the following without waiting to be told:
- Show the renewal price and renewal date next to the sign-up button, not only in the terms.
- Let customers cancel in the same place they bought, with no mandatory phone call or chat.
- Limit retention offers to one optional screen that can be skipped.
- Send a written confirmation of the cancellation, and state the refund policy in plain words.
- Email a reminder before each annual renewal.
None of that is exotic. It is the opposite of what the FTC alleged in the Prime case, that cancelling was knowingly made difficult.
The strongest counter-argument
The best case against our position goes like this. Retention offers can genuinely help customers, who sometimes leave in a hurry and would have taken a cheaper tier or a pause. A one-size-fits-all cancel button could remove those chances. Smaller vendors also face a patchwork of state rules and may reasonably want a single federal standard rather than guessing which one applies. And if the existing law already requires a simple cancellation mechanism, as the SubTracker summary describes, then perhaps the answer is more enforcement of the current rules, not a new design mandate from editors.
We take each point seriously. Retention offers are fine if they are optional and brief, which is why our list allows one skippable screen. A single clear federal rule would be welcome, and the vacating of the last one on procedural grounds rather than substance suggests the goal itself was not rejected. But enforcement after the fact is a poor substitute for design done properly in advance. A company that makes exit easy does not need to be sued into it, and customers who can leave easily are more likely to trust a service enough to join it.
What to do as a buyer
Before you subscribe to anything on an annual plan, find the renewal price and the cancellation route, and note the date in your calendar. If a cancellation is being obstructed, keep a record of when you signed up and when you asked to leave. Your state attorney general's consumer protection office and the FTC's ReportFraud site are the places the SubTracker summary points to for complaints. For anything involving your legal rights, speak to a qualified professional.
The Prime refunds are scheduled to continue into 2027. The practice behind them has not gone away. We would like buyers in every software category, identity protection included, to see an easy exit as a basic feature rather than a favour.
