TOLLMINT 30 July 2026

Five laws your compliance tool still enforces that aren't law anymore

By the person who maintains the rule database

I keep a database of advertising and subscription rules. It's boring work. You read a statute, write down what it requires, save the link, and move on.

The interesting part turned out to be the opposite job: tracking which rules stopped being law. There are more of them than I expected, and they're the ones everybody still cites.

Here's the one that made me start paying attention. The FTC's Negative Option Rule, the one everyone calls Click-to-Cancel, was thrown out in full by the Eighth Circuit on 8 July 2025. Its compliance date was 14 July. It never took effect, not for a single day.

California's amended Automatic Renewal Law took effect on 1 July 2025. A week before the federal rule died.

So if you loosened your cancellation flow when the FTC rule fell, and you sell to anyone in California, you relaxed out of a rule that never bound you and into one that does. That's the part I think is worth knowing, and I've not seen anyone say it.

Why nobody notices

When an agency makes a rule, it produces a Federal Register notice, a press release, a compliance guide, a hundred law-firm client alerts and a year of conference talks. When a court kills that rule, it produces one opinion.

All the material from the first event stays online, written in the present tense, because it was true when it was written. The Federal Register page for the 2024 rule is still up and still reads like live law. Cornell's copy of 16 C.F.R. §425.6 still shows the vacated text.

Any tool that works by reading a lot of text will conclude the rule is in force, because that's what almost all of the text says. It's not stupidity. It's a counting problem, and the vacatur is one document against a thousand.

The five

FTC Negative Option Rule (Click-to-Cancel), 16 C.F.R. Part 425

Would have required cancellation at least as easy as signup, in the same medium, plus consent and disclosure before billing.

Vacated in full, 8 July 2025. Custom Commc'ns, Inc. v. FTC, No. 24-3137 (8th Cir.), per curiam. The FTC skipped a required regulatory analysis after its own judge found the rule would cost over $100M a year.

Still binding: ROSCA, 15 U.S.C. §8403, in force since 2010, plus FTC Act §5. The narrower 1973 rule survives. And the state laws are the sharp end: California §§17600–17606 as amended, and N.Y. Gen. Bus. Law §527-a, which between them require most of what the federal rule would have.

Federal Register 2024-25534

DOT airline ancillary-fee disclosure, 89 FR 34620

Would have required bag and change fees shown with the first fare results.

Vacated en banc, 3 February 2026. Airlines for America v. DOT, 166 F.4th 487 (5th Cir. 2026), for a notice-and-comment failure on the cost study.

Already replaced. DOT restored the 2011 framework in a new rule effective 2 July 2026. Checking against the 2024 version now gets you wrong twice over.

Federal Register 2024-08076

FCC one-to-one consent, former 47 C.F.R. §64.1200(f)(9)

Would have ended shared lead-generation consent by limiting it to one identified seller at a time.

Vacated 24 January 2025, one business day before it took effect on the 27th. Insurance Marketing Coalition v. FCC, No. 24-10277 (11th Cir.).

Still binding: the TCPA itself. Written consent is still required for autodialed marketing calls and texts. What died was the narrowing, not the requirement.

11th Cir. No. 24-10277 (this link was unreachable on my last check)

California AB 2839, election deepfakes, Elec. Code §20012

Banned materially deceptive election media about candidates in set windows.

Permanently enjoined 29 August 2025 on First Amendment grounds. Kohls v. Bonta (E.D. Cal.). The State has appealed to the Ninth Circuit, so this one isn't finished. It isn't enforceable today.

Coverage of the decision

California AB 2655, platform deepfake duties, Elec. Code §20510

Required large platforms to block or label deceptive election content.

Held preempted by Section 230, August 2025. X Corp. v. Bonta, heard alongside Kohls. Note it fell for a different reason than AB 2839, which is why treating "the California deepfake law" as one thing gets both wrong.

Case announcement

Try it on whatever you use

I'm not going to claim every compliance tool gets this wrong, because I haven't tested every compliance tool. Test yours instead:

Our checkout says "cancel anytime" and cancellation is by
email only, processed within 30 business days.
Which US rules does this violate, and cite them.

A good answer cites ROSCA and the state laws. A bad one cites 16 C.F.R. Part 425 or "the FTC Click-to-Cancel rule" as current, which is the tell.

For the record, I do sell this. My API checks copy against 225 rules and returns both what you trip and what's no longer law, with the court and date. It's $0.035 a call and needs no account. The corpus itself is free to read at /v1/agent/catalog if you want to check my work rather than take my word for it.

Not legal advice, and I'm not a lawyer. This is what the instruments say and how courts have treated them. Whether any of it applies to you depends on facts I can't see.

Accurate as of 28 July 2026. Three of these five changed status in the last eighteen months and one is on appeal right now, so any of it could move.

On sourcing: two of the five link to coverage of the decision rather than the opinion, and the Eleventh Circuit link didn't resolve when I last checked it. I'd rather say that than dress up a citation. If something here is wrong I want to know.