Cancellation in same steps (or fewer) as enrollment

The FTC Click-to-Cancel Rule (effective 2025) mandates that cancellation be available in the same number of steps — or fewer — as enrollment. Requiring users to email support to cancel while allowing online self-service enrollment is an automatic regulatory violation regardless of how simple the enrollment was. California ARL imposes the same requirement. Cancellation friction is also the primary driver of 'friendly fraud' chargebacks: users who cannot cancel quickly dispute the charge with their bank instead, and Stripe's 0.75% dispute threshold has real consequences.

Implement self-service cancellation reachable in two clicks from the authenticated dashboard. The Stripe Billing Portal handles step-count compliance automatically. In app/api/billing-portal/route.ts:

export async function POST(req: Request) {
  const session = await getServerSession()
  if (!session?.user?.id) return new Response('Unauthorized', { status: 401 })

  const portalSession = await stripe.billingPortal.sessions.create({
    customer: await getStripeCustomerId(session.user.id),
    return_url: `${process.env.NEXT_PUBLIC_APP_URL}/settings/billing`,
  })

  return Response.redirect(portalSession.url)
}

Wire a 'Cancel subscription' button in app/settings/billing/page.tsx — not buried in an 'Advanced' section. Verify in Stripe Dashboard → Billing → Customer portal that 'Allow customers to cancel subscriptions' is enabled. Document the step count: enrollment steps vs. cancellation steps.