Yesterday upon the stair,
I met a man who wasn’t there!
He wasn’t there again today.
I wish, I wish he’d go away!
Antigonish – William Hughes Mearns, 1899.
There’s a rule like that in my line of work. You’ve met it on the stair. It’s been dead for a year.
If you spend any time near online compliance, you have watched people cite the FTC’s “click to cancel” rule in the last few months – in a webinar, in a vendor’s email, in a LinkedIn post with a confident little graphic. Some cite it as the law you must follow. Some cite it as the law that got struck down, so relax. It doesn’t much matter which, because both camps are doing the same thing: talking with total assurance about a rule that is not there. It wasn’t there again today. And nobody seems to wish it would go away, because a rule that isn’t there turns out to be enormously convenient. You can make it mean whatever you need it to mean at eleven o’clock on a Tuesday when a client asks.
This is stranger than ordinary misinformation, and I want to sit in exactly how strange it is before I let it go. Misinformation usually spreads among people who don’t know any better. This spread among people whose entire professional identity is knowing better. Compliance people. Legal marketers. Vendors who sell trust for a living. The class of person whose one job, above all others, is to read the actual thing and tell you what it actually says. And somewhere along the line, a great many of them stopped reading the actual thing.
Because here is the actual thing, and it took me less time to find than this paragraph took to write. On the 8th of July 2025, the Eighth Circuit vacated the amended rule. It died on procedure – the FTC skipped a required economic analysis – not on any finding that hard-to-cancel design is fine. The court didn’t bless the cancellation maze. It never reached the question. I’m not going to relitigate the law here; that’s a job for a tidy explainer with numbered sources, and I’ve argued the facts of it elsewhere. What I can’t stop turning over is a different question, and it’s not really a legal one at all.
How does a citation outlive the thing it points to?
There’s a word for this, and I love it the way you love a word that finally names something you’d only felt. Citogenesis. Randall Munroe coined it – the loop where somebody writes a false claim somewhere, a lazy writer repeats it, and then the repetition becomes the citation. The rumor cites the rumor. The false thing acquires a paper trail, and the paper trail is made entirely of other people who also didn’t check. Round and round, each lap conferring more authority, until the claim is so well-attested that checking it feels almost rude. Everybody knows. Everybody knows because everybody said. Everybody said because everybody knew.
Watch it happen with click to cancel. A vendor’s blog cites a trade-press piece. The trade-press piece was working off another vendor’s webinar. The webinar said “the FTC rule” and never mentioned it no longer exists, because the person giving it was working off a blog. Nowhere in that chain does anyone cite the court. The court is right there. It’s free. It’s searchable. And the entire ecosystem routed around it, because the primary source is long and the summary of the summary is short and confident and fits on a slide.
The part that I think is true, and… damning: the false version wins because it’s better – not truer, better. Better in every way that folklore is selected for. “The rule is dead” is a cleaner headline than “the rule is dead but the statute underneath it, the one nobody’s talking about, just pulled two and a half billion dollars out of Amazon.” One of those you can say in four words and move on. The other one requires you to have read something. Folklore doesn’t optimize for accuracy. It optimizes for repeatability, for comfort, for how easily it travels from one mouth to the next. The reassuring version is a better organism. It out-competes the truth in the only environment that matters, which is other people’s attention, and it does it every single time.
I could stop here, and it would be a fun little essay about how professionals are credulous and the internet is a game of telephone with a compliance budget. *raspberry* But that’s not what my thinking space is for, and I’ve seen this exact reflex before.
It’s the overlay that “handles ADA compliance.” It’s the audit that “passed.” It’s the accessibility statement generated from a template that nobody has tested against a single screen reader, sitting proudly at the bottom of a site that a person cannot use to buy a coat. It is, in every case, the identical move: I trust the summary so I don’t have to meet the source. Citing “the FTC rule” instead of reading the opinion is the same act as trusting the compliance badge instead of listening to your own page. Both let you feel informed without doing the one thing that would actually inform you. Both are shortcuts around the primary source – and in accessibility, the primary source is a human being trying to use the thing you built.
Let me give you my favorite example. Every accessibility vendor keeps a number on slide four: fixing an issue after release costs up to a hundred times more than building it in right. It comes attributed to “IBM studies,” which sounds unimpeachable, so nobody checks. I checked – and I don’t mean I clicked, I mean I dug, the way you had to dig before a chatbot would hand you a confident lie on demand. The “IBM study” is a 2008 sales brochure for two code-debugging tools. It’s about memory leaks. The word “accessibility” appears nowhere in it. Its number isn’t a hundred, it’s thirty – and the brochure doesn’t even claim the thirty as its own; it credits a 2002 report from NIST. So I read the NIST report. That table isn’t in it: NIST’s cost-by-stage numbers come from two earlier studies, from 1976 and 1995, and they’re different numbers again – the 1976 one, Boehm’s, being the actual headwater everyone downstream has been paraphrasing badly ever since.
Five hops. At each one the number moved, or the subject moved, or the source moved, and the only thing that survived every hop intact was the word that made it sound true: IBM. And the original brochure? I had to pull it out of the Wayback Machine. The receipt for the entire edifice is a cached copy of a sales flyer. The internet remembers – barely, and not for much longer. We are, all of us, out here quoting a memory of a memory of a flyer, to sell the idea that other people should check their work.
That’s the whole essay, really. The person who never read the opinion and the person who never listened to the page are running the same shortcut. They have decided, without ever quite deciding it out loud, that the confident secondhand version is close enough. And the difference between the two – the only difference that matters – is who pays when the secondhand version is wrong. Misread a court ruling and you might embarrass yourself in a webinar. Misread whether your site works, coast on the badge, cite the overlay’s own marketing back to yourself as evidence, and the bill goes to someone who was never in the room and never took the shortcut and never got a vote. You already know I know which one I care about.
Here I run out of tidy ending, and I’d rather admit that than fake one. I don’t have the trick that fixes this. I can tell you to read the opinion, test with the screen reader, meet the source – and I do, I am, consider it told – but I know exactly how much that’s worth against “everybody already knows,” which has never once lost a fair fight over what a tired person will do at 4pm. The incentives all point the other way.
All I’ve really got is the poem I painted on my wall as a teenager. The rule wasn’t there. It wasn’t there again today. And an entire industry keeps climbing the same staircase to shake its hand – not because they’re fools, but because the thing that isn’t there is so much easier to live with than the thing that is.
I wish, I wish it’d go away. It won’t. So the least I can do is stop pretending I’ve met it.
Receipts (because an essay about people who don’t cite their sources had better cite its own):
The vacatur: Custom Communications, Inc. v. FTC, 8th Cir., 8 July 2025 – the opinion.
The accessibility “100x” claim in the wild: Deque, “The Business Case for Accessibility.”
What it actually points to: IBM Rational, Minimizing code defects to improve software quality and lower development costs, October 2008 (says 30x, about code defects, credits NIST).
What that points to: NIST, The Economic Impacts of Inadequate Infrastructure for Software Testing, May 2002 – whose cost-by-stage table credits Boehm (1976) and Baziuk (1995), not IBM, and not those numbers.
On how these figures became folklore in the first place: Laurent Bossavit, The Leprechauns of Software Engineering: How Folklore Turns Into Fact and What to Do About It – and his dig into the phantom “IBM Systems Sciences Institute” citation.
Disclosure: I work at Silktide. These are my own views, painted on my own wall.