Auto-Renewal and Subscription Compliance: The Rules That Govern Recurring Charges Before Customers Click Subscribe

By Hank FasthoffJuly 6, 2026

If your business charges customers on a recurring basis, federal and state regulators treat the sign-up flow, the renewal process, and the cancellation mechanism as compliance events. Every subscription enrollment that doesn't meet disclosure and consent requirements is a potential enforcement action. Every cancellation that's harder than sign-up is evidence of an unfair practice. And every free trial that converts to a paid subscription without proper notice is a deceptive act. The regulatory framework governing auto-renewal has expanded significantly since 2024, with new federal requirements, strengthened state laws, and enforcement actions producing penalties in the hundreds of millions of dollars.

ROSCA. The Federal Baseline

ROSCA, the Restore Online Shoppers' Confidence Act (15 U.S.C. §§ 8401-8405), applies to every business that charges consumers for goods or services sold online through a negative option feature (an arrangement where the customer's silence or failure to cancel is treated as acceptance of the offer).

ROSCA imposes three requirements. First, the business must disclose all material terms of the transaction before obtaining the consumer's billing information. "Material terms" includes that the subscription will automatically renew, the renewal period, the renewal price, and how to cancel. Second, the business must obtain the consumer's express informed consent before charging. A pre-checked box doesn't constitute express informed consent. The consumer must take an affirmative action that specifically indicates agreement to the recurring charge. Third, the business must provide simple mechanisms for the consumer to stop recurring charges.

A violation of ROSCA constitutes a violation of an FTC rule, which means the FTC can seek both consumer redress and civil penalties. Enforcement has been aggressive. In September 2025, the FTC secured a $2.5 billion settlement against Amazon for practices related to its Prime membership enrollment and cancellation processes. In December 2025, Instacart agreed to pay $60 million in consumer refunds for failing to disclose that a free trial membership would automatically convert to a paid annual subscription. In August 2025, the FTC brought an action against LA Fitness for requiring in-person cancellation even when members signed up online.

The FTC's Negative Option Rule

In late 2024, the FTC finalized amendments to its Negative Option Rule (16 CFR Part 425), requiring that cancellation be at least as easy as sign-up (the "click-to-cancel" requirement), that businesses obtain express informed consent with disclosure of material terms before charging, and that businesses send pre-renewal reminders before annual subscriptions renew. Portions of the amended rule took effect in January 2025 (prohibition on material misrepresentations), with additional requirements scheduled for July 14, 2025.

On July 8, 2025, the Eighth Circuit vacated the amended rule, holding that the FTC failed to conduct a required preliminary regulatory analysis. The FTC submitted an Advance Notice of Proposed Rulemaking (ANPRM) to OIRA on January 30, 2026, signaling its intent to restart the rulemaking process.

Vacating the rule didn't strip the FTC of enforcement authority. ROSCA, the FTC Act (Section 5 prohibition on unfair and deceptive practices), and the Telemarketing Sales Rule all remain in effect, and the FTC has continued to bring subscription-related enforcement actions under these existing authorities. Every major enforcement action in 2025 and 2026 was brought under ROSCA and the FTC Act, not the vacated Negative Option Rule. For compliance purposes, businesses should treat the vacated rule's requirements (particularly cancellation parity and pre-renewal reminders) as de facto standards that the FTC will enforce through its existing authorities.

California's Automatic Renewal Law

California's Automatic Renewal Law (CARL), codified at Business and Professions Code §§ 17600-17606, is the most comprehensive state auto-renewal statute and the model for most other state laws. Amendments effective July 1, 2025, strengthened the law's requirements.

CARL requires businesses offering auto-renewal or continuous service terms to California consumers to present material terms in a conspicuous manner before the consumer subscribes, obtain the consumer's "express affirmative consent" to the auto-renewal terms (separate from general consent to the transaction), provide a post-transaction acknowledgment in a retainable form that includes the auto-renewal terms and cancellation instructions, allow consumers who signed up online to cancel exclusively online, without engaging in steps that obstruct or delay cancellation, and send annual renewal reminders for subscriptions with terms of one year or longer, and notices before any price change takes effect.

If a business fails to comply and charges a consumer under an auto-renewal arrangement, the goods or services are deemed unconditional gifts to the consumer, and the business must bear their entire cost. Beyond the gift provision, the California Attorney General can seek civil penalties of $2,500 per violation, and consumers can bring private actions for restitution.

"Save offers" (discounts or incentives presented when a consumer attempts to cancel) are permitted under the California amendments but only if the consumer is notified that they can decline the offer and proceed with cancellation at any time. Forcing the consumer to navigate a save offer before reaching the cancellation confirmation crosses into obstruction.

Other State Laws

At least 30 states now have auto-renewal or negative option statutes, and the pace of new legislation accelerated in 2025. Several impose requirements beyond what ROSCA and CARL demand.

New York's law (effective November 2025) requires businesses to obtain advance affirmative consent before increasing subscription prices or allow the consumer to cancel within 14 days of the increased charge and receive a pro-rata refund.

Massachusetts requires pre-renewal notice five to 30 days before the consumer must cancel to avoid the next charge for any subscription term exceeding 31 days.

Minnesota prohibits save offers during the cancellation process unless the consumer affirmatively consents to receive them, which is stricter than California's approach.

A 33-state coalition announced a $4.8 million settlement with TFG Holding, Inc. (an online clothing retailer) in October 2025 for enrolling consumers in recurring-charge memberships without consent and frustrating cancellation attempts.

Free Trial Conversions

Free trials that automatically convert to paid subscriptions are among the most heavily regulated and most frequently enforced categories of auto-renewal practice.

Both ROSCA and CARL (as amended in 2025) require disclosure before the trial begins that the trial will convert to a paid subscription, the date on which the first charge will occur, the price of the paid subscription, and how to cancel before the conversion. The consumer must provide express informed consent to the conversion before the trial starts.

A free trial enrollment flow that requires billing information upfront, converts to a paid subscription after 14 or 30 days, and buries the conversion disclosure in fine print is the pattern regulators target most aggressively. Instacart's $60 million settlement was based in part on this pattern.

Compliance Architecture

Building compliance into the subscription enrollment flow requires attention to four stages.

At sign-up, disclose the auto-renewal terms (price, period, renewal date, cancellation method) in a conspicuous location on the enrollment page. Obtain express affirmative consent through a separate action (a checkbox or button specifically tied to the auto-renewal terms, distinct from the general purchase button).

After sign-up, send a post-transaction acknowledgment that includes the auto-renewal terms, the date of the next charge, and instructions for how to cancel. If the subscription began with a free trial, include the date the trial ends and the amount the consumer will be charged at conversion.

Before renewal, send a reminder notice (the timeline depends on the applicable state law, but 5 to 30 days before the renewal date is the range across most statutes). If the price has changed, disclose the new price and give the consumer the option to cancel before the new rate takes effect.

At cancellation, provide a mechanism that's at least as easy to use as the enrollment mechanism. If the consumer signed up online, cancellation must be available online. Don't require phone calls, live chat, or in-person visits if the consumer enrolled through a website or app. Don't interpose multiple save offers, surveys, or retention screens that obstruct or delay the cancellation.

Practical Recommendations

Design the cancellation flow before the enrollment flow. If cancellation is harder than sign-up, regulators will treat the imbalance as evidence of an unfair practice regardless of whether any specific statute prescribes cancellation parity.

Comply with California's ARL regardless of where your business is located. If you accept subscribers from California (and every online subscription business does), CARL applies. Its requirements are the most comprehensive, and complying with CARL will satisfy the requirements of most other state laws.

Send pre-renewal reminders for every subscription. Even if the applicable state law doesn't require one, a pre-renewal reminder reduces chargebacks, reduces regulatory risk, and provides the consumer the transparency that every regulator expects.

Audit your free-trial-to-paid conversion flow against ROSCA and CARL. Confirm that the conversion terms are disclosed before the consumer provides billing information, that consent is obtained through an affirmative action, and that the acknowledgment email includes the conversion date and cancellation instructions.

Keep records of consent. Store timestamped records of each consumer's affirmative consent to the auto-renewal terms, the version of the terms the consumer accepted, and the disclosure page the consumer viewed. If a regulator or class action plaintiff challenges your practices, the records are your primary defense.