Subscriptions, Auto-Renewal, and Cancellation Rules

If you bill customers on a recurring basis — a subscription, a membership, a "free trial" that converts to paid, any auto-renewing plan — federal law already sets the floor: tell people clearly what they're signing up for before you take their billing information, get their real, separate agreement to the recurring charge itself, and let them cancel easily. That baseline comes mainly from a federal law called ROSCA (the Restore Online Shoppers' Confidence Act), backed up by the FTC's general authority to police unfair and deceptive practices. On top of that federal floor, a growing list of states — California and New York are the two furthest along — layer on their own auto-renewal disclosure, consent, reminder, and cancellation rules, and those state rules generally apply based on where your customer is located, not where your business is based. If you sell to customers nationwide, you're realistically building to the strictest state rule that touches your customer base, not just the federal minimum.

The federal baseline: ROSCA

ROSCA governs negative-option offers in transactions effected on the internet. That scope matters: ROSCA itself is an internet-transaction statute, so a subscription sold over the phone is reached by different authority — mainly the FTC's Telemarketing Sales Rule and the FTC Act's general ban on unfair and deceptive practices — rather than by ROSCA. "Negative option" is the legal term for any arrangement where the customer's silence, or their failure to cancel, is treated as agreement to keep being charged, which describes almost every subscription or auto-renewing plan. For online sales, ROSCA requires three things:

• Clear and conspicuous disclosure of all material terms — before you obtain the customer's billing information. Note how early that trigger is: the statute keys the disclosure to the moment you collect the card, not the moment you charge it. That means the price, that the charge will recur, how often, when the first charge hits, and how to cancel — stated plainly and placed near the button or link the customer uses to complete the purchase, not buried in a terms-of-service page they never open.
• Express, informed consent to the recurring charge itself. This is the part businesses get wrong most often. Consent to being billed on an ongoing basis has to be its own clear step — not folded into a general "I agree to the terms and conditions" checkbox that also covers a dozen other things. The customer needs to affirmatively agree to the recurring charge specifically, with the terms in front of them when they do it.
• A simple mechanism to stop the recurring charges. The mechanism can't be designed to be harder to find or use than the sign-up process was. Requiring a phone call, a mailed letter, or a multi-step retention gauntlet to cancel something a customer bought with two clicks online is exactly the pattern regulators target.

ROSCA violations are enforced by the FTC and treated like violations of an FTC trade regulation rule, which can carry civil penalties per violation. Those per-violation maximums adjust for inflation, so don't rely on any specific number you read — the point that matters for planning is that enforcement is active and that exposure scales with your customer count, not with any one bad experience. See the FTC's pages on ROSCA and its business guidance for current material.

Where the FTC's "click-to-cancel" rule stands

You may have heard the FTC finalized a broader negative-option rule in 2024 — often called the "click-to-cancel" rule — that would have applied across sales channels and required, among other things, that canceling be at least as easy as signing up. That rule is not in effect. The U.S. Court of Appeals for the Eighth Circuit vacated it in Custom Communications, Inc. v. FTC (2025), on procedural grounds — the court faulted the FTC's rulemaking process, specifically its failure to issue a preliminary regulatory analysis, rather than ruling on whether the substance was a good idea. In February 2026 the FTC formally conformed its regulations to that decision, recodifying the pre-2024 rule text.

One point that trips people up: there is still a "Negative Option Rule" on the books, at 16 CFR Part 425 — but it is the narrow, pre-2024 original, titled the Rule Concerning the Use of Prenotification Negative Option Plans. It addresses prenotification plans, the old book-club or record-club model where the seller periodically announces a selection and ships it unless the subscriber declines by a deadline. If you run an ordinary recurring-billing subscription, that rule is probably not what governs you, and it is not the click-to-cancel rule. Don't let the shared name mislead you in either direction.

Meanwhile, the FTC restarted the process at its earliest stage, issuing an advance notice of proposed rulemaking in March 2026 seeking comment on amendments to help consumers avoid unwanted recurring charges and cancel without obstacles. An advance notice is a long way from a final rule, and its eventual scope and timing are unsettled. So don't build your compliance program around a rule that isn't in force — in either direction. What is reliably in force right now is ROSCA, the FTC Act's general ban on unfair and deceptive practices, and the state auto-renewal laws described below, which already require most of what click-to-cancel was meant to add. Building to that existing baseline is the safer approach regardless of how the rulemaking lands. Check the FTC's negative option rule page for current status before relying on any description of this area as settled — including this one.

The state layer — this is where most real exposure lives

Federal law sets a floor, but a number of states have passed their own, more detailed automatic-renewal laws. Depending on the state, exposure can come from the state attorney general's consumer-protection enforcement, from customers suing under that state's general consumer-protection statute, or both — so the practical risk isn't limited to waiting for a federal regulator to act. Two of the most developed:

• California's Automatic Renewal Law requires clear disclosure of the automatic-renewal or continuous-service terms before the offer is accepted, the consumer's affirmative consent, an acknowledgment the customer can retain that includes the terms and how to cancel, and — critically — that a customer who accepted online be able to terminate exclusively online, at will, and without further steps. It also requires an annual reminder for annual automatic-renewal agreements, advance notice before a longer free trial converts, and advance notice before a price increase takes effect.
• New York's automatic-renewal law (General Business Law § 527-a) similarly requires clear and conspicuous pre-consent disclosure of the material terms, affirmative consent, a retainable notice with the terms and cancellation instructions, and a simple cancellation mechanism that is as easy to use as the one the customer used to sign up and available through the same medium. It also requires advance notice before certain longer-term contracts renew, and advance notice of material changes such as a price increase.

Exact timing windows, what counts as adequate disclosure, and who can enforce all differ state to state, and they change as legislatures act — so treat the summaries above as orientation, not as the operative deadlines to build against. Other states have adopted or are actively adopting similar frameworks. Because these laws generally turn on your customer's location, a business with customers in several states can be subject to several of these regimes at once for the same product. Confirm the current requirements for any state where you have a meaningful customer base; that state's Attorney General consumer-protection office is the right place to check, since this area moves quickly.

What to do

1. Disclose the material terms right next to the "buy" or "start trial" button — price, that it recurs, the frequency, the first charge date, and how to cancel — and do it before you collect the card, not just in a linked terms-of-service page.
2. Make consent to the recurring charge its own separate step, distinct from your general terms-of-service checkbox. A single "I agree to everything" box that also covers privacy, arbitration, and a dozen other terms does not satisfy ROSCA's consent requirement for the billing itself.
3. Never use a pre-checked box for auto-renewal or a free-trial conversion. The customer has to actively choose it.
4. Let people cancel the same way they signed up. If they subscribed online with two clicks, they need an online way to cancel with roughly that much friction — not a phone-only cancellation line, a mail-in form, or a login wall that traps them in a retention flow.
5. Send a retainable confirmation when someone subscribes, spelling out the price, frequency, and how to cancel, and keep your own record that they consented.
6. Send a renewal reminder before longer-term plans auto-renew (annual and multi-year terms especially), and before any price increase takes effect, giving the customer a real chance to cancel or object before being charged. The required timing windows vary by state — confirm them for your customer base rather than picking a number that feels safe.
7. Keep proof of consent — a timestamped record of what the customer saw and agreed to — for as long as that customer relationship could plausibly be disputed. If a regulator or a customer later challenges a charge, that record is what shows you complied.

A few practical traps

"Retention flows" are a common source of trouble: multi-screen cancellation paths that push discount offers, ask the customer to explain why they're leaving, or require confirming a cancellation more than once. None of that is automatically illegal, but if it functionally makes canceling harder than signing up, it cuts against ROSCA's simple-mechanism requirement and, in California and New York, against the explicit no-further-steps and same-medium language in their statutes. A safer design lets the customer complete the cancellation first, and offers the discount or the "are you sure" screen only after cancellation is already confirmed — or skips it.

Free trials deserve the same rigor as paid subscriptions. A trial that silently converts to a paid recurring charge is a negative option, so the disclosure and consent rules apply at sign-up, before the trial even starts — not just at the moment of the first real charge.

How this connects to the rest of your billing setup

Get the underlying agreement right first: what a subscription's website terms of service actually need to say is covered in this site's separate guide to that topic — this article assumes you already have terms and focuses on the recurring-billing disclosures layered on top of them. And because a customer who feels trapped in a subscription is a customer who calls their card issuer instead of you, a clean, self-serve cancellation flow is also one of the most effective things you can do to reduce chargebacks — a disputed charge is far more likely when canceling felt impossible than when it was easy.

This article is general business information, not legal, tax, or financial advice, and reading it does not create an attorney-client relationship. Rules in this area are actively changing — a federal rule was vacated in 2025 and new rulemaking is underway — so verify current requirements before you rely on any summary. If you run subscription billing at any real scale, or into California, New York, or other states with their own auto-renewal statutes, have a qualified attorney review your disclosure and cancellation flow.