Automatic Renewal Laws: What Subscription Businesses Must Do Now
Automatic renewal laws require express consent, online cancellation and timed reminders. See what California, Minnesota and the FTC expect at checkout.
Photo: Pixabay
On this page 7 sections
- Three Rulebooks Apply to Every Recurring Charge
- The Click-to-Cancel Rule Fell, but Easy Cancellation Is Still the Law
- What California's Automatic Renewal Law Requires After the 2025 Amendments
- Minnesota and Massachusetts Push Further
- A Worked Notice Calendar for a Two-State Subscriber Base
- Keep Consent Records Longer Than the Subscription
- Your Processor Reviews the Same Pages
Key takeaways
- The FTC's click-to-cancel rule was struck down, but that didn't make phone-only cancellation safe. ROSCA and California's law still require a simple way to cancel.
- Since July 1, 2025, California requires a consent box that covers the renewal terms themselves. A single "I agree to the Terms" checkbox no longer covers both.
- If you sell in both California and Minnesota, one notice sent 15 to 45 days before an annual renewal may also count as Minnesota's yearly notice. Confirm this with counsel.
- Keep each consent record for three years from consent or one year after the contract ends, whichever comes later. Never delete records for active subscribers.
Automatic renewal laws require any business that bills consumers on a repeating basis to show the renewal terms clearly before the sale and to get the customer's express consent to those terms. After the sale, the business has to confirm the terms in a form the customer can keep and make cancelling about as easy as signing up. The federal "click-to-cancel" rule was struck down in July 2025, but that changed less than many owners think. California has required online cancellation for online sign-ups since July 1, 2018, and amendments that took effect July 1, 2025, tightened how that cancellation has to work. The FTC also still enforces the federal law that covers online subscriptions.
This article is general information, not legal advice. These laws differ by state and keep changing, so have a qualified attorney confirm what applies to your customers before you change your flow.
Three Rulebooks Apply to Every Recurring Charge
A subscription sold online to a U.S. consumer answers to three sets of rules at once. Meeting one never satisfies the others.
State automatic renewal laws come first. California's law is in Business and Professions Code sections 17600 to 17606, and Minnesota's took effect January 1, 2025. These laws protect the state's residents no matter where the seller is based, and they apply whether the customer pays by card, ACH or digital wallet. If you collect subscription payments by bank debit, Nacha's authorization requirements for ACH debits apply on top of state law.
Federal law is the second layer. The Restore Online Shoppers' Confidence Act (ROSCA) covers negative option features in transactions made on the internet. A "negative option" is any offer that treats the customer's silence or failure to cancel as permission to keep charging. Gibson Dunn summarizes what ROSCA requires. The seller must clearly disclose all material terms before it collects billing information, get the consumer's express informed consent, and offer a simple way to stop the charges.
Card network rules are the third layer. These are private contract terms from Visa and Mastercard, and your acquiring bank enforces them through your merchant agreement. They focus on free trials and introductory pricing. Our breakdown of Visa and Mastercard free trial billing rules covers that side.
| Rulebook | Who writes it | Who enforces it | What it covers |
|---|---|---|---|
| State automatic renewal laws | State legislatures and attorneys general | State regulators and courts | Consumer subscriptions sold to that state's residents, paid any way |
| ROSCA and FTC Act Section 5 | Congress | Federal Trade Commission | Negative option offers sold online |
| Network rules | Visa, Mastercard | Acquiring banks and processors | Card transactions, especially trials and promotional pricing |
The Click-to-Cancel Rule Fell, but Easy Cancellation Is Still the Law
The FTC finalized its amended Negative Option Rule in October 2024, and it became known as the click-to-cancel rule. On July 8, 2025, the U.S. Court of Appeals for the Eighth Circuit vacated it, days before its July 14 compliance date. The court ruled on procedure, not substance. The FTC had skipped the preliminary regulatory analysis that the FTC Act requires when a rule is expected to cost businesses $100 million or more a year.
The FTC then started over. It announced an advance notice of proposed rulemaking on March 11, 2026, published it in the Federal Register on March 13 and took comments through April 13, 2026. An advance notice is the earliest stage of rulemaking. From here the Commission can propose specific amendments or drop the effort, so no new federal rule is coming soon.
Many owners took the court decision as permission to go back to phone-only cancellation. It wasn't. ROSCA already requires a simple way to stop charges, and the FTC has kept enforcing it. A March 2026 Cooley analysis counted five new FTC cases and six approved settlements over negative option practices since January 2025. California's law separately requires online cancellation for online sign-ups. A business that went back to phone-only cancellation after July 2025 still faces legal risk.
What California's Automatic Renewal Law Requires After the 2025 Amendments
California's automatic renewal law is the one most national subscription businesses design around. It has been amended several times, and owners often mix up which rule arrived when. SB 313 added the online cancellation requirement effective July 1, 2018. AB 390 added a renewal notice for longer plans effective July 1, 2022. Then Assembly Bill 2863, enacted in September 2024, made the latest changes effective July 1, 2025. The 2025 rules apply to contracts entered into, amended or extended on or after that date. Ask your lawyer whether a monthly renewal of an older plan counts as an extension. The simpler choice is to treat every California subscriber under the current rules.
Based on summaries from Barnes & Thornburg and Cooley, the law now requires six things a merchant has to build for. The first four came with the 2025 amendments. The last two are older rules, and AB 2863 tightened the cancellation rule.
- Specific consent (new in 2025). You need the consumer's express affirmative consent to the renewal terms themselves, separate from consent to the overall agreement. A single "I agree to the Terms of Service" box no longer does both jobs. The usual design is a separate, unchecked box next to the renewal terms.
- Consent records (new in 2025). Proof of consent must be kept for at least three years or one year after the contract ends, whichever is longer.
- An annual reminder (new in 2025). Every subscriber gets a yearly reminder stating how often the plan renews, the amount charged and how to cancel.
- Free-to-paid conversions (spelled out in 2025). California has required trial-related disclosures since SB 313 extended protections to offers that include a free gift or trial. The 2025 amendments expressly cover trials that convert to paid plans, so they don't apply only to paid plans that renew.
- A renewal notice for long terms (since July 1, 2022). Plans with an initial term of one year or longer need a notice sent at least 15 and no more than 45 days before the renewal date.
- Online cancellation (since 2018, tightened in 2025). Customers who accept an offer online have been entitled to cancel "exclusively online" since SB 313. The 2025 amendments added rules about how that works: cancellation must be available at will, with no extra steps that obstruct or delay it.
California still lets you show a discount or other save offer during cancellation, as long as you tell the customer they can still cancel. Our piece on cancellation flows that save customers legally covers how to design that screen.
Illustrative disclosure wording: "Your membership renews automatically every month at $29.99 until you cancel. Your first charge is on [date]. Cancel anytime in Account > Membership." The price is an example only. Have counsel review your version.
Minnesota and Massachusetts Push Further
Minnesota's law (Minn. Stat. § 325G.57 and related sections) covers some contracts that other states leave out, including health clubs and buying clubs. Three of its provisions go further than California's.
The first is cancellation. A business whose website has profile or subscription management features must let customers cancel on that website, no matter how they signed up. So a gym that enrolls members at the front desk but runs a member portal needs a cancel option in the portal. The second is save offers, which Minnesota bans during cancellation unless the customer affirmatively agrees to hear them. The third covers price and term changes: a material change made without the required notice is void and unenforceable.
Minnesota also requires a written notice at least once a year to customers on continuous service. The notice covers the terms and how to cancel or manage the service. Free trials longer than 30 days need a notice 5 to 30 days before the trial ends.
Massachusetts took a different route. Instead of passing a statute, the attorney general adopted regulations, 940 CMR 38.00, that cover junk fees, trial offers and subscriptions. They took effect September 2, 2025, and violations count as unfair or deceptive acts under the state's consumer protection law. Section 38.05 is the part that applies to automatically renewing agreements.
Other states have their own statutes, with different coverage and notice timing. Ask counsel to list every state where you have a meaningful number of subscribers and map each law to your flow. Gyms and fitness studios and SaaS and software businesses tend to have the most exposure because they sell long terms, run free trials, or both.
A Worked Notice Calendar for a Two-State Subscriber Base
Most multistate sellers build one flow to the strictest rule they face instead of running a separate checkout for each state. Here is what that looks like for an illustrative business.
The assumptions: an online fitness program sells a monthly plan and an annual plan to consumers in California, Minnesota and other states. Both plans start with a 14-day free trial. One customer buys the annual plan on January 10, 2026, so it renews January 10, 2027.
| Moment | Strictest rule in play | What the business sends or builds |
|---|---|---|
| Checkout | California's separate express consent | Renewal terms beside the pay button, with their own unchecked consent box |
| Right after sign-up | California acknowledgment, Minnesota confirmation | Email restating the terms, the cancellation policy and how to cancel |
| Day 14, trial converts | California's coverage of free-to-paid conversions | Trial terms and the first charge date in the acknowledgment. Counsel confirms any conversion notice timing (the trial is under Minnesota's 30-day threshold) |
| Before the annual renewal | California's 15-to-45-day window | One renewal notice between November 26 and December 26, 2026 |
| Once a year, monthly plan | California annual reminder, Minnesota annual notice | One anniversary email with renewal frequency, amount, terms and cancellation steps |
| Any price increase | Minnesota voids changes made without notice | Advance notice with the new price, effective date and how to cancel |
Here is the date math. Forty-five days before January 10, 2027, is November 26, 2026, and 15 days before is December 26. Scheduling the notice for December 1 leaves time to resend it inside the window if delivery fails. Because that notice includes the terms and how to cancel, it may also count as Minnesota's yearly notice. If it does, annual-plan customers get one email instead of two. Confirm that with counsel before you rely on it.
Keep Consent Records Longer Than the Subscription
Teams get California's retention rule wrong more often than any other part of the law, because "three years" sounds like a fixed number. It isn't. Take two illustrative customers who both consent on July 15, 2025.
Customer A cancels on September 15, 2025. Three years from consent (July 15, 2028) comes later than one year after cancellation (September 15, 2026), so you keep the record until July 2028. Customer B stays subscribed until March 1, 2028. This time one year after cancellation (March 1, 2029) is the later date, so you keep the record until then.
In practice, never delete consent records for an active subscriber, and set each record's deletion date to whichever of the two dates comes later. Store the timestamp, the exact version of the disclosure shown, whether the consent box was checked and a copy of the acknowledgment email. That record is also your best evidence when a customer claims they never agreed to renew. It matters as much for fighting subscription chargebacks as for answering regulators.
Your Processor Reviews the Same Pages
Underwriters review a recurring-billing merchant's website before approval and again during later reviews. Missing renewal terms, no clear way to cancel, or a refund policy that contradicts the checkout can delay approval or lead to a decline. Our article on getting approved for recurring billing covers what reviewers check.
After approval, those same flaws turn into disputes from customers who didn't expect the renewal or couldn't find the cancel button. Those disputes raise your chargeback ratio, and a rising ratio can lead to reserves, network monitoring programs or account termination.
This week, buy your own subscription on a phone using a California address, then cancel it. Count the screens between "Account" and "Cancelled," and check every email you got against the calendar above. Then take the results to your attorney. If your payments setup also needs work, MannyPay provides merchant accounts and online payment processing, with gateways such as Authorize.net and NMI and integrations including Shopify and WooCommerce. You can request a free quote, and a MannyPay specialist responds within one business day.
Sources
- California Expands Automatic Renewal Law: New Requirements Now in Effect (Barnes & Thornburg)
- California Automatic Renewal Law Amendments Take Effect on July 1, 2025 (Cooley)
- California's "Auto Renewal Law" Takes Effect on July 1 (Sheppard Mullin)
- California Auto Renewal Law: Consent, Cancellation, and Enforcement (Daeryun Law)
- Changes to California Automatic Renewal Law Effective July 1, 2018 (Wilson Sonsini)
- Updates to California Auto-Renewal Law Take Effect on July 1, 2018 (National Law Review)
- California Passes Updated Automatic Renewal Law (Cooley, 2021)
- Click to Cancel Just Got Cancelled: Eighth Circuit Vacates Entirety of FTC's Negative Option Rule (Cooley)
- Eighth Circuit Cancels Click-to-Cancel (Crowell & Moring)
- FTC Restarts Negative Option Rulemaking After Eighth Circuit Vacatur (Gibson Dunn)
- FTC Issues New Advance Notice of Proposed Rulemaking on Negative Option Marketing (Cooley)
- FTC Negative Option Rule ANPRM (Covington, Inside Privacy)
- Rule Concerning the Use of Prenotification Negative Option Plans (FTC, Regulations.gov)
- Auto-Renewal Laws: 2025 Round Up (Kelley Drye)
- Massachusetts AG Implements Regulations on "Junk Fees" and Auto-Renew Offers (Frankfurt Kurnit)
- Minnesota Statutes § 325G.57 (Minnesota Office of the Revisor of Statutes)
- Minnesota's Automatic Renewal Law: A Subscription Cancellation Guide (Churnkey)
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
