Auto-renewal compliance (ROSCA & state laws)

The FTC's 2024 Negative Option Rule ('Click-to-Cancel') was vacated by the Eighth Circuit in July 2025 on procedural grounds, but the statutes it sat on did not move. ROSCA (15 U.S.C. § 8401–05) still requires clear disclosure of material terms before obtaining billing information, express informed consent to recurring charges, and simple cancellation mechanisms for anything sold online with a negative-option feature. The FTC enforced ROSCA before the rule existed and continues to after it: the government's case against Adobe (hidden early-termination fees, a cancellation flow built to obstruct) was a ROSCA action, and it settled with the DOJ in March 2026 for $150M.

State law stacks on top: California's Automatic Renewal Law is the strictest and most litigated (private plaintiffs' firms run ARL demand campaigns the way they run ADA ones), and New York, Oregon, Colorado and others have their own versions. If you sell subscriptions to consumers in those states, the state statute reaches you regardless of where you're incorporated.

The recurring fact patterns are mechanical: the recurring price revealed only after billing details are collected; pre-checked consent; trial terms that convert silently; and cancellation that requires a phone call, a retention gauntlet, or business-hours chat when signup took ninety seconds online. Vonage's $100M FTC settlement was about exactly that asymmetry: easy in, obstructed out.

These mechanics are visible from the outside, which is why they're scannable: the disclosure either appears before the payment step or it doesn't; the cancel path either exists on the site or it doesn't.