Auto-renewal & click-to-cancel compliance for subscription ecommerce

Subscription ecommerce is squarely inside negative-option law, because the recurring charge is the model. ROSCA (15 U.S.C. § 8401) requires clear disclosure of the recurring-order terms before billing information is taken, express informed consent to the recurring charge, and a simple cancellation mechanism for anything sold online with a negative-option feature. California's Automatic Renewal Law (Cal. Bus. & Prof. Code § 17602) adds clear-and-conspicuous renewal disclosure, affirmative consent, and the right to cancel online for anything bought online, and private plaintiffs' firms run ARL demand campaigns the way they run accessibility ones. The FTC's Click-to-Cancel rule named that same cancel-as-easily-as-you-signed-up principle directly before the Eighth Circuit vacated it in 2025; the statutes carry it regardless.

Whether a given statute reaches your specific store, the ARL's California nexus, the FTC's threshold for a given action, is a question for your counsel. What is not a counsel question is what your subscribe & save toggle, your subscription-box signup, and your cancel page actually say and do, which is observable from the outside and is the part a scan settles.

The recurring fact patterns on a subscription store are mechanical and visible without an account, which is exactly why they are scannable. The signup either states the recurring-order amount and interval before it collects a card, or it doesn't. The auto-renew box is pre-checked, or it isn't. The cancel path lives on the site, or it routes the customer to a phone line that only answers during business hours.

• A subscribe & save or subscription-box signup that enrolls a shopper in recurring billing with no clear-and-conspicuous recurring-order disclosure before the billing step
• A pre-checked auto-renew box standing in for affirmative consent, so the shopper never actively agrees to the recurring charge
• Recurring price or interval left unclear, so the shopper can't tell what they'll be billed for the next box or when
• Free-trial-to-paid conversion terms that don't state what happens, or at what price, when the intro period ends and billing begins
• Online self-serve cancellation replaced by phone-only or email-only cancellation when signup was fully online
• Dark patterns in the cancel flow: retention walls, confirm-shaming, and cancel links buried below pause-and-discount offers

For a single store the realistic exposure is a California ARL demand letter or an attorney-general inquiry built from screenshots of your own subscribe & save and cancel flows, and comparable cancellation-method cases have a category median around $10M. The large FTC numbers are mega-operator scale illustrations only, not your figure: FTC v. Epic (Fortnite) ran to $245M, FTC v. Vonage to $100M, and FTC v. AT&T to $60M, each turning on the same easy-in, obstructed-out asymmetry. The narrative anchor for the cancel-flow theory specifically is U.S. v. Adobe, a $150M DOJ settlement (March 2026) over a cancellation flow built to obstruct. Every one of those cases started on the signup and cancel pages a scan reads first. We can show what your flows do; whether to remediate, respond, or both is a conversation for your counsel.