Auto-renewal · By industry
Auto-renewal & click-to-cancel compliance for gyms
Auto-renewal compliance for a gym website means recurring membership charges are disclosed clearly before signup, members affirmatively consent to them, and cancellation is genuinely available online: the requirements of ROSCA (15 U.S.C. § 8401), California's Automatic Renewal Law (Cal. Bus. & Prof. Code § 17602), and other state auto-renewal laws. Gym memberships are a canonical enforcement target. Complidar walks your signup and cancellation flows the way an FTC investigator would read them.
Why gym memberships are the textbook target
Fitness is the industry regulators reach for when they describe auto-renewal abuse: a membership sold online in ninety seconds that can only be cancelled by phone, in person, or certified mail. The statutory footing is layered. ROSCA requires clear disclosure of material terms before billing information is taken, express informed consent to the recurring charge, and a simple cancellation mechanism for anything sold online with a negative-option feature. California's ARL adds clear-and-conspicuous renewal disclosure, affirmative consent, and, for memberships bought online, the right to cancel online. The FTC's Click-to-Cancel rule named that same cancel-as-easily-as-you-signed-up principle directly before the Eighth Circuit vacated it in 2025; the statutes carry it regardless.
On top of the federal and California regimes, many states have their own health-club and gym contract cancellation statutes with specific notice periods and refund rights for fitness memberships. Those vary by state and are a question for counsel; what does not vary is that selling a membership online while gating cancellation behind a phone tree is the precise asymmetry these laws were written to stop.
What the cancellation flow actually shows
The recurring fact patterns on a gym site are mechanical and visible from the outside, which is why they are scannable. The signup either discloses the renewal price and timing before it collects a card, or it doesn't. The consent box is pre-checked, or it isn't. The cancel path lives on the site, or it sends the member to a phone line that only answers during business hours.
- Memberships that renew automatically with no clear-and-conspicuous renewal terms shown before checkout
- No affirmative consent to the recurring charge at signup, or a pre-checked auto-renew box standing in for it
- Renewal price or timing left unclear, so the member can't tell what they'll be billed or when
- Cancellation that is phone-only or in-person-only when signup was fully online, with no self-serve path
- Retention walls, confirm-shaming, and buried cancel links inside whatever cancellation flow does exist
What it costs when it goes wrong
For a single gym or small studio the realistic exposure is a state-law demand letter or an attorney-general inquiry built from screenshots of your own flow, and cancellation-method cases of that comparable kind have a median in the range of $10M across the category. The headline FTC numbers are mega-operator scale illustrations, not your figure: FTC v. Epic (Fortnite) ran to $245M, FTC v. Vonage to $100M, and FTC v. AT&T to $60M, each turning on the same easy-in, obstructed-out asymmetry. The narrative anchor for the cancel-flow theory specifically is U.S. v. Adobe, a $150M DOJ settlement (March 2026) over a cancellation flow built to obstruct, and U.S. v. Cognosphere (Genshin Impact), $20M, shows the price of taking money without affirmative consent. The membership flow is where every one of those cases started.
What the scan checks here
- Membership signup: recurring-charge amount and interval disclosed before the billing step
- Affirmative consent to the recurring term at signup, with no pre-checked auto-renew box
- Renewal price and timing stated clearly where the membership is offered
- Trial-conversion language: what happens, and at what price, when an intro period ends
- A discoverable online cancellation path, walked the way a member would walk it
- Dark patterns in the cancel flow: phone-only or in-person-only gating, retention walls, confirm-shaming, hidden links
- Membership terms and ToS auto-renewal clauses checked against what the checkout actually shows
Honest limits: A scan verifies what the public site shows: the renewal disclosure, the consent UI, and the visible cancellation path your members walk. It cannot verify your billing backend (whether a cancellation actually stops the charge, whether refunds issue) or which state health-club statute applies to your contracts. Those are records and counsel questions, and the report marks which side of that line each finding sits on rather than implying a clean scan equals full compliance.
Common questions
We require members to cancel in person or by phone. Is that actually illegal?
For a membership sold online, ROSCA requires a simple cancellation mechanism and California's ARL requires online cancellation for online signups, so phone-only or in-person-only cancellation for an online sale is the precise asymmetry these laws target. Many states also have specific health-club cancellation statutes on top. The scan documents exactly what your flow requires today, which is the fact counsel needs to apply your states' rules.
Our memberships bill through Stripe / a fitness platform. Doesn't that handle compliance?
The processor or platform handles the billing mechanics; ROSCA and the state auto-renewal laws regulate what your pages say and how your flows behave: renewal disclosure placement, the consent box, and the cancel path are your site's responsibility, not your vendor's. The scan reads the pages your members actually use, which is where the violations live.
What does a gym auto-renewal violation cost?
Cancellation-method cases of the comparable kind have a category median around $10M, and the large FTC actions show the ceiling as scale illustrations only: Epic/Fortnite $245M, Vonage $100M, AT&T $60M, with U.S. v. Adobe ($150M DOJ settlement, 2026) the anchor for the cancel-flow theory specifically. For a single gym the realistic exposure is a state demand letter or AG inquiry, cheaper but built from the same screenshots the scan would have shown you first.
All 22 checks · up to 120 pages · no card
Last updated 2026-06-28 · Informational, not legal advice: how to read this