Stage 9: Subscriptions and cancellation

The short answer

If your app charges again and again until someone cancels, federal law requires three things: show the terms before you take card details, get clear consent before you charge, and give a simple way to stop. The federal click-to-cancel rule was thrown out by a court in 2025, but that law, the FTC's general powers and about 30 state laws still apply. Put the price, the renewal and the cancel method next to your Subscribe button, let online sign-ups cancel online, and send the reminder emails California and other states require.

Why this matters

• Amazon paid $2.5 billion. On 2025-09-25 the FTC (the US Federal Trade Commission) announced that Amazon would pay $1 billion in civil penalties and $1.5 billion in refunds, to settle claims about how it signed people up for Prime and how hard it was to cancel. The FTC estimated about 35 million people were affected, and called the $1 billion the largest civil penalty ever in a case involving one of its rules (FTC). The claims were under the FTC Act and ROSCA, the federal subscription law in this stage.
• The click-to-cancel rule is gone, the duty is not. On 2025-07-08, a federal appeals court (the Eighth Circuit) cancelled the FTC's 2024 click-to-cancel rule in full, six days before its compliance date (Eighth Circuit opinion). Amazon's settlement came about eleven weeks later, under the older law.
• California tightened its law in 2025. For subscriptions started, changed or extended on or after 2025-07-01, California now requires online cancel, trial reminders, yearly reminders and price-change notices (Bus. and Prof. Code 17602, mirror copy).
• Other states keep adding rules. The law firm Skadden counts approximately 30 states with some form of auto-renewal or click-to-cancel law, and reports that a New York City rule took effect on 2026-10-01 (Skadden). There is no official count.

I checked my own app, Ducktate, against this stage on 2026-10-09. The cancel path was fine: a Stripe customer portal on the web and Apple's subscription settings on iPhone. The web purchase screen was not. It shows the price and "cancel anytime" next to the Subscribe button, but it does not say the plan renews automatically. That gap is still open as of 2026-10-09. It is a one-line fix, and it is the kind of line an AI-built pricing page leaves out.

Core concepts

ROSCA and its three duties

A negative option is a deal where silence means yes: you keep paying until you act to stop. A monthly subscription, a free trial that turns into a paid plan, and an annual plan that renews are all negative options.

ROSCA, the Restore Online Shoppers' Confidence Act, is the federal law for negative options sold online. It makes a charge unlawful unless the seller does three things (15 U.S.C. 8403):

1. Clearly and conspicuously discloses all material terms before it collects billing information. Material terms are the facts a buyer needs to decide: price, how often, that it renews, and how to cancel.
2. Gets the consumer's express informed consent before it charges. That means a clear yes to the charge, given with those terms in view.
3. Provides simple mechanisms to stop recurring charges.

ROSCA treats a violation as a violation of an FTC rule, so the FTC Act's penalties apply (15 U.S.C. 8404). My reading is that the per-violation maximum is the FTC's rule-violation figure, $53,088 in 2026 (see Stage 5), but the statute does not state a number.

Worked example. Here are two versions of the same pricing card:

The right column states every material term on the screen where the user decides, before the card form. The button text itself is the consent.

Where the federal click-to-cancel rule stands

The FTC's Negative Option Rule is an older FTC rule about these deals. In 2024 the FTC added the click-to-cancel amendments, which would have made cancelling as easy as signing up across the country. Here is what happened next:

The court did not say subscriptions may be hard to cancel. It said the FTC skipped a required step: a preliminary analysis of the rule's costs, after an administrative law judge found the rule could cost more than $100 million a year.

An ANPRM (advance notice of proposed rulemaking) is the first, earliest step: the FTC asks questions. An NPRM (notice of proposed rulemaking) is the step where it publishes actual rule text. My search of the Federal Register on 2026-10-09 found no NPRM after the March 2026 notice. The FTC's August 2026 regulatory agenda lists the removal of the vacated amendments and gives no new-rule step (Federal Register).

So today there is no federal click-to-cancel rule in force. ROSCA, the FTC Act and state laws still apply. Check this again on the day you launch.

California's Automatic Renewal Law

California's Automatic Renewal Law (ARL), Business and Professions Code sections 17600 to 17606, was amended by AB 2863. The new duties apply to contracts entered into, amended or extended on or after 2025-07-01. I read the text on a statute mirror, california.public.law, because the official site blocked my research tool (17602, mirror). Check the official text by hand.

The duties, in plain words:

• Visual proximity. Show the material terms clearly and conspicuously "in visual proximity" to the request for consent. In practice: on the same screen, right next to the button.
• Affirmative consent before you charge. Keep a record of that consent for at least 3 years, or 1 year after the contract ends, whichever is longer.
• Trial and promo notice. If a free trial or promotional price lasts longer than 31 days, send a notice 3 to 21 days before it ends.
• Annual plan notice. If the first term is 1 year or more, send a notice 15 to 45 days before it renews.
• Online cancel. If the person signed up online, they must be able to cancel online, at once, through a prominent link or button, or an email that is immediately accessible. In general, they can cancel in the same medium they used to sign up.
• Save offers. If you show a discount or other offer when someone tries to cancel online, a "click to cancel" option must appear with it.
• Price changes. Give notice 7 to 30 days before a fee change takes effect.
• Yearly reminder. Remind subscribers once a year of the product, the charge and how often, and how to cancel.

If you charge without the required consent, goods you sent count as an unconditional gift (17603). A violation is not a crime, but civil remedies apply, and good-faith compliance is a defense (17604) (17603, mirror, 17604, mirror).

Worked example. You sell two plans to people in California. Here are the emails the law asks for:

A 14-day trial is under the 31-day line, so California does not require the trial email. I would send one anyway, a few days before the charge. It costs nothing, and a charge nobody expected is how refund fights start.

Other states

California is not alone, but I only verified a few details beyond it.

• Minnesota. Its statute requires the terms near the offer, a notice 5 to 30 days before a free trial longer than 30 days ends, and a written notice at least once per calendar year (Minn. Stat. 325G.57). Law-firm and vendor summaries give 2025-01-01 as the start date; the statute pages I read do not show it.
• New York City. According to Skadden, the city adopted a click-to-cancel rule on 2026-07-10, effective 2026-10-01, with renewal notices 15 to 45 days before the cancel deadline and civil penalties from $525 to $3,500 (Skadden). I did not read the city's rule itself.
• The rest. Skadden's count is approximately 30 states. Law-firm summaries mention new rules in several more states in 2025 and 2026, but I did not confirm their dates against the laws. If many of your users live in one state, read that state's law.

The safe pattern is to meet the strictest common rule everywhere: terms next to the button, online cancel, a trial email before any trial converts, and a yearly reminder.

The cancel flow, Stripe and the app stores

Stripe's customer portal is a hosted page where your customers manage billing. It lets customers cancel at once or at the end of the billing period, and you can add a cancellation page that asks for a reason and offers a retention coupon (Stripe docs). It has limits: a customer can cancel but not change some kinds of subscriptions, such as ones with several products, usage-based billing or trial offers, and the portal cannot be shown inside an iframe. Stripe's page makes no legal claims. The tool gives you a cancel button. It does not write your disclosures, keep your consent records or send your reminders.

A save offer is the discount or "are you sure?" screen shown when someone tries to cancel. Under California's law, the cancel option must stay visible with it.

Worked example. A good cancel flow, start to finish:

1. Settings, then Billing, shows "Cancel subscription" as a plain button.
2. One optional screen asks why, and may offer 50% off for three months. A "Cancel subscription" button sits on the same screen.
3. The next screen says "Cancelled. You keep access until 2026-11-30. You will not be charged again."
4. An email confirms the same thing.

A bad flow hides the button, sends the user to a chat, or asks them to email support and wait.

App stores. If you sell subscriptions inside an iPhone app, Apple's guideline 3.1.2 applies: a subscription period of at least 7 days, access on all of the user's devices, and a clear statement of what the user gets for the price before you ask them to subscribe (Apple guidelines). Google Play requires price, billing frequency and auto-renewal stated clearly, the length and price of any trial and that the user moves to a paid plan after it, and an easy online cancel path (Google Play). Store billing gives you a cancel path, but the screen before purchase is still your job.

Key terms

The checklist

• Show the price, how often it is charged, that it renews automatically, and how to cancel right next to the Subscribe button, before the card form.If it appliesSource: 15 U.S.C. 8403, Cal. 17602 (mirror)
• Get consent with a button or an unticked checkbox that names the charge, not with a line hidden in your terms.If it appliesSource: 15 U.S.C. 8403, Cal. 17602 (mirror)
• Save proof of each consent (time, user, price shown, terms version) for at least 3 years, or 1 year after the subscription ends if that is longer.Should doSource: Cal. 17602 (mirror)
• Send a confirmation email right after sign-up with the price, the renewal terms and how to cancel.Should doSource: Cal. 17602 (mirror), Minn. Stat. 325G.57
• Let anyone who signed up online cancel online, at once, from a visible link or button, with no phone call, chat or wait.If it appliesSource: Cal. 17602 (mirror), 15 U.S.C. 8403
• If you show a save offer, keep a cancel button on the same screen as the offer.Should doSource: Cal. 17602 (mirror), Stripe customer portal
• For a free trial or promo price longer than 30 days, email the customer before it ends: 3 to 21 days before for California, 5 to 30 days before for Minnesota.If it appliesSource: Cal. 17602 (mirror), Minn. Stat. 325G.57
• For a plan with a first term of a year or more, send a renewal notice 15 to 45 days before it renews.If it appliesSource: Cal. 17602 (mirror)
• Send every subscriber a yearly reminder with the product, the price, how often it is charged and how to cancel.Should doSource: Cal. 17602 (mirror), Minn. Stat. 325G.57
• Give subscribers 7 to 30 days notice before a price change, with how to cancel.Should doSource: Cal. 17602 (mirror), Skadden on the NYC rule
• If you sell subscriptions inside a mobile app, check the screen before purchase against Apple guideline 3.1.2 and Google Play's subscription policy.If it appliesSource: Apple guidelines, Google Play subscriptions
• Before each release, sign up and cancel as a test user, and confirm that no further charge is scheduled.Should doSource: Stripe customer portal, 15 U.S.C. 8403
• Do not treat the vacated click-to-cancel rule as permission; follow ROSCA and the law of the states where most of your users live.Should doSource: Eighth Circuit opinion, FTC on Amazon, Skadden

The prompt for your agent

Copy this into Claude Code, Codex or Cursor from the root of your project. It checks your pricing screens, checkout setup, cancel flow and billing emails.

Audit this project for Stage 9 of a launch checklist: subscriptions and cancellation.
Do not change any code, copy, checkout setting, or email template until I approve a plan.

For each item below, report PASS, FAIL, or UNKNOWN, with the file and line that
proves it. If you cannot prove an item from the code, report UNKNOWN. Never report
PASS without evidence.

1. Find every screen with a Subscribe, Upgrade, Start trial, or Buy button for a
   recurring plan. Quote the text shown next to each button. Does it state the
   price, how often it is charged, that it renews automatically, and how to cancel?
2. Is that text shown before the card form or checkout redirect?
3. How does the user agree? Quote the button label or checkbox. Flag a pre-ticked
   box or consent that only appears in linked terms.
4. Is a record of consent stored (time, user, price shown, terms version)? Where?
5. Find the checkout setup (for example Stripe Checkout or a payment form). Does it
   add any text about renewal or terms?
6. Find the cancel path. Can a user who signed up online cancel online without
   contacting support? List each step and screen.
7. If there is a save offer or "are you sure" screen, is a cancel button on the
   same screen?
8. Which emails exist for: sign-up confirmation, trial ending, annual renewal,
   price change, yearly reminder, and cancel confirmation? Quote the template file
   for each, or report it missing.
9. For trials and annual plans, when is each reminder sent? Give the scheduling
   code and the number of days before the charge.
10. If the app sells in-app subscriptions, quote the screen before purchase and
    the restore and cancel instructions.

End with a table: item, status, evidence (file and line), and the smallest fix you
suggest. Then stop and wait for my approval.

Item 1 is quick to check by eye. Open your own pricing page and read only what sits next to the button. If "renews automatically" is not there, that is your first fix, as it was mine.

Common mistakes

• Reading "click-to-cancel rule struck down" and deciding cancel rules are gone. ROSCA and state laws still apply, and Amazon settled under ROSCA after the rule fell.
• Writing "cancel anytime" without saying the plan renews, or without saying how to cancel.
• Putting the renewal terms only in the Terms of Service link.
• Letting people sign up in one click but making them email support or open a chat to cancel.
• A save-offer screen with no cancel button on it.
• Assuming Stripe or the App Store makes you compliant. They give you billing tools; the disclosures, consent records and reminders are yours.
• Converting a long trial to a paid plan with no reminder email.

Check yourself

Resources

• 15 U.S.C. 8403 (ROSCA)LawFree

  The three duties in the statute's own words.

• FTC: the Amazon Prime settlementGuidanceFree

  The largest case so far on sign-up and cancel design.

• Eighth Circuit: Custom Communications v. FTCLawFree

  The opinion that vacated the click-to-cancel rule.

• Federal Register: the 2026 advance noticeLawFree

  Where the FTC's new rulemaking starts.

• California Bus. and Prof. Code 17602 (mirror)LawFree

  California's disclosure, cancel and reminder duties.

• Minnesota Statutes 325G.57LawFree

  Minnesota's trial and yearly notice rules.

• Skadden: New York City's click-to-cancel ruleArticleFree

  A law firm summary of the NYC rule and the state count.

• Stripe: customer managementDocsFree

  What the customer portal can and cannot do.

• Apple App Review GuidelinesDocsFree

  Guideline 3.1.2 covers auto-renewable subscriptions.

• Google Play: subscriptions policyDocsFree

  Google's rules for trials, pricing and cancel paths.

Next stage

Several duties in this stage are emails: confirmations, reminders and notices. Stage 10 covers the rules for the emails and text messages you send, and the line between a receipt and an ad.