# Subscription Compliance
Source: https://paymentsandrisk.com/docs/compliance/subscriptions

Last updated 21 October 2026.

TL;DR

-   **Three layers hit you at once**: network rules, federal law (ROSCA and the FTC Act), and state law. California's ARL is the strictest
-   **Four things you have to get right**: disclose before you take the card, capture express consent, let them cancel the way they signed up, warn them before you renew
-   **Get it wrong** and it's chargebacks, network fines, FTC penalties up to ~$53K a violation, and a letter from a state AG

You're getting hit from three directions at once.

-   **Card network rules.** Visa and Mastercard set the floor on stored credentials and recurring charges. That's consent capture, confirmation emails and cancellation.

-   **Federal law.** ROSCA (Restore Online Shoppers' Confidence Act) and the FTC Act cover deceptive enrollment and cancellation.

-   **State law.** California's Automatic Renewal Law is the strictest. 20+ states regulate auto-renewal in some form.


The FTC's Click-to-Cancel Rule was finalized in October 2024. The 8th Circuit vacated it in July 2025, on procedural grounds. Don't relax. Enforcement carries on under ROSCA, and the rule still shows you how the FTC reads existing law.

## Regulatory Layers

| Layer | Requirement Source | Key Focus Areas |
| --- | --- | --- |
| **Network Rules** | Visa, Mastercard mandates | Consent capture, receipts, cancellation |
| **Federal Law** | ROSCA, FTC Act | Disclosure, consent, simple cancellation |
| **State Laws** | CA ARL, NY, CO, others | Enhanced disclosure, online cancel, annual reminders |
| **Industry Standards** | PCI DSS | Secure credential storage |

## Who This Applies To

Anything that renews on its own:

-   Subscription box services
-   SaaS companies
-   Streaming services
-   Membership organizations
-   Gym and fitness memberships
-   News and magazine subscriptions
-   Free trial to paid conversion models
-   Any recurring billing arrangement

## Section Contents

If a renewal failed, start with [failed-renewal recovery](https://paymentsandrisk.com/docs/payments/subscriptions-recurring/#set-up-recovery-before-you-buy-another-tool); keep consent and cancellation questions with [Recurring Billing Requirements](https://paymentsandrisk.com/docs/compliance/subscriptions/recurring-billing/).

### [Recurring Billing Requirements](https://paymentsandrisk.com/docs/compliance/subscriptions/recurring-billing/)

What you actually have to do:

-   Visa and Mastercard stored credential rules
-   Free trial conversion requirements
-   ROSCA obligations
-   California ARL requirements
-   Cancellation process requirements

### [Failed Payment Collection](https://paymentsandrisk.com/docs/compliance/subscriptions/failed-payment-collection/)

When to stop chasing a failed payment, what the FDCPA says, and when it's time to write it off:

-   Dunning vs collections vs charge-off
-   90-day industry standard
-   Collections agency usage
-   Cost-benefit analysis by debt age
-   When to write off entirely

## Key Dates Timeline

| Date | Event |
| --- | --- |
| 2010 | ROSCA enacted |
| 2018 | Visa/Mastercard stored credential mandate |
| 2020 | Visa free trial rules enhanced |
| 2022 | Mastercard subscription rules updated |
| Oct 2024 | FTC Click-to-Cancel Rule finalized |
| Jan 2025 | FTC Rule misrepresentation provisions effective |
| July 2025 | FTC Rule vacated by 8th Circuit; CA ARL amendments effective |

## Quick Compliance Checklist

### Pre-Enrollment

-   [ ]  Clear disclosure of all terms before collecting payment info
-   [ ]  Price, frequency, and cancellation policy displayed prominently
-   [ ]  Terms not buried in fine print or terms of service

### At Enrollment

-   [ ]  Express consent captured (checkbox, not pre-checked)
-   [ ]  Consent retained for 3+ years (California requirement)
-   [ ]  Separate consent for subscription vs. one-time purchase

### Post-Enrollment

-   [ ]  Confirmation sent immediately after enrollment
-   [ ]  All subscription terms included in confirmation
-   [ ]  Cancellation instructions provided

### Before Trial Conversion

-   [ ]  Advance notice sent 7+ days before first paid charge
-   [ ]  Specific amount and date included
-   [ ]  Cancellation method clearly stated

### Ongoing

-   [ ]  Easy cancellation (same method as signup)
-   [ ]  Annual reminders (required by California for 12+ month terms)
-   [ ]  Price change notifications in advance

## Enforcement Risk

**FTC Enforcement:**

-   Up to ~$53,000 per violation (as of 2025 civil penalty adjustments)
-   Recent cases include Uber, Cleo AI and Care.com. Amazon settled the FTC's Prime case on 25 September 2025 for $2.5 billion.

**State Enforcement:**

-   California AG, district attorneys
-   Private plaintiff class actions common
-   Other state AGs increasingly active

**Network Enforcement:**

-   Elevated chargebacks for subscription disputes
-   Potential VAMP/ECM enrollment
-   Merchant account termination risk

* * *

Last Verified: December 2024

These rules move fast. The Click-to-Cancel Rule's status can change again. California's ARL is strict and it gets enforced. Check the current text before you decide anything.

## Popular in This Section

-   **[Recurring Billing Requirements](https://paymentsandrisk.com/docs/compliance/subscriptions/recurring-billing/)** - Network, federal, and state compliance

## Next Steps

**New to subscription compliance?**

1.  [Read the recurring billing requirements](https://paymentsandrisk.com/docs/compliance/subscriptions/recurring-billing/) - Detailed network and legal requirements
2.  [Understand network rules](https://paymentsandrisk.com/docs/compliance/network-rules/) - VAMP, ECM thresholds affecting subscriptions

**Preventing subscription disputes?**

1.  [Implement chargeback prevention](https://paymentsandrisk.com/docs/chargebacks/prevention/) - Alerts and prevention tools
2.  [Fix billing descriptors](https://paymentsandrisk.com/docs/chargebacks/prevention/descriptors-and-comms/) - Reduce "I don't recognize" disputes

**Fighting subscription chargebacks?**

1.  [Build compelling evidence](https://paymentsandrisk.com/docs/chargebacks/representment/compelling-evidence/) - Win subscription disputes
2.  [Reduce chargebacks fast](https://paymentsandrisk.com/docs/playbooks/reduce-chargebacks-fast/) - Emergency response playbook

* * *

## See Also

-   [Chargeback Prevention](https://paymentsandrisk.com/docs/chargebacks/prevention/) - Reducing subscription chargebacks
-   [Network Rules](https://paymentsandrisk.com/docs/compliance/network-rules/) - VAMP, ECM thresholds
-   [Consumer Protection](https://paymentsandrisk.com/docs/compliance/consumer-protection/) - Reg E, Reg Z basics
-   [Subscriptions & Recurring](https://paymentsandrisk.com/docs/payments/subscriptions-recurring/) - Billing fundamentals
-   [Compelling Evidence](https://paymentsandrisk.com/docs/chargebacks/representment/compelling-evidence/) - Fighting subscription disputes
-   [Descriptors and Communication](https://paymentsandrisk.com/docs/chargebacks/prevention/descriptors-and-comms/) - Billing clarity
-   [Friendly Fraud](https://paymentsandrisk.com/docs/fraud/types/friendly-fraud/) - First-party disputes
-   [Reason Codes](https://paymentsandrisk.com/docs/reference/reason-codes/) - Subscription-related codes
-   [Promo Abuse](https://paymentsandrisk.com/docs/fraud/types/promo-abuse/) - Trial abuse patterns
-   [Chargeback Metrics](https://paymentsandrisk.com/docs/chargebacks/metrics/) - Tracking dispute rates
-   [Network Programs](https://paymentsandrisk.com/docs/chargebacks/reference/network-programs/) - VAMP, ECM details
-   [Reduce Chargebacks Fast](https://paymentsandrisk.com/docs/playbooks/reduce-chargebacks-fast/) - Emergency response