Skip to main content

Subscription Compliance

TL;DR
  • Three layers hit you at once: network rules, federal law (ROSCA and the FTC Act), and state law. California's ARL is the strictest
  • Four things you have to get right: disclose before you take the card, capture express consent, let them cancel the way they signed up, warn them before you renew
  • Get it wrong and it's chargebacks, network fines, FTC penalties up to ~$53K a violation, and a letter from a state AG

You're getting hit from three directions at once.

  • Card network rules. Visa and Mastercard set the floor on stored credentials and recurring charges. That's consent capture, confirmation emails and cancellation.

  • Federal law. ROSCA (Restore Online Shoppers' Confidence Act) and the FTC Act cover deceptive enrollment and cancellation.

  • State law. California's Automatic Renewal Law is the strictest. 20+ states regulate auto-renewal in some form.

The FTC's Click-to-Cancel Rule was finalized in October 2024. The 8th Circuit vacated it in July 2025, on procedural grounds. Don't relax. Enforcement carries on under ROSCA, and the rule still shows you how the FTC reads existing law.

Regulatory Layers​

LayerRequirement SourceKey Focus Areas
Network RulesVisa, Mastercard mandatesConsent capture, receipts, cancellation
Federal LawROSCA, FTC ActDisclosure, consent, simple cancellation
State LawsCA ARL, NY, CO, othersEnhanced disclosure, online cancel, annual reminders
Industry StandardsPCI DSSSecure credential storage

Who This Applies To​

Anything that renews on its own:

  • Subscription box services
  • SaaS companies
  • Streaming services
  • Membership organizations
  • Gym and fitness memberships
  • News and magazine subscriptions
  • Free trial to paid conversion models
  • Any recurring billing arrangement

Section Contents​

Recurring Billing Requirements​

What you actually have to do:

  • Visa and Mastercard stored credential rules
  • Free trial conversion requirements
  • ROSCA obligations
  • California ARL requirements
  • Cancellation process requirements

Failed Payment Collection​

When to stop chasing a failed payment, what the FDCPA says, and when it's time to write it off:

  • Dunning vs collections vs charge-off
  • 90-day industry standard
  • Collections agency usage
  • Cost-benefit analysis by debt age
  • When to write off entirely

Key Dates Timeline​

DateEvent
2010ROSCA enacted
2018Visa/Mastercard stored credential mandate
2020Visa free trial rules enhanced
2022Mastercard subscription rules updated
Oct 2024FTC Click-to-Cancel Rule finalized
Jan 2025FTC Rule misrepresentation provisions effective
July 2025FTC Rule vacated by 8th Circuit; CA ARL amendments effective

Quick Compliance Checklist​

Pre-Enrollment​

  • Clear disclosure of all terms before collecting payment info
  • Price, frequency, and cancellation policy displayed prominently
  • Terms not buried in fine print or terms of service

At Enrollment​

  • Express consent captured (checkbox, not pre-checked)
  • Consent retained for 3+ years (California requirement)
  • Separate consent for subscription vs. one-time purchase

Post-Enrollment​

  • Confirmation sent immediately after enrollment
  • All subscription terms included in confirmation
  • Cancellation instructions provided

Before Trial Conversion​

  • Advance notice sent 7+ days before first paid charge
  • Specific amount and date included
  • Cancellation method clearly stated

Ongoing​

  • Easy cancellation (same method as signup)
  • Annual reminders (required by California for 12+ month terms)
  • Price change notifications in advance

Enforcement Risk​

FTC Enforcement:

  • Up to ~$53,000 per violation (as of 2025 civil penalty adjustments)
  • Recent cases: Uber, Cleo AI, Care.com, Amazon (ongoing)

State Enforcement:

  • California AG, district attorneys
  • Private plaintiff class actions common
  • Other state AGs increasingly active

Network Enforcement:

  • Elevated chargebacks for subscription disputes
  • Potential VAMP/ECM enrollment
  • Merchant account termination risk
Last Verified: December 2024

These rules move fast. The Click-to-Cancel Rule's status can change again. California's ARL is strict and it gets enforced. Check the current text before you decide anything.

Next Steps​

New to subscription compliance?

  1. Read the recurring billing requirements - Detailed network and legal requirements
  2. Understand network rules - VAMP, ECM thresholds affecting subscriptions

Preventing subscription disputes?

  1. Implement chargeback prevention - Alerts and prevention tools
  2. Fix billing descriptors - Reduce "I don't recognize" disputes

Fighting subscription chargebacks?

  1. Build compelling evidence - Win subscription disputes
  2. Reduce chargebacks fast - Emergency response playbook

See Also​

Last updated on