Updated October 2026: We updated this post to explain that the FTC’s 2024 click-to-cancel rule was vacated by the Eighth Circuit in July 2025, to refocus on ROSCA itself, recent FTC ROSCA enforcement (including the 2025 Amazon Prime settlement), and state automatic renewal laws, and to correct several outdated details.
Congress enacted the Restore Online Shoppers’ Confidence Act (“ROSCA”), 15 U.S.C. §§ 8401–8405, in 2010. ROSCA had two main purposes. First, it was intended to protect online consumers and purchasing by banning “payment data passing.” This occurred when merchants sold or passed along consumer payment and billing data without the consent of the consumer. This often happened without even the knowledge of the consumer. Some merchants then used the unauthorized payment and billing data to charge the consumer for other and additional goods or services. Since the consumer was not required to reenter payment and billing information, many consumers were charged and received products that they did not want. All of this has been given the cumbersome name of “internet-based post-transaction third-party sales.” ROSCA bans and prohibits such transactions.
More specifically, ROSCA prohibits the so-called “data pass.” That is, the initial online merchant is not allowed to share or disclose payment/billing data, such as payment card and bank account numbers, to another merchant/third-party seller for use in a sale by said merchant/third-party seller. As another protection, ROSCA provides that if such merchant/third-party seller wants to attempt a sale, then it cannot obtain the “data pass” without providing various notices and obtaining express consent from the consumer.
Since the enactment of ROSCA, many States have enacted their own consumer data privacy and protection statutes. One of the most famous is the California Consumer Privacy Act, which has been amended and strengthened in recent years. As another example, Indiana passed its own consumer data privacy/protection statute called the Indiana Consumer Data Protection Act (“ICDPA”), which took effect on January 1, 2026. These state-level statutes generally limit how businesses may use and share consumer data, such as billing and payment information, beyond the purposes disclosed to the consumer, and they give consumers rights to control or opt out of the sale or sharing of their personal data. In effect, these State-level statutes add another layer of restriction on the kind of “data pass” between online merchants that ROSCA outlaws.
ROSCA also had a second purpose which was to regulate what are called “negative option features” in online product and service sales. “Negative option” refers to a legal concept where a consumer’s consent to purchase or continue receiving a product is INFERRED from a customer’s silence, failure to cancel a product/service, or failure to take some other affirmative action to reject those goods or services. For example, consider some “PRODUCT of the Month” internet sales (like maybe types of coffee). These might be “fun” for the first couple of months. However, such sales become very problematic if the consumer wants to cancel the ongoing product/service but cannot find an easy method of cancellation. Worse still are those products or services bought online where the consumer thinks the purchase is “one-off.” However, a month later, there is another charge and another product arrives.
ROSCA prohibits the use of such negative options in online sales agreements unless:
- The full and complete terms of the transaction are fully and conspicuously disclosed BEFORE billing and other information is collected
- The seller obtains express informed consent before charging the consumer, and
- The consumer has a simple mechanism to cancel or otherwise stop the recurring charges
Contact the Internet Attorneys at Revision Legal
For more information, contact the experienced Ecommerce Lawyers at Revision Legal. You can contact us through the form on this page or call (855) 473-8474.
The FTC’s 2024 ‘Click-to-Cancel’ Rule and Its Vacatur
In October 2024, the Federal Trade Commission finalized amendments to its Negative Option Rule (16 C.F.R. Part 425), commonly called the “click-to-cancel” rule. The amendments would have extended detailed disclosure, consent, and cancellation requirements to nearly all negative option offers, online and offline, including a requirement that cancellation be no harder than enrollment. For example, a consumer who subscribed online would have been entitled to cancel online, without being forced to call a retention line.
The amended rule never took effect. On July 8, 2025, the U.S. Court of Appeals for the Eighth Circuit vacated the amendments in Custom Communications, Inc. v. Federal Trade Commission (8th Cir. 2025), before businesses were required to comply with them. The court set the rule aside on procedural grounds related to the FTC’s rulemaking process. It did not change ROSCA, and it did not limit the FTC’s ability to enforce ROSCA and Section 5 of the FTC Act.
Said another way, the core federal obligations for online subscriptions are the same ones ROSCA has imposed since 2010: clear and conspicuous disclosure of all material terms before billing information is collected, express informed consent before the consumer is charged, and simple mechanisms to stop recurring charges. Because a ROSCA violation is treated as a violation of an FTC rule, the FTC can seek civil penalties of more than $50,000 per violation (adjusted annually for inflation), along with consumer redress and injunctive relief. Many businesses already overhauled their cancellation flows in anticipation of the click-to-cancel rule. Those changes remain a sensible way to meet ROSCA’s “simple mechanism” requirement and state law.
Recent FTC Enforcement Actions Under ROSCA
The FTC has used ROSCA aggressively against companies employing deceptive subscription practices, and the vacatur of the click-to-cancel rule has not slowed that enforcement. Notable actions include:
- FTC v. Vonage Holdings Corp. (2022): Vonage agreed to pay $100 million to settle FTC allegations that it used illegal dark patterns to prevent customers from canceling VoIP service subscriptions, violating ROSCA’s requirement for simple cancellation mechanisms.
- FTC v. Amazon.com, Inc. (filed 2023): The FTC sued Amazon, alleging that it enrolled consumers in Amazon Prime through manipulative design choices (“dark patterns”) and made cancellation deliberately difficult, in violation of ROSCA. In September 2025, Amazon agreed to pay $2.5 billion to resolve the case, consisting of a $1 billion civil penalty and $1.5 billion in refunds to consumers, along with injunctive relief addressing its sign-up and cancellation practices.
- FTC v. Benefytt Technologies (2022): Benefytt agreed to a $100 million settlement resolving FTC allegations that it used negative option marketing to sell health benefit memberships without adequate disclosure and without simple cancellation.
State Automatic Renewal Laws: Additional Compliance Layer
In addition to federal ROSCA enforcement, many states have enacted automatic renewal laws (ARLs) that impose requirements on subscription businesses operating in those states. With the federal click-to-cancel rule vacated, these state laws now supply many of the most specific subscription requirements. California’s ARL (Cal. Bus. & Prof. Code § 17600 et seq.) is among the most demanding, requiring specific pre-enrollment disclosures, affirmative consent, and acknowledgment of subscriptions. California amended its ARL through AB 2863, effective July 1, 2025, which added requirements including express affirmative consent to the automatic renewal terms, annual reminders for ongoing subscriptions, and online cancellation for consumers who sign up online. New York, Illinois, and Utah have similarly robust ARLs. Violation of state ARLs can give rise to class action litigation, and California’s ARL has generated significant class action exposure for subscription businesses.
A comprehensive compliance program for subscription and recurring charge businesses must address both federal ROSCA requirements and applicable state ARLs. Because state ARLs vary in their specific requirements, including the content of required disclosures, the timing of reminder notices, and required cancellation mechanisms, multi-state compliance requires a state-by-state analysis. Revision Legal’s e-commerce attorneys can conduct that analysis and help your business build a compliant subscription program. Contact us at (855) 473-8474.
