Updated October 2026: We updated this post to reflect that the Eighth Circuit vacated the FTC’s 2024 click-to-cancel amendments to the Negative Option Rule in July 2025, before they took effect, and to explain the ROSCA and state automatic renewal law requirements (including California’s 2025 amendments) that still apply.
The Restore Online Shoppers’ Confidence Act (ROSCA), 15 U.S.C. §§ 8401–8405, is a federal law that governs online subscriptions and other negative option offers. It requires sellers to clearly disclose all material terms before collecting billing information, obtain the consumer’s express informed consent before charging, and provide a simple way to stop recurring charges.
Passed by Congress in 2010, the Restore Online Shoppers’ Confidence Act (“ROSCA”) was intended to, among other things, regulate the deceptive billing practices of online businesses. Among the main targets of ROSCA were billing practices that allowed billing without a consumer’s explicit consent, including automatic renewal provisions that locked consumers into automatic payments from which they struggled to escape. Like many such statutes, the regulatory regime was a notice/disclosure/consent regime. That is, the solution to the abusive practices was to require businesses to provide notices and disclosures to consumers and obtain their consent to the respective billing practices involved. As is typical of these regulatory regimes, ROSCA requires that the notice/disclosure be “clear and conspicuous” and that the online business obtain “express” and “informed” consent from the consumer before these recurring charges can begin. Further, notice/disclosure and consent had to be given and obtained prior to the collection of the consumer’s billing information. With respect to recurring charges, the statute requires a business to disclose:
- That recurring charges existed
- That, unless a consumer took action, the consumer would be automatically charged
- The amount of the recurring charges
- The frequency of such recurring charges
- The date such recurring charges are charged
- Any date by which the consumer must take action to stop the recurring charges
- All information necessary to entirely cancel the recurring charges
The federal regulatory agency tasked with enforcement of ROSCA is the Federal Trade Commission (“FTC”). Over the years, the FTC has explained how it reads many of the ROSCA statutory requirements, most notably in its 2021 Enforcement Policy Statement Regarding Negative Option Marketing. For example, the FTC has taken the position that the disclosures for recurring charges should not be buried among other terms, and that the business should obtain the consumer’s consent to the recurring charges separately from consent to the rest of the transaction. In addition, ROSCA treats a violation of the statute as a violation of an FTC trade regulation rule under the Federal Trade Commission Act. This means that ROSCA violations are treated as unfair or deceptive acts or practices, and the FTC can seek civil penalties and consumer redress.
In any event, for consumers, the major problem has always been cancellation and how to escape being charged every month without enormous hassles and wait times. ROSCA requires “simple mechanisms” for a consumer to stop recurring charges, and the FTC’s 2021 policy statement took the position that cancellation should be at least as easy as sign-up. But that leaves a lot of maneuvering room. For profit and revenue reasons, businesses have deep incentives to make cancellation difficult for consumers. Obviously, a successful cancellation is recurring revenue that “escapes.” Businesses have been inventive in creating strategies and tactics for discouraging cancellation. Efforts have included:
- Burying the cancellation link or button
- Making the process cumbersome
- Requiring extra data and personal information before cancellation can be processed (in a claimed effort to “protect” the consumer from fraud)
- Requiring the consumer to verify the cancellation through text or call and email verification procedures
- Offering new deals or other products to “distract” the consumer from cancellation
- And more
In late 2024, the FTC adopted a new Final Rule amending its Negative Option Rule in an attempt, yet again, to help consumers. In the past, the FTC’s guidance focused on mechanisms that were “at least as easy” as the signup. The amended rule went further and would have required businesses to “provide a simple mechanism to cancel the negative option feature and immediately halt charges…” This is the so-called “click-to-cancel” rule. The rule addressed the three most common forms of sign-up: internet, telephone, and in-person. It would have required that the same method be available for cancellation as for sign-up, that the cancellation method be “simple” (a “click” for online and a simple statement for a telephone or in-person sign-up), and that the cancellation take effect immediately.
The Eighth Circuit Vacated the Click-to-Cancel Rule
The click-to-cancel rule never took effect. On July 8, 2025, the U.S. Court of Appeals for the Eighth Circuit vacated the FTC’s 2024 amendments to the Negative Option Rule in Custom Communications, Inc. v. Federal Trade Commission (8th Cir. 2025), before businesses were required to comply with them. The court set the amendments aside on procedural grounds related to how the FTC conducted the rulemaking. It did not hold that the FTC lacks authority to police subscription practices, and it did not change ROSCA.
Said another way, the vacatur removed a new layer of federal regulation, but it did not remove the obligations that subscription businesses already had. ROSCA still requires clear disclosure of material terms before billing information is collected, express informed consent before the consumer is charged, and simple mechanisms to stop recurring charges. The FTC continues to bring ROSCA cases, and state automatic renewal laws continue to apply. Businesses that built cancellation flows to meet the click-to-cancel rule should think carefully before rolling those changes back, because many of the same practices are what ROSCA and state law require.
Compliance Checklist for Online Businesses Under ROSCA and State Automatic Renewal Laws
ROSCA and state automatic renewal laws create concrete obligations for any online business that offers subscription products or services. Because ROSCA violations are treated as violations of an FTC rule, non-compliance exposes businesses to civil penalties that the FTC can seek in federal court under Section 5 of the FTC Act (15 U.S.C. § 45). With per-violation penalties exceeding $50,000 (adjusted annually for inflation), and with each individual subscriber potentially constituting a separate violation, the financial exposure from a systematic compliance failure is substantial.
The Four Pillars of Subscription Compliance
The vacated amendments to the Negative Option Rule (16 C.F.R. Part 425) were organized around four core requirements. Even without the amended rule, these four areas remain a practical way to organize compliance under ROSCA and state law:
- Disclosure. ROSCA requires that all material terms of the negative option offer be disclosed clearly and conspicuously before the consumer submits billing information. “Clear and conspicuous” means the disclosure must be difficult to miss. It should not appear only in fine print, in a hyperlinked document, or after the consumer has already provided billing information. The disclosures should include the fact that recurring charges will occur, the amount and frequency of charges, the deadline to cancel to avoid the next charge, and how to cancel.
- Consent. ROSCA requires the consumer’s express informed consent before charging. The FTC has taken the position that consent to the negative option feature should be obtained separately from consent to the broader transaction. A single checkbox that says “I agree to the Terms of Service” that buries the subscription terms creates real risk. The safer approach is to present the negative option for separate, affirmative consent, meaning the consumer takes a deliberate action (checking a box, clicking a button) specifically to authorize the recurring charge.
- Annual reminders. The vacated federal rule would have required annual reminders. Federal law does not currently impose that requirement, but state law may. California’s Automatic Renewal Law, as amended by AB 2863 (effective July 1, 2025), requires annual reminders for many ongoing subscriptions. Reminders also help address “zombie subscriptions” that consumers forgot they signed up for, which are a frequent source of complaints and chargebacks.
- Simple cancellation. ROSCA requires simple mechanisms to stop recurring charges, and the FTC has continued to bring cases against companies that make cancellation difficult. State laws are often more specific. California, for example, requires that consumers who sign up online be able to cancel online. As a practical matter, if sign-up occurs online, cancellation should be available online through a simple mechanism, and online cancellation requests should not be routed through phone trees, mandatory live agent conversations, or waiting periods.
Dark Pattern Prohibition
The FTC has repeatedly targeted so-called “dark patterns,” meaning user interface design choices that are intended to manipulate users into signing up for or retaining subscriptions they did not fully intend to purchase. Specific dark patterns that the FTC has challenged as deceptive or unfair under ROSCA and Section 5 of the FTC Act include:
- Confirming cancellation only after requiring the consumer to navigate multiple pages or screens (“roach motel” design)
- Forcing consumers to speak with a retention agent before cancellation can proceed
- Using interface design to make the “cancel” button visually less prominent than a “continue subscription” button
- Making cancellation available only during limited business hours when sign-up is available 24/7
State Law Overlay
ROSCA sets a federal floor, and with the click-to-cancel rule vacated, state automatic renewal laws now carry much of the detailed regulation of subscription practices. California’s Automatic Renewal Law (Cal. Bus. & Prof. Code §§ 17600 et seq.) is among the most demanding, requiring clear and conspicuous pre-enrollment disclosures, affirmative consent to renewal terms, an acknowledgment at the time of subscription, and a cancellation mechanism that is easy to use. California’s AB 2863, which took effect July 1, 2025, tightened those requirements further, including express affirmative consent to the automatic renewal terms, annual reminders, and online cancellation for consumers who sign up online. California courts and the California Attorney General have actively enforced these requirements, with settlements in the tens of millions of dollars in some cases. New York, Illinois, Oregon, and a growing number of other states have similar automatic renewal laws that businesses must comply with in addition to ROSCA.
If your business uses subscriptions, free trials with automatic conversion, or any negative option billing arrangement, now is the time to audit your disclosures, consent flows, and cancellation mechanisms. Contact the FTC and Internet Law attorneys at Revision Legal or visit our internet law practice page to review your business’s compliance.
Contact the FTC Attorneys at Revision Legal
For more information, contact the experienced FTC Lawyers at Revision Legal. You can contact us through the form on this page or call (855) 473-8474.
Frequently Asked Questions
What is ROSCA?
ROSCA is the Restore Online Shoppers’ Confidence Act, a 2010 federal law (15 U.S.C. §§ 8401–8405) that regulates online negative option offers, such as free trials that convert to paid subscriptions and automatic renewals.
What does ROSCA require?
Sellers must clearly and conspicuously disclose all material terms before obtaining billing information, obtain the consumer’s express informed consent before charging them, and provide a simple mechanism for stopping recurring charges.
Who enforces ROSCA?
The Federal Trade Commission enforces ROSCA, and violations are treated as violations of an FTC rule, which can lead to civil penalties and consumer redress. State attorneys general can also bring actions.
Is the FTC click-to-cancel rule still in effect?
No. The U.S. Court of Appeals for the Eighth Circuit vacated the FTC’s amended Negative Option Rule, commonly called the click-to-cancel rule, on July 8, 2025, in Custom Communications, Inc. v. FTC, before it took effect. ROSCA itself remains in force, as do state automatic renewal laws.
Do state auto-renewal laws still apply to subscription businesses?
Yes. Many states, including California, have their own automatic renewal laws with disclosure, consent, and cancellation requirements that apply in addition to ROSCA. California amended its law through AB 2863, effective July 1, 2025.
