DTC Subscription Billing Compliance: The FTC Negative Option Rule and State Auto-Renewal Laws Every Brand Must Follow in 2026

If your DTC brand runs a subscription model — and most do — you're operating in one of the most aggressively regulated corners of consumer protection law right now. The FTC's revised Negative Option Rule (16 CFR Part 425) was supposed to impose uniform "click-to-cancel" requirements nationwide starting in 2025. But a federal court vacated the rule, the FTC reopened rulemaking, and in the meantime the agency hasn't slowed down its enforcement drive one bit. Layer on California's amended Automatic Renewal Law, Colorado's auto-renewal statute, and a rising wave of class actions — and DTC subscription billing compliance has become a multi-jurisdictional minefield that no brand can afford to ignore.

Here's what every DTC brand needs to understand about the current legal landscape, the enforcement actions redefining the rules, and the practical steps you must take to stay compliant.

The FTC's Negative Option Rule: What Happened and What It Means

In October 2024, the FTC announced its final "Click-to-Cancel" Rule — sweeping amendments to 16 CFR Part 425 that would have required sellers to obtain express informed consent before charging consumers for negative option programs, provide simple cancellation mechanisms, and deliver annual reminders for subscriptions. The rule was published in the Federal Register in November 2024 and took effect in January 2025.

But in July 2025, the U.S. Court of Appeals for the Eighth Circuit vacated the 2024 amendments, holding that the FTC had not conducted the preliminary regulatory analysis required by Section 22 of the FTC Act. The court didn't reach the merits of the rule's substance — it struck it down on procedural grounds.

As of March 2026, the FTC has issued a new Advance Notice of Proposed Rulemaking (ANPRM) to revisit the rule, signaling its intent to re-propose many of the same requirements — broad disclosure mandates, separate verifiable consent for recurring charges, and cancellation processes at least as easy as enrollment. The FTC is accepting public comment and has made clear it views the current patchwork of authorities — ROSCA, Section 5 of the FTC Act, the Telemarketing Sales Rule, and state laws — as insufficient to address persistent consumer harm.

For DTC brands, the key takeaway is this: the rule may be vacated, but the FTC's enforcement expectations are alive and well. The agency is using every tool it has — and winning record settlements.

FTC Enforcement Actions: The New De Facto Compliance Standard

Even without the revised rule in force, the FTC has brought a series of high-profile enforcement actions that establish what it expects from subscription businesses. These cases function as a compliance roadmap — and they're expensive lessons for the companies involved.

Match.com — $14 Million Settlement

The FTC alleged that Match.com deceptively induced consumers to subscribe by promising a complimentary six-month subscription without adequately disclosing the qualifications, unfairly suspended accounts of users who disputed charges, and made cancellation procedures confusing and cumbersome. The resulting $14 million settlement requires Match.com to clearly disclose all material terms and conditions, refrain from misrepresenting restrictions, cease retaliatory actions against consumers who file billing disputes, and provide simple, accessible cancellation methods.

Chegg — $7.5 Million Settlement

The FTC's settlement with Chegg, an education technology provider, resolved allegations that the company continued to charge consumers after they attempted to cancel, made online cancellation options difficult to locate, created a confusing and cumbersome cancellation process, and failed to improve cancellation accessibility even after being notified of consumer difficulties. The $7.5 million settlement requires that Chegg's online cancellation mechanism be easy to find and that cancellation requests be promptly processed.

Amazon — $2.5 Billion Settlement

Most dramatically, the FTC secured a $2.5 billion settlement with Amazon in the midst of trial over its Prime enrollment and cancellation processes. The stipulated order requires Amazon to include a clear option for customers to decline membership not obscured by retention offers, include language in the call to action that characterizes Prime as a membership, indicate that the membership "renews" on all sign-up pages for services with auto-renewal, and always disclose the price and auto-renewal feature on the sign-up page. The order also states that if the FTC promulgates a new amended rule governing negative options, those requirements will supersede the Amazon-specific requirements — a signal the agency intends to try again.

Across these cases, the FTC consistently targets three things: opaque or misleading disclosures about auto-renewal terms, cancellation processes more difficult than sign-up, and practices that frustrate or penalize consumers seeking to cancel.

State Auto-Renewal Laws: The Compliance Layer DTC Brands Can't Ignore

While the FTC's federal rule was vacated, state auto-renewal laws remain fully in force — and many are stricter than what the federal rule would have required. DTC brands selling to consumers in California, Colorado, and other states with auto-renewal statutes must comply with each state's specific requirements.

California's Amended Automatic Renewal Law (Effective July 1, 2025)

California's Automatic Renewal Law (ARL), amended by AB 390, took effect July 1, 2025, and applies to subscriptions, plans, and services that continue until the consumer cancels or automatically renew — including free or discounted trial periods. According to the California Attorney General's consumer alert, the law requires:

• Express affirmative consent to auto-renewal or continuous-service terms before any charge
• Pre-renewal notice at least 15 days but no more than 45 days before renewal for subscriptions with an initial term of one year or longer — including the length, terms, amount or range of charges, frequency, and cancellation instructions
• Free trial notice at least 3 days but no more than 21 days before a free or discounted trial period expires (for trials lasting more than 31 days)
• Fee change notice at least 7 days but no more than 30 days before a fee change takes effect
• Annual reminder sent using the same method of communication as enrollment — identifying the product or service, frequency and amount of charges, and how to cancel
• Online cancellation — consumers must be able to cancel online, at will, using a prominent link or button

California's ARL is enforced by the Attorney General and also serves as the predicate for private class actions under the state's Consumer Legal Remedies Act (CLRA), False Advertising Law (FAL), and Unfair Competition Law (UCL).

Colorado's Auto-Renewal Statute (C.R.S. § 6-1-732)

Colorado's auto-renewal law, codified at C.R.S. § 6-1-732, imposes its own set of requirements on sellers offering automatic renewal contracts to Colorado consumers:

• Clear and conspicuous disclosure of automatic renewal offer terms before the contract is executed — including that the contract will auto-renew, the cancellation policy, recurring charges, renewal term length, and minimum purchase obligation
• Written acknowledgment containing the renewal terms, cancellation policy, and cancellation instructions in a format the consumer can retain
• Simple cancellation mechanism — a one-step online cancellation link on the seller's website or in an electronic communication, available immediately or after reasonable authentication
• Material change notice — if terms change, the seller must provide clear notice of the change and cancellation information
• Pre-renewal notice at least 25 days but no more than 40 days before the first automatic renewal and each renewal thereafter, with specific rules for terms shorter than 12 months

Colorado's law is enforced exclusively by the Attorney General and district attorneys — but violations are also actionable as deceptive trade practices under the Colorado Consumer Protection Act, which carries civil penalties.

Other States

California and Colorado are the most prominent examples, but at least two dozen states have auto-renewal laws on the books, including New York, Illinois, and Texas (which has its own automatic renewal provisions under the Texas Business & Commerce Code). DTC brands with nationwide customers must assess compliance across every jurisdiction where their subscribers reside.

The Class Action Threat: Dark Patterns Litigation

Beyond FTC enforcement and state AG actions, DTC brands face a growing wave of private class action lawsuits targeting subscription billing practices. These cases typically assert violations of state consumer protection laws — California's ARL, CLRA, FAL, and UCL are the most common — alongside common law claims for unjust enrichment and breach of contract.

A recent putative class action filed in the Northern District of California against Adobe alleges that the company deceives consumers into year-long "annual, billed monthly" plans, obscures material terms and early termination fees in fine print and hyperlinks, and makes cancellation unduly difficult. The complaint asserts ARL violations as the predicate, alleging that Adobe failed to present auto-renewal terms "clearly and conspicuously," failed to obtain affirmative consent, and failed to allow "online, at will" termination.

The Adobe case is instructive because it demonstrates how plaintiffs' attorneys are using state auto-renewal statutes as the foundation for class action litigation — even against large, sophisticated companies. The remedies sought include damages, restitution, disgorgement, and injunctive relief forcing changes to disclosure and cancellation flows.

For DTC brands, the class action risk is real and growing. Plaintiffs' firms are actively soliciting clients and filing complaints based on dark pattern allegations — design choices that make it easy to subscribe but hard to cancel. Even if a brand ultimately prevails, the cost of defending a nationwide class action can be devastating for a startup or growth-stage company.

The Three Pillars of DTC Subscription Billing Compliance

Whether the FTC revives the Click-to-Cancel Rule or continues enforcement under existing authorities, and regardless of which state laws apply to your subscribers, the compliance framework comes down to three pillars:

1. Clear and Conspicuous Consent

Before any charge, you must obtain express, informed, affirmative consent. That means:

• Presenting all material terms — price, renewal frequency, cancellation policy, any trial-to-paid conversion — clearly and conspicuously, not buried in fine print or behind hyperlinks
• Obtaining a separate, affirmative action for the auto-renewal consent (not bundled with a general terms-of-service checkbox)
• For upsells or additional charges mid-subscription, obtaining separate consent for each new charge — the FTC's enforcement actions specifically target undisclosed or inadequately disclosed additional billing

2. Simple Cancellation

The FTC's consistent enforcement position is that cancellation must be at least as easy as enrollment. In practice:

• If a consumer can sign up online with one click, they must be able to cancel online with comparable ease
• Don't require phone calls, live-agent interactions, or multi-step navigation through retention offers
• Process cancellation requests promptly — don't impose waiting periods or "processing" delays
• California specifically requires a prominent online link or button for cancellation; Colorado requires a one-step online cancellation link

3. Recordkeeping and Notices

Both state and federal authorities expect sellers to maintain records of consumer consent and to provide required notices:

• Retain proof of express consent — timestamp, IP address, the terms presented, and the consumer's affirmative action
• Send pre-renewal notices within the required windows (California: 15–45 days before renewal; Colorado: 25–40 days)
• Send annual reminders identifying the product, charge frequency and amount, and cancellation method (required by California; a best practice everywhere)
• Send fee-change notices before any increase takes effect (California: 7–30 days)
• Send material-change notices for any modification to subscription terms (Colorado requires clear notice and cancellation information)

Why This Matters Now

The compliance landscape is shifting in real time. The FTC has reopened rulemaking and signaled its intent to re-propose many of the same requirements the Eighth Circuit struck down. In the meantime, the agency is aggressively enforcing under ROSCA and Section 5 — with settlements totaling billions of dollars. State AGs in California, Colorado, and elsewhere are bringing their own cases. And plaintiffs' class action attorneys are actively pursuing DTC brands for dark pattern subscription practices.

For DTC brands, this is not a "wait and see" situation. The compliance expectations are already clear from the FTC's enforcement actions, and the state laws impose concrete, operational requirements that take effect regardless of what happens at the federal level. We've written previously about the FTC's Click-to-Cancel Rule and what startups must do and ROSCA and subscription billing compliance fundamentals — but the landscape has evolved dramatically, and brands need to update their compliance posture accordingly.

Actionable Next Steps

1. Audit your enrollment flow. Review every step a consumer takes from landing page to checkout. Are auto-renewal terms, pricing, and cancellation policy presented clearly and conspicuously? Is consent obtained through a separate affirmative action — not buried in a general terms checkbox?
2. Implement click-to-cancel. If consumers can sign up online, they should be able to cancel online in the same number of steps or fewer. Remove phone-only cancellation requirements, retention offer gauntlets, and artificial processing delays. California and Colorado both specifically require an online one-step cancellation mechanism.
3. Build a notice calendar. Map out when pre-renewal notices, annual reminders, fee-change notices, and material-change notices must be sent for each subscriber — and automate the triggers. California requires notices within specific windows; Colorado has its own timing requirements. Missing these windows is a statutory violation.
4. Maintain consent records. For every subscriber, retain documentation of what terms were presented, when, and how the consumer affirmatively consented. If the FTC or a state AG comes knocking — or a class action is filed — these records are your first line of defense.
5. Review upsell practices. The FTC's enforcement actions specifically target additional charges and upsells that weren't adequately disclosed. Ensure any mid-subscription changes in billing require separate, informed consent.
6. Get a compliance review. The intersection of FTC enforcement authority, ROSCA, and multiple state auto-renewal statutes is complex — and getting it wrong can mean regulatory penalties, class action liability, and forced operational changes. If your DTC brand offers subscriptions, a legal compliance review of your billing practices is one of the highest-ROI investments you can make. For a deeper look at product liability risks DTC brands face, see our guide to DTC product liability when you're the importer.

The regulatory and litigation landscape for subscription billing is moving fast — and it's moving toward more disclosure, easier cancellation, and stricter enforcement. DTC brands that get ahead of these requirements now will avoid the costly enforcement actions and class action settlements that are defining this space.