Every autorenewal lawsuit I've read has the same shape. A consumer signs up for a free trial, gets charged when the trial ends, doesn't notice the charge for three months, tries to cancel and finds a cancel-flow that requires a phone call during business hours. They sue. The subscription business settles for $2M-$10M. Happens about twenty times a year at scale.
The FTC Click-to-Cancel rule, which takes full effect in 2026, is Congress and the commission trying to end that pattern. Plus California's autorenewal law (BPC 17600-17606, amended by AB-390 in 2022). Plus New York's (GBL 527-a). Plus Virginia, Colorado, Illinois, Oregon, and New Jersey.
The Subscription Autorenewal Audit checks the 12 signals that matter across all of them.
The 12 signals
1. Recurring billing signals. The audit verifies the page is actually a subscription page. If your subscriptions live on /pricing but you run the audit on /, you won't get useful results.
2. Clear-and-conspicuous autorenewal disclosure. CA BPC 17602 and NY GBL 527-a both require autorenewal disclosure "clear and conspicuous" near the accept button. Buried-in-TOS doesn't count. This is the #1 reason autorenewal complaints get traction.
3. Self-service cancel path. The FTC Click-to-Cancel rule is simple: if a consumer can sign up online, they must be able to cancel online with the same number of clicks. No phone-only, no chat-only, no email-required cancellation flows. Most SMBs fail this because the cancel link is on a page the signup flow doesn't mention.
4. Free-trial to auto-charge disclosure. Before the trial converts to paid, you must state: the charge amount, the billing date, how to cancel. Missing any of these has been the specific finding in multiple FTC settlements.
5. Pre-renewal reminder policy. California AB-390 (2022) requires reminder notice 3-21 days before annual renewal. The standard policy that covers all states: "We email you 7 days before each annual renewal."
6. Price-change notice policy. CA BPC 17602(d) requires advance notice of material changes. Industry standard: "We notify you at least 30 days before any price change by email."
7. Annual vs monthly cadence explicit. "Billed monthly" and "Billed annually" are required language — not just "$X/mo" in ambiguous marketing copy.
8. Recurring billing processor signal. Stripe Billing, Paddle, Chargebee, Recurly, RevenueCat, Apple IAP, Google Play Billing, Memberstack, Memberful, WooCommerce Subscriptions — each has a customer portal that satisfies Click-to-Cancel out of the box. You just have to actually link to it.
9. Refund / cancellation policy page. Some states (notably NY GBL 527-a) require clear cancel + refund terms.
10. California-specific autorenewal language. Optional but defensive. If you have CA subscribers, add CA-specific disclosure language calling out Civil Code §§1749-1763 + BPC 17602 protections.
11. Cancellation contact available. Self-service is the primary path; contact is backup.
12. Cancel-flow friction (manual review). FTC Click-to-Cancel caps cancel-flow friction: at most one "save offer" intervention allowed before the cancel button appears. The audit can't detect this programmatically — walk through your own cancel flow quarterly and count steps. More than two clicks from Cancel button to confirmation is a fail.
The 50-state policy
The good news: one compliant policy covers all 50 states. The policies with the narrowest and most specific requirements (California + New York) are strict supersets of the federal rule. If you comply with California's BPC 17602 and New York's GBL 527-a, you comply everywhere.
Specifically:
- Disclose autorenewal clearly and conspicuously near the accept button
- Email a pre-renewal reminder 7 days before each annual renewal
- Notify subscribers of price changes 30 days in advance by email
- Provide a one-click cancel path accessible from the account page
- Link to the cancel path from every subscription confirmation email
- Keep a refund/cancellation policy page
- Honor cancellations within the same billing period they're requested
That's the entire bar. Every compliance-sensitive SMB should match it.
Platform-level customer portals
If you're on a modern billing platform, most of the mechanics are built.
Stripe Billing → Customer Portal. Configurable: let the user pause, update payment, change plan, cancel. Link to the portal from the user's account page. Stripe provides the URL + session management.
Paddle. Paddle Checkout + Customer Portal — similar shape to Stripe.
Chargebee. Chargebee Customer Portal. Self-service cancellation is one toggle.
Recurly. Hosted Account Management Page. Built for this.
RevenueCat. For mobile-app subscriptions — links into Apple or Google native subscription management.
Memberstack / Memberful / MemberSpace. For membership-plugin WordPress setups. Each has a self-service cancel option in dashboard config.
WooCommerce Subscriptions. Manual enable: Subscriptions settings → "Customers can manage own subscriptions."
The mechanics are usually two dashboard toggles. The miss is usually not linking to the portal prominently enough — it has to be on the account page, on the billing email footer, and ideally in the confirmation-of-purchase email.
The FTC Click-to-Cancel timeline
As of early 2026:
- May 2024: FTC published the final Negative Option / Click-to-Cancel Rule.
- January 2025: Initial effective date for the most consumer-facing provisions.
- 2026: Full effective date including the "at most one save offer" + "same method of cancellation as enrollment" provisions.
Enforcement actions on Amazon Prime (2023) and Adobe (2024) both cited the Click-to-Cancel patterns even before the rule was final. FTC is signaling hard.
Related reading
- Email Compliance Footer — CAN-SPAM side of outbound
- SMS Compliance Audit — TCPA side
- PCI SAQ-A — payment data scope
- Merchant Category Code — payment MCC for subscription billing
- Transparency Page Trust — why visible pricing is a trust multiplier
Fact-check notes and sources
- Federal Trade Commission Negative Option / Click-to-Cancel Final Rule (published May 2024).
- California Business and Professions Code §§ 17600-17606.
- California AB-390 (2022) — annual renewal reminder notice requirement.
- New York General Business Law § 527-a.
- Virginia Code § 59.1-207.45.
- Colorado Revised Statutes § 6-1-732.
- Illinois 815 ILCS 601 (Automatic Renewal Act).
- Oregon ORS 646A.295.
- New Jersey Automatic Renewal Act § 56:12-17.
- FTC action against Amazon Prime (FTC v Amazon.com, 2023).
- FTC action against Adobe (FTC v Adobe Inc., 2024).
This post is informational, not legal or compliance-consulting advice. The FTC Click-to-Cancel rule, California BPC 17600-17606, New York GBL 527-a, and related state autorenewal statutes evolve. Consult qualified counsel before making compliance-sensitive changes. Mentions of Stripe, Paddle, Chargebee, Recurly, RevenueCat, Memberstack, MemberSpace, Memberful, WooCommerce, Apple, Google, Amazon Prime, Adobe are nominative fair use. No affiliation is implied.
