Subscription practices and auto-renewal compliance in the United States have been thrown back into a stormy sea of state laws and shifting federal currents. What was once hoped to be a clear standard for operation based on the Federal Trade Commission’s (FTC) revised Negative Option Rule (NOR)—has returned to its unwieldy state of varying state-laws and industry requirements, without a clear federal baseline for consistency.

A Sea of Distinguishable Auto-Renewal Laws

Before the FTC even raised anchor with the amended NOR, companies were already navigating a continuously rising tide of rules across the nation. As of the writing of this article, over 20 states (plus D.C.) have their own automatic renewal laws, each with their own varying nuances and requirements. To comply with each can be a nightmare for national businesses, akin to sailing through rocky-waters with scattered lighthouses flashing different signals.

State Automatic Renewal Laws (ARLs) generally demand clear and conspicuous disclosures that a subscription will renew, upfront affirmative consent from the consumer, and easy cancellation mechanisms. But beyond those basics, no two states’ requirements are exactly alike. For example, some states like Vermont, Oregon, Virginia, and D.C. impose extensive requirements modeled after California’s pioneering law. Other states take a lighter touch or cover only certain contracts (for instance, a few historically only regulated gym memberships or service contracts). Further adding to the chaos, many states, even after implementing laws, continue to refine and amend the legal requirements. This creates a legal environment akin to navigating shifting sandbars—businesses risk running aground on class-action or attorney-general enforcement if they misjudge these ever-changing requirements.

To illustrate the complicated waters, California’s Automatic Renewal Law (in effect since 2010 and beefed up in 2018, 2022, and 2025) requires everything including the kitchen galley: prominent disclosure of recurring charges, affirmative consent explicitly for the auto-renewal terms, a post-purchase acknowledgment with terms and cancellation instructions, and a simple online cancel method for online sign-ups. New York’s law, effective 2021, similarly mandates clear disclosures and lets consumers cancel online if they enrolled online. Colorado and Delaware, which joined the fray in 2022, both insist that if a customer can subscribe on a website, they must be able to unsubscribe via the website just as easily, and California and others have recently included similar requirements in their amended laws. Meanwhile, states like Tennessee, Minnesota, and Utah only recently enacted their first broad laws (in 2024–2025), adding notice requirements and even banning certain “save offer” tactics that pressure consumers at cancellation.

In short, the U.S. map is dotted with a mix of strict, moderate, and narrow auto-renewal regulations – a perilous sea for unwary captains of industry.

States with Auto-Renewal Laws

FTC’s Negative Option Rule: A Lighthouse on the Horizon, Extinguished

For a brief moment, it looked like a federal lighthouse might guide companies through the subscription shoals. In October 2024, the FTC adopted the sweeping NOR popularly dubbed the “Click-to-Cancel” rule, which promised to streamline auto-renewal compliance with one national standard. The rule required, in one fell swoop: clear up-front disclosures, consumers’ express informed consent to recurring charges, cancellation “at least as easy as signing up” (including same-medium cancellation), and reminders about trials and renewals. However, it was also considered overly expansive in application, also applying to business-to-business contracts—contracting parties that have traditionally been considered sophisticated parties unbound by similar consumer contracting restrictions. The law was challenged in a variety of states, which were consolidated and heard by the Eighth Circuit.

In its July 8, 2025 opinion, the Eighth Circuit unanimously vacated the NOR in its entirety, just before the rule was set to take effect only days later. The court’s decision turned on the FTC’s failure to issue a preliminary regulatory analysis as required by Section 22 of the FTC Act (15 U.S.C. § 57b-3(b)(1)). This analysis is mandated when a proposed rule is expected to have an annual economic effect of $100 million or more. Although the FTC initially estimated the rule’s impact would fall below this threshold, an Administrative Law Judge (ALJ) later found that compliance costs would exceed $100 million annually. Despite this finding, the FTC did not issue the required preliminary analysis before finalizing the rule, and the court found such procedural error was not harmless—by failing to provide a preliminary regulatory analysis, the FTC deprived interested parties of the opportunity to comment on reasonable alternatives and the cost-benefit analysis at a critical stage of the rulemaking process. As a result, the newly amended NOR had to be nullified.

Importantly, this nullification does not necessarily mean that the decision is binding in other jurisdictions beyond those of the consolidated cases (i.e., the 8^th, 5^th, 6^th, and 11^th Circuits), but, as a practical matter, other all other circuit courts will likely find this decision to be persuasive. Moreover, nothing about this ruling touches on whether the breadth of the FTC’s proposed NOR exceeded the authority of the FTC, including the business-to-business application. Instead, this ruling is entirely based on a procedural error, and there is nothing in this ruling that would prevent the FTC from using the same rule’s requirements so long as it is subject to a preliminary regulatory analysis as required by Section 22 of the FTC Act. At this time, there is no indication that the current administration will challenge the ruling or engage in remediating activities. In nautical terms, the lighthouse went dark as soon as it was lit, and there is no sign of a new national light shining any time soon.

Adrift After the Storm: A Regulatory Vacuum and Divergent Currents

With the FTC’s NOR now overturned, compliance has largely reverted back to the patchwork of state laws, each setting its own course. However, even without the NOR in place, businesses must still account for limited federal requirements when developing their subscription compliance programs, including the previous version of the rule that covers prenotification plans, and the Restore Online Shoppers’ Confidence Act (ROSCA). Staying abreast of these evolving rules and adapting compliance strategies accordingly is essential to mitigate the risk of non-compliance.

In response to the void left by the federal rule, many states have strengthened their own auto-renewal laws. In a sense, as the federal lighthouse fades, some states are amplifying their beacons, guiding the industry down a similar path. For instance, California has once again taken the lead, amending its ARL with new provisions that took effect on July 1, 2025—coincidentally aligning with the timeline when the FTC’s rule would have been enforced.

That said, federal protections are far from nonexistent. Section 5 of the FTC Act continues to grant the FTC the authority to bring enforcement actions against unfair or deceptive practices, including those involving negative option marketing (e.g., failing to clearly disclose auto-renewal terms or making cancellation unduly difficult). Additionally, businesses must still comply with the ROSCA, which mandates basic disclosure requirements related to auto-renewals. However, these federal laws lack the prescriptive details that the now-vacated NOR provided, leaving states to take the lead in setting more specific rules.

The net-effect of the failed FTC NOR is unknown at this time; however, we may see a magnification effect as a result of the loss—class-action attorneys have been highly anticipating this new rule, and the void left by the Rule’s demise may lead other regulators, like California, to scrutinize subscriptions and related contracting requirements more closely. While businesses engaged in B2B transactions may be safe from enforcement actions, consumer-facing subscriptions still have a high hurdle for compliance across the nation. So, what’s the best course of action if you sell subscriptions to consumers? The prevailing advice within the legal community is to adopt a “lowest-common-denominator” compliance strategy. By meeting the strictest state requirements, businesses are more likely to navigate these choppy waters unscathed.

Conclusion: Staying Afoot Amongst the Shifting Waves

So, what’s the outlook? If you are a business exclusively focused on business-to-business sales, the 8^th court’s ruling should come as a huge relief, but for those with subscription models tailored for consumers, it is even more important to stay vigilant and ensure practices don’t run afoul of the sea of potentially applicable state laws. We are continuing to monitor the net effect of this ruling, but we may see more states picking up where the FTC left off. Regardless, the best strategy is to follow best practices:

• make disclosures clear and identifiable
• implement an affirmative acceptance mechanism specific to the agreement of the auto-renewal
• send out immediate acknowledgements following purchases with required disclosures
• be mindful of time-based and annual notice requirements; and
• make cancellation simple.

Do you have questions, or any issues related to an auto-renewal program? Dentons stands ready with the experience and strategic insight to provide the necessary compliance advice, efficiently defend any pending or threatened adversarial proceeding, and help chart a business-forward path.