For the past year the rules around subscription merchants have looked as if they were about to simplify. In October 2024 the Federal Trade Commission amended its 1973 Negative Option Rule to cover every form of negative option marketing in every medium, with disclosure, consent and click-to-cancel requirements that would have given an acquirer one federal standard to underwrite against. On 8 July 2025 the Eighth Circuit vacated the whole rule, six days before businesses had to comply with it. In March 2026 the Commission started again from an advance notice of proposed rulemaking, and as of 21 September 2026 it has not published a proposed rule.
For a merchant-services team that is the least important part of the story. The statute the FTC actually brings subscription cases under, the Restore Online Shoppers' Confidence Act, was never at issue and produced a $2.5 billion settlement two months after the vacatur. The Visa and Mastercard rules for a free trial and a recurring charge sit in the public rulebooks and are enforced through disputes and the monitoring programs. And twice the FTC has brought ROSCA against a payment company rather than the seller. Here is what fell, what stands, and what to check, as of September 2026.
What the Eighth Circuit Vacated, and Where the FTC Is Now
The 1973 rule covers only prenotification plans, the book-of-the-month model; FTC staff estimated in 2024 that about 25 sellers were subject to it. The October 2024 amendment, adopted on a 3-2 vote and published on 15 November 2024, extended it to continuity plans, automatic renewals and free-to-pay conversions and required clear disclosure of material terms, express informed consent and a cancellation mechanism at least as easy as sign-up. It took effect on 14 January 2025, with compliance for parts of it deferred to 14 May and then 14 July.
Industry petitions from four circuits were consolidated in the Eighth Circuit as Custom Communications, Inc. v. FTC, No. 24-3137. The per curiam opinion of 8 July 2025 never reached the argument that the Commission had exceeded its authority. Section 22 of the FTC Act requires a preliminary regulatory analysis, with alternatives and a cost-benefit comparison, for any rule with an annual effect on the economy of $100 million or more; the Commission's own administrative law judge had found the rule would clear that threshold; and the Commission published a final analysis instead of letting the public comment on a preliminary one. Losing the chance to dissuade the agency was prejudicial, the court held, and given the breadth of the rule's coverage the party-specific vacatur the Commission asked for was not feasible. The panel added that it certainly did not endorse the use of unfair and deceptive practices in negative option marketing, and vacated the rule in its entirety.
The Commission accepted the result. On 12 February 2026 it recodified the 1973 text, and on 13 March 2026 it published an advance notice of proposed rulemaking, with comments due 13 April, that reads as a fresh start on the record. It asks, in a question worth reading in this business, whether third parties such as payment service providers, subscription management providers or customer relationship management providers are involved in enrolling or cancelling consumers, what impact they have on a business's ability to disclose, obtain consent and enable cancellation, and what role they play in compliance. It also gives the Commission's own measure of the problem: complaints about negative option marketing rose from at least 33 a day in late 2020 to more than 90 a day in 2025, and since January 2025 it has filed five new cases and approved six settlements. A proposed rule, a comment period and, this time, a preliminary analysis all come before anything binds.
What Never Stopped Binding the Merchant
ROSCA has been in force since 29 December 2010, and its section 4 is short. It is unlawful for any person to charge or attempt to charge a consumer for goods or services sold in a transaction effected on the internet through a negative option feature unless the person clearly and conspicuously discloses all material terms before obtaining the consumer's billing information, obtains the consumer's express informed consent before charging the card or account, and provides simple mechanisms for the consumer to stop recurring charges. A negative option feature is any provision under which the consumer's silence is treated as acceptance, and a violation counts as a violation of an FTC rule, which is what puts civil penalties on the table.
The scale of enforcement did not change with the vacatur. On 25 September 2025 the Commission settled its Prime case with Amazon for $2.5 billion: a $1 billion civil penalty, which the FTC calls the largest ever in a case involving an FTC rule violation, and $1.5 billion in redress for an estimated 35 million consumers. The order requires a clear and conspicuous button to decline Prime during enrolment and a cancellation path using the same method the consumer used to sign up: the vacated rule's click-to-cancel standard, imposed under a statute from 2010.
Below the federal layer sit the state automatic-renewal laws. California's, as amended by AB 2863, signed on 24 September 2024 and applying to contracts entered into, amended or extended on or after 1 July 2025, requires express affirmative consent to the renewal terms, cancellation in the same medium the consumer used to sign up or is accustomed to using with the business, online termination through a prominently located link or button without steps that obstruct or delay it, a notice three to twenty-one days before a free trial or promotional price ends, and proof of consent kept for at least three years. A merchant with California customers has had a click-to-cancel rule for fourteen months regardless of what the Eighth Circuit did.
What Visa Requires at the Checkout, at the End of the Trial, and in the Dispute
The Visa Core Rules and Visa Product and Service Rules, in the public edition of 18 April 2026, treat a subscription as a stored-credential agreement. Before storing the credential a merchant must obtain express informed consent to terms that include the cancellation and refund policies, the timing and frequency of transactions and the length of any trial period, introductory offer or promotional period, displayed at the time of consent and separately from the general purchase terms. A merchant processing recurring transactions must provide a simple cancellation procedure, and at least an online one if the order was accepted online, and at least seven days before a recurring transaction must notify the cardholder by email or another agreed method if a trial, introductory or promotional period is ending, with the amount and date of the subsequent charges and a link or other simple mechanism to cancel online or by SMS.
Section 5.8.17.2 adds a layer for what Visa calls a negative option merchant, one that requires a cardholder to expressly decline future transactions: disclose the terms on the checkout screen, obtain consent via a click-to-accept button there, send a receipt or written confirmation immediately afterwards that states the trial length, that the cardholder will be charged unless they cancel, the amounts and dates, and, if sent by email, a link to a page where the agreement can be easily cancelled, and give seven days' written notice before any subsequent transaction if the terms have changed or a trial is ending.
Where this lands on an acquirer is in chapter 11. Dispute Condition 13.5, Misrepresentation, applies to a card-absent transaction where merchandise or digital goods were purchased through a trial period, promotional period or introductory offer, or as a one-off purchase, and the cardholder was not clearly advised of further transactions after the purchase date. The merchant's defence is specified: proof that at the initial transaction the cardholder expressly agreed to future transactions, and proof that the merchant gave notice of them at least seven days before the transaction date. A merchant that cannot produce those two records has no answer to a 13.5, and its dispute ratio is the acquirer's ratio under VAMP.
What Mastercard Requires, and When a Recommendation Becomes a Rule
Mastercard's Transaction Processing Rules, in the 9 June 2026 edition, put the subscription standards in section 5.4.1 and the trial standards in 5.4.2. A subscription billing merchant must disclose the terms at the same time it asks for card credentials, including the price and the billing frequency; a merchant using a negative option model must also disclose the trial terms, and the rule supplies the sentence it wants: you will be billed USD 2.99 today for a 30-day trial, and once the trial ends you will be billed USD 19.99 each month thereafter until you cancel. An e-commerce merchant must display those terms clearly and prominently on the payment and order summary pages and capture the cardholder's affirmative acceptance before completing the order; a link to another page, a message box that has to be expanded, or terms below the fold do not satisfy it. A confirmation with the terms and cancellation instructions must follow the order, an online or electronic cancellation method must exist, and a subscription billed every six months or less often needs a reminder seven to thirty days before the charge. Utilities, telecommunications, insurance and existing debt are carved out.
The rule about receipts is the one to read twice. Sending a receipt with cancellation instructions after each approved authorisation is a recommendation until a recurring-payment merchant has been identified for four months or more in the same audit period of the Acquirer Chargeback Monitoring Program as an Excessive Chargeback Merchant, a High Excessive Chargeback Merchant or an Excessive Fraud Merchant. Then it is a requirement, and the acquirer of a merchant that has not implemented it may face Category A assessments for each month of non-compliance on top of the program's own.
Section 5.4.2 governs the trial. For digital goods and services with a trial longer than seven days, a reminder must go out no less than three and no more than seven days before it ends, with the basic terms and clear cancellation instructions. For physical products the merchant must obtain explicit consent to the start date, amount, payment date, descriptor and cancellation instructions after the trial and before the first full-price authorisation. Section 5.1.1 adds that a trial period begins on the date the cardholder receives the product, not the date it ships. The physical-goods variant is also a registered specialty merchant category, which is where the fee changes we covered in September land.
The FTC Has Applied ROSCA to the Processor Twice
ROSCA says any person who charges. On 16 June 2025 the Commission filed against Paddle.com Market Limited and its US subsidiary in the District of Columbia, and the stipulated order was signed four days later. Paddle is a merchant of record: it opens the merchant accounts in its own name, takes ownership of the charges and resells its clients' software. The complaint alleges it used that position to process for tech-support schemes, some impersonating Microsoft or McAfee; that it knew one client's chargeback rate had passed 7 percent against a 1 percent network threshold; and that it managed its aggregate ratio by using pre-chargeback alert services to refund disputes before they reached the networks rather than fixing the cause. Count IV is a ROSCA count against Paddle itself: as merchant of record it charged consumers for auto-renewing subscriptions without clear disclosure, express informed consent or a simple way to stop. The complaint quotes a board report that 50 to 60 percent of the company's fraud came from recurring payments.
The order is a $5 million judgment and a compliance program written for an aggregator. Paddle is banned from processing for tech-support merchants that telemarket or use security pop-ups, for anyone it knows or should know is on MATCH, and for anyone operating as a payment facilitator. It may not spread volume across merchant accounts or descriptors to avoid risk monitoring, use shell companies to obtain accounts, or reduce chargeback ratios through prevented-chargeback services without assessing the cause. Before boarding a client it must collect the business, its principals and majority owners, its websites, and any account terminations or law-enforcement actions in the prior ten years. A client above a 0.9 percent chargeback rate with more than 75 chargebacks in any two of six months triggers a defined investigation, test shopping included, and processing must stop within ninety days unless a written report shows by clear and convincing evidence that the offer is not deceptive. For any negative option feature it sells, the order restates the vacated rule: disclosures immediately adjacent to the consent, consent separate from the rest of the transaction and kept for three years, and cancellation at least as easy as sign-up and in the same medium.
The 2022 case points the other way. On 29 July 2022 the Commission settled with First American Payment Systems, a Texas processor, and two of its sales affiliates for $4.9 million in redress to merchants. The standard agreement carried a three-year term and a $495 cancellation fee, sales agents promised merchants they could cancel at any time without one, and the enrolment portal put the term, the fee and the renewal clause behind separate links. The complaint's theory is the one that matters here: the processing agreements renewed automatically for a further one-year term unless the merchant cancelled, which made them negative options under section 8403 of ROSCA, and the merchants were the consumers. Your own merchant agreement, if it auto-renews and was accepted in a web portal, is inside the same statute as your merchants' checkout pages.
What to Put in Place
- Underwrite the checkout, not the description of it. Capture the payment page and order summary at boarding and at each review: price and frequency next to the card fields, trial length and post-trial price in the Mastercard form of words, a click-to-accept control separate from the general terms, and nothing that needs a scroll or a click to reveal. One screenshot answers Visa, Mastercard and ROSCA at once.
- Ask for the notification calendar and a sent log: the confirmation after the order, the trial-ending notice seven days before the first charge on Visa and three to seven days before on Mastercard, the reminder seven to thirty days ahead of any charge billed at six-month intervals or longer, and a receipt after each approved authorisation. If the platform cannot show what it sent, treat the requirement as unmet.
- Make the dispute defence a boarding requirement. A 13.5 on a trial transaction is won with two records, the cardholder's express agreement to future transactions and the seven-day notice. Require both to be retrievable per cardholder, and keep consent for three years, the retention period in both the Paddle order and California's law.
- Hold the Paddle due-diligence file on every aggregated merchant: business description, principals and majority owners, websites, account terminations and law-enforcement actions in ten years, MATCH in five.
- Watch the ACMP month count on recurring merchants. Four months in one audit period turns the per-authorisation receipt into a requirement, with the assessment on the acquirer. Put the count next to the chargeback ratio in the merchant record.
- Read your own merchant agreement as a negative option. If it auto-renews, was accepted in a portal and carries a term or early-termination fee, First American says the disclosure, consent and cancellation standards apply to you as the seller. Put the term and the fee on the page where the merchant clicks.
The One-Line Version
A federal rule that would have given the subscription economy one disclosure, consent and click-to-cancel standard was thrown out on procedure in July 2025 and is back at the first step of rulemaking. It was never the standard that bound a merchant in practice: ROSCA has required the same three things since 2010 and just produced a $2.5 billion settlement, Visa and Mastercard write the checkout, the trial notice and the dispute defence into rules the acquirer answers for, California has had click-to-cancel since July 2025, and the FTC has shown twice that a payment company that charges the card, or auto-renews its own merchants, is inside the statute. Underwrite against those, and the eventual federal rule will be a formality.
Tags
About the author
Kyle Hall
Founder
Kyle Hall is a fintech entrepreneur, software engineer, and marketing strategist with over a decade of experience in high-risk payment processing and SaaS development. He is the CEO of PayKings, a leader in high-risk merchant services, and the founder of PulseCRM, a purpose-built CRM platform for the payments industry. Kyle specializes in building custom payment processing systems and growth strategies that empower merchant services providers to scale and succeed in the digital marketplace.