Free trials, freemium and cancellation rules under consumer-protection law

Amazon settled the FTC's Prime case in September 2025 for $2.5 billion: a $1 billion civil penalty plus $1.5 billion in refunds to affected subscribers. The complaint's central allegation was about clicks. Two to subscribe. Four pages and six clicks to cancel, through a flow Amazon staff had internally nicknamed "Iliad". Nobody had to prove a false advertising claim. The friction itself was the violation.

That is the subject of this lesson: the money-and-consent side of SaaS marketing. What you disclose before you take a card, what counts as agreement, and how hard you are allowed to make it to leave.

Why regulators care about trials and freemium

SaaS growth relies on low-friction entry: free trials, freemium tiers, "$1 for 30 days". The business logic holds. Regulators look at a narrower thing, which is friction that runs one way only: easy to start paying, hard to stop.

That asymmetry is the classic dark pattern, a design choice that pushes people into decisions they would not otherwise make. The cancel link buried three levels into account settings. The pre-ticked seat upgrade. The double negative on a consent checkbox.

One distinction decides whether any of this touches your product. Negative option rules bite when there is a stored payment credential plus an automatic conversion. A freemium tier with no card on file and no scheduled charge sits largely outside them. A "free" trial that requires a card and converts on day 15 is negative option billing, whatever the landing pagelanding pageA standalone web page built for a single campaign goal, designed to maximise conversions by removing distractions and focusing visitors on one action.View full definition → calls it. Growth teams often have this backwards, treating the word "free" as the safe part and the card requirement as a harmless conversion lever.

The core US law: ROSCA

The Restore Online Shoppers' Confidence Act (ROSCA), enacted in 2010 and enforced by the FTC, governs negative option billing: any offer that converts to a recurring charge unless the customer acts to stop it.

ROSCA requires three things before you charge:

1. Clear disclosure of the terms before billing information is collected (price, that it recurs, how to cancel).
2. Express informed consent, not a pre-checked box.
3. A simple cancellation mechanism, at least as easy as the sign-up mechanism.

The FTC's 2024 negative option rule, widely called "click-to-cancel", tried to codify that third point. It was finalised in October 2024, most provisions took effect in May 2025, and the Eighth Circuit vacated it on procedural grounds in July 2025 (the FTC had skipped a required preliminary regulatory analysis). The rule is gone; the exposure is not. ROSCA itself, Section 5 deception authority and a stack of state statutes all push the same way, and the Amazon settlement was reached under existing law with no new rule needed.

State layers and the promotional-price cliff

California's Automatic Renewal Law, amended again with effect from 2025, adds requirements on top of ROSCA: conspicuous disclosure of the recurring charge and of how to cancel, a reminder before a trial converts, and cancellation through the same channel used to sign up. New York, Illinois, Vermont and others run comparable statutes. Selling nationally, you build to the strictest applicable standard rather than maintain fifty flows.

Consumer antivirus shows the edge case that catches SaaS pricing teams. McAfee, like most of the category, sells a heavily discounted first year and renews at list, so an introductory price under $50 can become roughly double that twelve months later on a card the customer has forgotten. The renewal is not deceptive in itself. The failure mode is disclosing the promotional expiry once, in the order confirmation, then letting list price land with no pre-renewal notice. Any promotional period that ends in a price step-up should be treated as a second disclosure obligation, not a pricing detail.

The other boundary question is who counts as a consumer. ROSCA and the state ARLs protect individuals buying for personal or household purposes; the EU definition is a natural person acting outside their trade. A self-serve checkout cannot reliably tell a freelance designer buying on a personal card from a procurement team. If your product-led motion accepts consumer cards, assume consumer law applies to the whole flow, because you will not win that argument case by case.

The EU equivalent: Consumer Rights Directive and beyond

The Consumer Rights Directive (CRD, 2011/83/EU) requires clear pre-contractual information, including total price, contract duration and renewal terms, before the consumer is bound. Article 8(2) requires explicit acknowledgment that the order carries an obligation to pay, usually implemented as a button labelled accordingly.

Layered on top:

• The Digital Content and Digital Services Directive (2019/770) covers conformity, updates and termination rights for software delivered as a service.
• The Unfair Commercial Practices Directive, updated by the Omnibus Directive (2019/2161), targets fake urgency countdowns and drip pricing.
• National regulators enforce independently. Italy's AGCM and German consumer associations have both pursued subscription businesses over unclear cancellation paths.

The default 14-day withdrawal right on digital contracts matters more than most teams expect. If a consumer starts using a paid service immediately, you need their explicit consent to waive that right plus their acknowledgment that they lose it once delivery begins. Miss that screen and a customer who used the product for ten days can still be entitled to a full refund.

What a compliant trial-to-paid flow actually looks like

1. Price and billing frequency on the same page as the payment field, not behind a terms link.
2. No pre-ticked add-ons, seats or upsells.
3. Confirmation at trial start, plus a reminder before conversion.
4. A cancel action reachable from account settings, not routed only through retention chat, a phone line or an email request.
5. Cancellation that completes without a mandatory reason field or exit survey standing in the way.

Retention offers are not banned. The test is position: a discount shown after the customer has confirmed cancellation is a save attempt, while a discount that sits between them and the cancel button is friction, and that is exactly what the FTC counted in the Prime flow.

Two rulebooks operate even where statute is quiet. Visa and Mastercard both impose their own trial-to-paid notification and billing-descriptor requirements on merchants. Ignore them and the cost arrives as disputes rather than fines: Visa's dispute monitoring program starts applying pressure at roughly 100 disputes a month and a dispute rate near 1%, and a payment processor that puts you into remediation is a more immediate problem than a regulator who takes three years.

Pre-launch marketing compliance checklist

Within the sign-off sequence the pre-launch lesson sets out, these are the billing-specific items nobody else will catch:

• Ad copy matches the offer mechanics. "Free forever" cannot describe a tier that converts.
• Auto-renewal terms appear above the payment field, and the promotional-expiry date is in the confirmation email and the reminder.
• Renewal reminders are scheduled in the billing system, not held as a manual task.
• The cancellation flow is walked end to end by someone outside the retention team, on mobile web as well as desktop.
• Regional variants exist and are protected from experimentation. A common failure: a growth team runs a checkout A/B testA/B testA/B testing is a controlled experiment that compares two versions of something (A and B) by splitting traffic randomly to learn which performs better on a chosen metric.View full definition → with global traffic allocation, and the winning US variant quietly overwrites the EU flow carrying the obligation-to-pay button.

The FTC's own materials are worth reading directly: FTC Negative Option Rule materials.

Enforcement signals to watch in 2026

Adobe has been in FTC litigation since June 2024 over its annual-paid-monthly plan, where the complaint alleges the early termination fee was disclosed only through small print and hover text while the plan was marketed at a monthly price. The pattern generalises: any commitment term dressed as short-term pricing is exposed, and the fee that finance treats as a retention mechanism is the thing an enforcer treats as the harm.

In the EU, the Commission's coordinated sweeps through the Consumer Protection Cooperation network periodically sample subscription checkouts across streaming, software and apps, with cancellation friction a recurring target. Assume your flow can be sampled without notice.

🎬 [VIDEO: "How the FTC's Click-to-Cancel Rule Could Change Subscriptions" - youtube.com - search for coverage from a reputable business or legal news channel explaining the rule's requirements and current legal status]

Key takeaways

• ROSCA in the US, the CRD plus Omnibus Directive in the EU: clear disclosure before the card field, affirmative consent, cancellation no harder than sign-up.
• The trigger is a stored card plus automatic conversion. Card-free freemium mostly sits outside these rules; a card-gated "free" trial does not.
• State law goes further than federal, and the promotional-price step-up is the most commonly missed disclosure event.
• Vacating the click-to-cancel rule in July 2025 changed the paperwork, not the risk. Amazon's $2.5 billion settlement was reached under law that already existed.
• Cancellation friction shows up in chargeback ratios and card-network monitoring long before it shows up in a complaint, which makes payments data an early warning signal marketing should be reading.