Free trials, freemium and cancellation rules under consumer-protection law

The core US law: ROSCA

The Restore Online Shoppers' Confidence Act (ROSCA), enacted in 2010 and enforced by the FTC, governs negative option billing, meaning any offer that converts to a paid, recurring charge unless the customer acts to stop it (trial-to-paid conversions, auto-renewing annual plans).

ROSCA requires three things before charging a customer:

1. Clear disclosure of the terms before billing information is collected (price, that it will recur, how to cancel).

2. Express informed consent, not a pre-checked box.

3. A simple cancellation mechanism, at least as easy as the sign-up mechanism.

That third point is what the FTC's 2024 "click-to-cancel" rule (part of its broader negative option rulemaking) tried to codify: if you can subscribe online in two clicks, you must be able to cancel online in a comparable number of clicks, no forced phone calls, no "chat with retention agent" mazes. The rule was finalized in 2024 but faced legal challenges in 2025 over FTC procedure; SaaS companies should treat "cancel as easy as sign-up" as the direction of travel regardless of the rule's exact litigation status, because state laws and FTC case-by-case enforcement under existing ROSCA authority already push the same way.

Practical SaaS example: a project-management tool offering "14 days free, then $29/month" must show that price and renewal term on the same screen where the user enters card details, not buried in a linked terms page.

State-level layers: California and beyond

California's Automatic Renewal Law (ARL), amended in 2018 and again with stronger rules effective in 2025, adds requirements on top of ROSCA:

• Clear and conspicuous disclosure of the recurring nature of the charge and cancellation instructions.
• For free trials specifically, sending a reminder notice before the trial converts to paid, especially for trials longer than 30 days.
• Honoring cancellation requests through the same method used to sign up (online sign-up requires online cancellation, no exceptions).

Other states (New York, Illinois, Vermont) have similar automatic-renewal statutes. For a SaaS company selling nationally, the practical approach is to build to the strictest applicable state standard rather than maintain 50 different flows.

The EU equivalent: Consumer Rights Directive and beyond

In the EU, the Consumer Rights Directive (CRD, 2011/83/EU) requires traders to give consumers clear pre-contractual information, including total price, contract duration and renewal terms, before the consumer is bound. Article 8(2) specifically requires an explicit acknowledgment that the order implies an obligation to pay, commonly implemented as a labeled "Order with obligation to pay" button.

Layered on top:

• The Digital Content and Digital Services Directive (2019/770) governs how SaaS/software-as-a-service contracts must handle conformity, updates and termination rights.
• The Unfair Commercial Practices Directive, updated by the Omnibus Directive (2019/2161), explicitly targets dark patterns like fake urgency countdowns and drip pricing (advertising a low headline price while adding mandatory fees later).
• National regulators enforce actively: Italy's competition authority (AGCM) and Germany's consumer bodies have fined SaaS and subscription companies over unclear cancellation paths in recent years.

The EU's default consumer right to a 14-day withdrawal period on digital contracts also matters for SaaS: if you let a consumer start using the paid service immediately, you generally need their explicit consent to waive the withdrawal right, and to acknowledge they'll lose it once the service begins. Skip that consent screen and the customer may be entitled to a full refund even after using the product.

What a compliant trial-to-paid flow actually looks like

A defensible flow, US and EU combined, typically includes:

1. Price and billing frequency shown on the same page where payment info is collected.

2. No pre-ticked add-ons, seats, or upsells.

3. A confirmation email at trial start, plus a reminder before conversion (especially required in California and increasingly expected as best practice everywhere).

4. A cancel button reachable from account settings, not routed exclusively through a retention chat, phone line, or "email support" step.

5. Cancellation taking effect without requiring a reason or a completed exit survey as a blocking step.

For a useful practitioner reference, the FTC's own guidance is a good primary source: FTC Negative Option Rule materials.

Pre-launch marketing compliance checklist

Before any new trial or freemium campaign ships, marketing and legal should jointly verify:

• Ad claims match the actual offer. If ads say "free forever," the freemium tier can't quietly convert to paid without consent.
• Landing pages disclose auto-renewal terms above the payment field, not in footer links only.
• Email and in-app renewal reminders are scheduled, particularly for annual plans and trials over 30 days.
• Cancellation flow is tested by someone outside the retention team, ideally a person unfamiliar with the product, to catch friction.
• Regional variants exist where required: EU checkout needs the "obligation to pay" button and withdrawal-right consent; California checkout needs the ARL-compliant renewal disclosure.

Enforcement signals to watch in 2026

Expect continued FTC activity even amid legal wrangling over the click-to-cancel rule's exact text, because ROSCA itself (not just the 2024 rule) already gives the FTC authority to act against deceptive negative-option practices. Adobe faced FTC litigation in 2024 over alleged hidden early-termination fees on annual subscriptions marketed as monthly, a useful cautionary example for any SaaS company with multi-month commitment plans disguised as short-term pricing.

In the EU, the European Commission's ongoing sweeps of subscription-based websites (coordinated through the Consumer Protection Cooperation network) periodically target streaming, software and app subscriptions specifically for cancellation friction. SaaS marketers selling into Europe should assume their checkout flow could be sampled.

🎬 [VIDEO: "How the FTC's Click-to-Cancel Rule Could Change Subscriptions" - youtube.com - search for coverage from a reputable business or legal news channel explaining the rule's requirements and current legal status]

Key Takeaways

• ROSCA (US) and the Consumer Rights Directive plus Omnibus Directive (EU) both require clear disclosure, affirmative consent, and easy cancellation before and during any subscription relationship.
• The core enforcement principle, in both regions, is symmetry: cancellation friction should not exceed sign-up friction. The Amazon Prime settlement ($2.5 billion, 2025) is the highest-profile cautionary case.
• State laws (notably California's ARL) and EU national regulators add specific requirements, like reminder notices before trial conversion, that exceed federal or EU baseline law.
• Marketing teams should treat trial and billing flow as a compliance artifact, not just a conversion-optimization surface: every dark pattern that lifts short-term conversion is a candidate for regulatory review.
• Build pre-launch checks into the campaign process, not just legal review at the end, since ad claims, landing pages and checkout UX must all match the same disclosed terms.