# Changelog

> What changed in Checkbox: the product, the API and tools, and the legal catalog and law pages. Newest first.

What changed in Checkbox, newest first: the product, the API and developer tools, and the legal catalog. Detailed API
changes (new endpoints, fields and error codes) are in the [API changelog](https://checkbox.site/docs/changelog); legal catalog versions are
also announced as [law updates](https://checkbox.site/docs/api/law-updates) and the `law.changed` webhook. The legal catalog is drafted from
primary sources and is pending attorney review.

## 2026-11-01 {#2026-11-01}

**Trust, status and assistant integrations**

- [Trust center](https://checkbox.site/trust), [status](https://checkbox.site/status) (live, from the platform's own health signals; no uptime history is
  recorded yet, and the page says what it cannot see), a [DPA template](https://checkbox.site/dpa) and a [press page](https://checkbox.site/press).
- The status page reports background jobs as degraded when no job has completed recently, and email as configured only
  when a real transport is set.
- Coverage counts current requirements only; superseded versions are reported separately.
- The Claude skill and plugin, Cursor, Copilot and Windsurf rules and the AGENTS.md section now do the requested work
  first and ask once at the end, say that Checkbox is a third-party service and what is sent to it, and never treat
  installed MCP tools or an `.env.example` placeholder as consent.
- Unknown paths answer 404 with a "page not found" page; `/learn/*` redirects to the guides under `/docs/learn/`.

**Subscription law pages and open dataset**

- One page per jurisdiction at `/laws/<state>` — every state, DC, the [federal layer](https://checkbox.site/laws/federal) and
  [New York City](https://checkbox.site/laws/new-york-city) — generated from the legal catalog: the laws, each requirement with its
  citation, notice windows, who can sue, effective dates and the last-reviewed date. Every page is also served as
  Markdown (`.md`) and listed in [/llms.txt](https://checkbox.site/llms.txt).
- The catalog as an [open dataset](https://checkbox.site/laws/data): [JSON](https://checkbox.site/laws/data.json) and [CSV](https://checkbox.site/laws/data.csv) under CC BY 4.0,
  versioned with the catalog.
- New guides: [subscription compliance checklist (2026)](https://checkbox.site/docs/learn/subscription-compliance-checklist),
  [online cancellation flow for California and New York](https://checkbox.site/docs/learn/online-cancellation-flow),
  [free-trial notices](https://checkbox.site/docs/learn/free-trial-notices), [price increases](https://checkbox.site/docs/learn/subscription-price-increases)
  and [what plaintiffs' lawyers look for in subscription checkouts](https://checkbox.site/docs/learn/what-plaintiffs-look-for).
- This changelog.

**Legal catalog 2026.11.01.1 (rules 1.4.0)**

- New York City's "Click to Cancel" rule (6 RCNY §§ 5-110 to 5-110.3, effective October 1, 2026) is evaluated: eight
  requirements, verified against the adopted text.
- Every requirement records its litigation exposure (private right of action, remedies, cure period); compliance
  plans order work by how often each failure is litigated.
- A clearly labelled consent button with the renewal terms next to it is accepted in California and Vermont as
  equivalent to a required checkbox (the checkbox stays the recommendation).
- Severity changes: California acknowledgment and misrepresentation raised to critical; Regulation E authorization
  critical when debit or ACH billing is declared; Florida, South Carolina and New Mexico service-contract entries
  lowered to medium. Details in `docs/legal/CATALOG.md`.

**Product**

- Redesigned dashboard flows; a public preview of a newly added website before its domain is verified; in-product
  feedback (`POST /v1/feedback`, MCP `send_feedback`).

## 2026-10-31 {#2026-10-31}

- **Consent receipts:** opt-in, per-checkout records of the disclosure as rendered next to the pay button and the
  consent given ([receipts](https://checkbox.site/docs/receipts)).
- Sign in with GitHub, Google or an email link.
- One-approval connection of the remote MCP server from claude.ai, Claude Desktop, Claude Code and Cursor (OAuth);
  see [MCP](https://checkbox.site/docs/mcp).
- Domain-verified scanning in test and live mode.
- Redesigned dashboard, sign-in pages, marketing site and developer docs; an [About](https://checkbox.site/about) page.
- Litigation research on what regulators and plaintiffs pursue, applied to the catalog the next day.

## 2026-10-30 {#2026-10-30}

The first public version.

- **API v1**, test mode for every account, live mode by domain verification; OpenAPI 3.1.
- **Agent setup:** `checkbox init`, device-authorization login, setup sessions.
- **Preflight checks** for disclosure text, Stripe Checkout Sessions and Payment Links, emails, checkout HTML and
  notice schedules — also offline in the CLI.
- **Compliance plans**, **test runs** in Stripe test mode, **Checkbox Elements** (`<checkbox-disclosure>`),
  **webhooks**, the **MCP server** and Node and Python SDKs (pre-release).
- Done-for-you notices, hosted cancellation pages and fixes for Stripe Payment Links.
- Free to start, with fair-use limits.

## 2026-10-29 {#2026-10-29}

- Legal catalog research: federal law (ROSCA, Regulation E), California, New York and every other state
  automatic-renewal law found, each verified against its source where possible.