# ROSCA explained > The Restore Online Shoppers' Confidence Act (15 U.S.C. §§ 8401–8405) in plain English — the three things every online subscription must do, who enforces it, how Regulation E adds to it for debit and ACH billing, and where the FTC's click-to-cancel rule stands. The **Restore Online Shoppers' Confidence Act** (ROSCA), 15 U.S.C. §§ 8401–8405, is the federal law for subscriptions sold online. It has been in force since December 29, 2010, and applies to any internet sale with a **negative option feature**: a term under which the customer's silence or failure to cancel is taken as acceptance — free-to-paid trial conversions, automatic renewals and continuity plans. Every Checkbox evaluation includes it (jurisdiction `US-FED`). ## The three requirements {#requirements} Section 8403 makes it unlawful to charge for goods or services sold online through a negative option feature unless the seller does three things. ### 1. Disclose all material terms before taking billing information {#disclose} **15 U.S.C. § 8403(1).** Before the customer enters payment details, the seller must clearly and conspicuously disclose all material terms: that the customer will be charged on a recurring basis until they cancel, the amount and how often, any free-trial length and what is charged after it, and how to cancel. "Clearly and conspicuously" means the terms are hard to miss — not buried in a link, a footer or small grey text. Checkbox checks: `signup.disclosure.autorenew_language`, `signup.disclosure.price`, `signup.disclosure.frequency`, `signup.disclosure.cancellation_policy`, `signup.disclosure.trial_terms`, `signup.disclosure.term_length`, `signup.disclosure.proximity`, `signup.disclosure.conspicuous`. ### 2. Get express informed consent before charging {#consent} **15 U.S.C. § 8403(2).** The seller must obtain the customer's express informed consent before charging their card, bank account or other financial account. In practice: an unchecked checkbox the customer ticks, labelled with the renewal terms, next to the disclosure — not a pre-checked box and not consent hidden in general terms of service. Checkbox checks: `signup.consent.affirmative`, `signup.consent.not_prechecked`. ### 3. Provide a simple way to stop recurring charges {#cancel} **15 U.S.C. § 8403(3).** The seller must provide simple mechanisms for the customer to stop recurring charges. Most state laws spell out what "simple" means for online sign-ups — cancel online, in the same medium, without calls or chats — and the FTC has treated hard-to-find or obstructed cancellation as a ROSCA violation. Checkbox checks: `cancel.online_available`, `cancel.mechanism_findable`, `cancel.flow_friction`, `cancel.confirmation`, `config.portal_cancel_enabled`; and, against your Terms of Service, `terms.cancellation_policy_consistent` (terms that say a subscription cannot be cancelled, or only by phone or mail, contradict § 8403(3)). ## Who enforces it {#enforcement} The Federal Trade Commission enforces ROSCA, and a violation is treated as a violation of an FTC rule under the FTC Act — which makes civil penalties and consumer redress available. State attorneys general can also bring actions. Private plaintiffs usually sue under state automatic-renewal and consumer-protection laws instead; see [state automatic-renewal laws](https://checkbox.site/docs/learn/state-automatic-renewal-laws). ## Debit cards and ACH: Regulation E {#regulation-e} When a subscription is billed to a **debit card, prepaid card or bank account (ACH)** — not a credit card — the Electronic Fund Transfer Act and Regulation E add two obligations: - **15 U.S.C. § 1693e(a); 12 C.F.R. § 1005.10(b):** recurring debits must be authorized in a writing signed or similarly authenticated by the consumer, and the consumer gets a copy. An acknowledgment email with the authorized terms serves as the copy. - **15 U.S.C. § 1693e(b); 12 C.F.R. § 1005.10(d):** when a recurring debit will vary in amount (for example after a price increase), notify the consumer of the amount and date at least 10 days before the transfer. Checkbox applies these when the site's payment methods include debit or ACH (`facts.payment_methods`). ## The FTC's click-to-cancel rule {#click-to-cancel} **FTC Negative Option Rule ("Use of Prenotification Negative Option Plans")** — 16 C.F.R. Part 425. Effective 2026-02-12. Status: not cataloged. Source: NOT CATALOGED. The 2024 click-to-cancel amendments (89 FR 90476) were vacated by the Eighth Circuit on July 8, 2025 (Custom Commc'ns, Inc. v. FTC, 142 F.4th 1060) and never took effect. The FTC restored the 1973 prenotification-plan rule effective Feb. 12, 2026 (91 FR 6507); it applies only to prenotification negative option plans (periodic announcements of selections), not ordinary subscriptions. An ANPRM was published Mar. 13, 2026 (91 FR 12318; comments closed Apr. 13, 2026); no proposed or final rule as of 2026-10-29. Re-check the Federal Register before relying on this. - Amendment: 89 FR 90476 (Nov. 15, 2024) — "Rule Concerning Recurring Subscriptions and Other Negative Option Programs", effective 2025-01-14: Click-to-cancel amendments; compliance date for most provisions was July 14, 2025. Vacated July 8, 2025 before taking effect. - Amendment: 91 FR 6507 (Feb. 12, 2026), effective 2026-02-12: Conforming final rule recodifying the pre-2024 prenotification rule after the vacatur. - Amendment: 91 FR 12318 (Mar. 13, 2026), RIN 3084-AB54, effective 2026-03-13: Advance notice of proposed rulemaking (no rule text; no legal effect). In short: there is no federal click-to-cancel rule in force, so ROSCA plus the state laws are what apply. Checkbox re-checks the Federal Register as part of its law updates and will add requirements if a new rule is adopted. ## Requirements in the catalog {#catalog} | Requirement | Citation | Applies when | Timing | Severity | Checkbox checks | |---|---|---|---|---|---| | **Clearly and conspicuously disclose all material terms before obtaining billing information** Before collecting the consumer's billing information, the seller must provide text that clearly and conspicuously discloses all material terms of the transaction: that the consumer will be charged on a recurring basis until they cancel, the amount and frequency of the charges, any free-trial length and the charge after it, and how to cancel. | 15 U.S.C. § 8403(1) | always | — | critical | `signup.disclosure.autorenew_language`, `signup.disclosure.price`, `signup.disclosure.frequency`, `signup.disclosure.cancellation_policy`, `signup.disclosure.trial_terms`, `signup.disclosure.term_length`, `signup.disclosure.proximity`, `signup.disclosure.conspicuous` | | **Obtain express informed consent before charging** The seller must obtain the consumer's express informed consent before charging the consumer's credit card, debit card, bank account or other financial account for the negative-option product or service. | 15 U.S.C. § 8403(2) | always | — | critical | `signup.consent.affirmative`, `signup.consent.not_prechecked` | | **Provide simple mechanisms to stop recurring charges** The seller must provide simple mechanisms for the consumer to stop recurring charges from being placed on their credit card, debit card, bank account or other financial account. | 15 U.S.C. § 8403(3) | always | — | critical | `cancel.online_available`, `cancel.mechanism_findable`, `cancel.flow_friction`, `cancel.confirmation`, `config.portal_cancel_enabled` | | **Written authorization for recurring debits from a consumer bank/debit account, with a copy to the consumer** Preauthorized (recurring) electronic fund transfers from a consumer's account — e.g. a subscription billed to a debit card, prepaid card or bank account (ACH) — may be authorized only by a writing signed or similarly authenticated by the consumer, and the merchant that obtains the authorization must give the consumer a copy of it. | 15 U.S.C. § 1693e(a); 12 C.F.R. § 1005.10(b) (Regulation E) | paid by debit / ach | — | high | `signup.consent.affirmative`, `confirmation.email.sent`, `confirmation.email.terms` | | **Advance notice when a recurring debit will change in amount** When a preauthorized debit from a consumer's account will vary in amount from the previous transfer or from the authorized amount (e.g. a subscription price increase billed to a debit card or by ACH), the payee must send written notice of the amount and date of the transfer at least 10 days before the scheduled transfer date. | 15 U.S.C. § 1693e(b); 12 C.F.R. § 1005.10(d) (Regulation E) | paid by debit / ach | at least 10 days before the charge | medium | `reminder.price_change` | | **Terms must not deny the simple mechanism to stop recurring charges** ROSCA requires simple mechanisms for consumers to stop recurring charges. Terms of service or policies that say a subscription cannot be canceled, or that it can only be canceled by phone, mail or in writing, contradict that mechanism and mislead subscribers about how to stop the charges. | 15 U.S.C. § 8403(3) | always | — | high | `terms.cancellation_policy_consistent` | | **Refund and cancellation terms must match what the offer promises** All material terms of a negative-option offer must be disclosed clearly before billing information is collected. A refund or money-back promise made in marketing or at checkout that the written refund policy takes back ("no refunds", a shorter window) is a misrepresented material term. | 15 U.S.C. § 8403(1); 15 U.S.C. § 45(a) (FTC Act § 5) | always | — | medium | `terms.refund_policy_consistent` | ## Check your checkout against ROSCA {#check} ```bash checkbox check disclosure --text "Start your free trial today!" --price 19.99 --interval month \ --trial-days 7 --jurisdictions US-FED --offline ``` Or let your agent do it: [Build with AI](https://checkbox.site/docs/build-with-ai). > **Not legal advice** > > This page summarizes the statute for engineers; it is not legal advice. The requirements above are drafted from the > statutory text and are pending attorney review.