State auto-renewal laws that bind your WooCommerce store#

The FTC's click-to-cancel rule is the floor, not the ceiling. At least ten US states have their own auto-renewal statutes. California's amended ARL adds standalone consent, three-year consent records, and annual reminders. New York adds price-increase consent with a refund backstop. Minnesota bans unsolicited retention offers during cancellation entirely. If you sell into a state, its law binds your store, wherever you host. Here is the map.

Why the federal rule is not the whole job#

State auto-renewal laws apply based on where your customers live, not where your business is registered. They add obligations the federal rule never mentions - renewal reminder emails, standalone consent checkboxes, record retention, price-increase notices - and most are enforceable by state attorneys general and, in practice, by class-action firms working through state consumer protection acts.

The federal side is covered in the click-to-cancel explainer and the compliance pillar, so this post will not restate ROSCA or the FTC's requirements. Short version: federal law governs disclosure, consent, and a cancellation mechanism as simple as signup. The states below assume all of that and add more.

One status note, because it changes how much weight the federal floor can carry. The FTC's 2024 amended Negative Option Rule reached its compliance date on May 14, 2025 and was then vacated in its entirety by the Eighth Circuit on July 8, 2025, in Custom Communications, Inc. v. FTC, on the procedural ground that the Commission skipped a required preliminary regulatory analysis. The Commission has since signalled a fresh rulemaking. What did not change: ROSCA and Section 5 of the FTC Act are statutes, not rules, and they still require clear disclosure, express informed consent, and simple cancellation. The Amazon Prime settlement discussed in the UX patterns post was brought under ROSCA, not under the vacated rule. The practical effect of the vacatur is that the state laws below carry more of the compliance weight than they did in early 2025, not less.

One framing note before the list. State ARLs regulate three moments: signup (what you disclose and how consent is captured), renewal (whether you must remind the customer before charging again), and cancellation (what the exit has to look like). Every statute below is some combination of those three, with different term thresholds and notice windows. The table further down lines them up.

California: the strictest baseline#

If you comply with California, you are most of the way to complying everywhere - Minnesota's save-flow rule is the main exception. California's Automatic Renewal Law, Business and Professions Code sections 17600-17606, has been the de facto national standard since 2010, and AB 2863 tightened it again for contracts entered into, amended, or extended on or after July 1, 2025.

What the amended ARL requires beyond the federal rule:

• Standalone express consent. Consent must be to the automatic renewal terms specifically, not bundled into accepting your general terms of service. The statute also bans design that would "interfere with, detract from, contradict, or otherwise undermine" the customer's ability to consent - pre-checked boxes and buried checkboxes are out.
• Consent records for three years. You must retain proof of each customer's consent for three years or one year after the contract ends, whichever is longer. WooCommerce does not capture this by default; you have to log it.
• Free-to-pay conversions are explicitly in scope. A free trial that converts to a paid plan is now, by definition, an automatic renewal plan under the statute.
• Annual renewal reminders. Sent in the same medium the customer used to sign up, listing the product, the charge amount and frequency, and how to cancel.
• Save offers require a persistent exit. You may show discounts during cancellation only if a prominently located, continuously displayed "click to cancel" link or button sits alongside them. This is the provision most retention popups fail.
• Phone rules. If you take cancellations by phone, calls must be answered promptly during business hours, and a voicemail cancellation must be processed or returned within one business day.

The remedy structure is what makes California the state to plan around. Under section 17603, goods sent without compliant consent are deemed an "unconditional gift," which courts have read to support full restitution of amounts charged. Enforcement runs through the state's Unfair Competition Law, with civil penalties up to $2,500 per violation - and district attorneys and city attorneys can bring cases, not just the Attorney General.

New York: price increases are the new tripwire#

New York's General Business Law section 527-a was amended in the May 2025 state budget bill, effective November 5, 2025. The headline change: raising the price of an active subscription now has its own rules, per Perkins Coie's summary of the amendments.

The amended law requires:

• Clear and conspicuous disclosure of the material terms - price, charge frequency, cancellation deadline, cancellation method - before you request consent or billing information.
• Affirmative consent before the first charge.
• Renewal reminders 15 to 45 days before the cancellation deadline, for offers with an initial term of one year or longer.
• Advance notice of material changes, including price increases, 5 to 30 days before the change. You must then either obtain affirmative consent to the new price, or give the customer at least 14 days after the first charge at the new rate to cancel and receive a prorated refund.
• A cancellation mechanism as easy to use as signup, in the same medium the customer used to consent.

If your store has ever run a silent price increase on renewal - legal in most states when the original disclosure allowed it - the New York rules are aimed at exactly that. For New York customers you now need a notice-and-consent path or a notice-and-refund path.

Minnesota: the state that reaches into your save flow#

Minnesota is the only state that regulates the retention offer itself. Its automatic renewal law, Minnesota Statutes sections 325G.56 to 325G.62, effective January 1, 2025, prohibits presenting retention offers, gifts, or discounts during the cancellation process unless the customer first agrees to hear them. Ask permission, then pitch - never the reverse.

The FTC considered the same requirement and dropped it from the 2024 final rule, deferring it to a future rulemaking. California and Colorado went the other way: offers are fine as long as a direct cancel link stays visible. Minnesota is stricter than all of them, and it is the reason a careful save flow needs either a permission step or Minnesota-awareness.

Minnesota also requires prompt processing once the customer clicks cancel, plus an annual written reminder with the service terms and termination instructions.

The rest of the map#

Eight more jurisdictions have statutes worth knowing, and most converge on one requirement: a written reminder 30 to 60 days before a long-term contract renews. Here is the table.

Sources: the statute texts linked above plus Vermont's 9 V.S.A. 2454a, Illinois's 815 ILCS 601, Florida's 501.165, D.C. Code 28A-203, Oregon's ORS 646A.295, and Kelley Drye's 2025 auto-renewal roundup.

Three notes on the table. Vermont's double opt-in means the renewal clause itself needs a distinct affirmative action - its own checkbox, in bold-face disclosure, not just checkout consent - for contracts with an initial term of a year or more. Illinois and Florida exempt pure B2B sales; Colorado's new law pointedly does not, which matters if your subscribers are businesses. Delaware currently has no auto-renewal statute at all.

This table has a shelf life. Per Kelley Drye's roundup, Arkansas, Connecticut, and Maryland all passed or updated auto-renewal laws in 2025, and more state bills are pending. Treat the table as a snapshot from August 2026, not a permanent reference.

Who actually enforces this#

Three groups, and only one of them is the FTC. State attorneys general enforce their own statutes directly, and California's ARL is also enforceable by district attorneys, county counsel, and city attorneys - Santa Monica and Los Angeles prosecutors have historically been among the most active auto-renewal enforcers in the country, and they do not limit themselves to California-headquartered companies.

The second group is private plaintiffs. California's unconditional-gift remedy gives class-action firms a clean restitution theory: if consent was defective, everything charged afterward is recoverable. Vermont's statute has generated its own line of private suits since taking effect, per the Vermont bar commentary on 2454a litigation trends. The pattern in these cases is consistent - the complaint is rarely about a store refusing to cancel anyone; it is about a checkout page where the renewal disclosure was not conspicuous enough or the consent was bundled. Signup defects, not cancellation defects, drive most of the private litigation.

The third group is payment processors, which is the enforcement channel nobody plans for. Card networks fold auto-renewal disclosure and cancellation-ease requirements into their merchant rules, and a spike in "I did not know I was subscribed" chargebacks triggers processor review faster than any regulator moves. A store that ignores the state-law hygiene below usually meets its processor's risk team before it meets an AG.

For a small WooCommerce store, the realistic exposure ranking is: chargeback pressure first, a class-action demand letter second, an AG inquiry third. All three get cheaper to prevent than to answer.

The comply-once checklist#

You do not need eleven different flows. One configuration that satisfies the strictest state in each dimension covers the whole table:

1. Consent: a standalone, unchecked checkbox for the renewal terms at checkout, with price, frequency, and cancellation method in visual proximity. Covers California, Vermont, Oregon, and New York.
2. Records: log who consented, to what text, and when. Keep it at least three years. Covers California.
3. Annual reminder: one email per year to every active subscriber with the terms and a cancel link. Covers California, D.C., and Minnesota.
4. Pre-renewal notice at 30 to 45 days before any annual renewal. That window sits inside every state's requirement: 30-60 days for Vermont, Illinois, Florida, Utah, and D.C., and 15-45 days for New York. One email satisfies all of them.
5. Price changes: notice 5 to 30 days ahead, then either capture consent or honor a 14-day cancel-with-prorated-refund. Covers New York, and pairs naturally with Massachusetts's pre-charge notice.
6. Cancellation: online, same medium as signup, one-step link, processed promptly. Covers the federal rule, California, Colorado, Minnesota, and New York.
7. Save offers: keep a continuously visible cancel link next to any offer, and add a permission step before showing offers - either geo-scoped to Minnesota or applied globally. Globally is simpler to maintain and simpler to defend.

WooCommerce Subscriptions handles none of items 1 through 5 natively. That is not a knock on it - it is billing software, not compliance software - but it means consent logging and the two reminder emails live in your theme, a snippet, or a plugin. Budget for them as real work, not configuration.

This post is a compliance map, not legal advice, so have counsel review your specific flow before relying on it.

What's next#

• The click-to-cancel pillar for the federal rule-by-rule breakdown that these state laws build on.
• The 10-minute federal audit if you have not run it yet - state compliance layered on a non-compliant federal flow is building on sand.
• Cancel-flow UX patterns for what these rules mean screen by screen, pattern by pattern.