ROSCA and Negative-Option (Subscription) Billing, Explained

The Restore Online Shoppers' Confidence Act, commonly abbreviated ROSCA, is a federal consumer-protection law. Congress passed it as Public Law 111-345, and it was signed into law on December 29, 2010. It is codified in the United States Code at 15 U.S.C. sections 8401 through 8405.

Congress enacted ROSCA after investigating online sales tactics that it found had harmed consumers, including 'data pass' arrangements and negative-option offers that resulted in recurring charges people did not knowingly agree to. In the statute's findings, Congress described aggressive sales practices that took advantage of consumers who had already entered their billing information for an unrelated purchase.

In plain terms, a 'negative option' is any offer in which a seller treats a consumer's silence or failure to cancel as acceptance of, or agreement to be charged for, goods or services. Automatically renewing subscriptions, free-to-pay conversions, and continuity plans are common examples. ROSCA sets baseline rules that apply to these arrangements when the transaction is conducted over the Internet.

The central operative provision is 15 U.S.C. 8403. It makes it unlawful for any person to charge a consumer for goods or services sold online through a negative-option feature unless the seller satisfies three conditions.

First, the seller must provide text that 'clearly and conspicuously discloses all material terms of the transaction before obtaining the consumer's billing information.' Material terms typically include the fact that charges recur, the amount and frequency, and how to cancel. Second, the seller must obtain 'a consumer's express informed consent before charging' the consumer's credit card, debit card, bank account, or other financial account. Third, the seller must provide 'simple mechanisms for a consumer to stop recurring charges.'

The 'express informed consent' element is a deliberate one. FTC guidance and enforcement have treated consent as something the consumer must affirmatively give; it is generally not established by pre-checked boxes, buried terms, or a consumer's mere silence. The 'simple mechanism' element is why cancellation practices receive close scrutiny: a sign-up process that takes seconds but a cancellation path that is long or obstructed can draw enforcement attention under this provision.

A separate provision, 15 U.S.C. 8402, targets the 'data pass' abuse that motivated the law. It prohibits an initial merchant from disclosing a consumer's credit card, debit card, bank account, or other financial account number to a post-transaction third-party seller so that the third party can charge the consumer.

That section also restricts post-transaction third-party sellers, who solicit a consumer immediately after an initial purchase with a different merchant. Before charging, such a seller must clearly and conspicuously disclose all material terms, including that it is not affiliated with the initial merchant and the cost involved, and must obtain the consumer's express informed consent. Consent under this section requires the consumer to provide the full account number plus name and address, together with an affirmative action such as clicking a confirmation button.

Under 15 U.S.C. 8404, a violation of ROSCA is treated as a violation of a rule under section 18 of the Federal Trade Commission Act defining an unfair or deceptive act or practice. That framing lets the FTC use its full FTC Act enforcement powers, including seeking civil penalties and consumer redress. A separate provision, 15 U.S.C. 8405, authorizes state attorneys general to bring civil actions on behalf of a state's residents.

Because ROSCA violations are treated as rule violations, they can carry per-violation civil penalties. The FTC's inflation-adjusted maximum was set at $53,088 per violation for 2025, and the FTC announced no inflation adjustment for 2026, so that figure carried forward. Actual penalties in any case depend on the facts, the conduct, and any settlement.

The scale of exposure is illustrated by the FTC's action against Amazon over Prime enrollment and cancellation. In September 2025 the FTC announced a $2.5 billion settlement, which the agency described as including a $1 billion civil penalty for ROSCA-related conduct and $1.5 billion in refunds to affected consumers. The FTC alleged Amazon used design tactics that enrolled people without clear consent and made cancellation difficult.

ROSCA the statute should not be confused with the FTC's separate Negative Option Rule. In 2024 the FTC finalized an amended Negative Option Rule, widely called the 'Click-to-Cancel' rule, which would have added detailed, industry-wide requirements such as making cancellation at least as easy as sign-up.

On July 8, 2025, the U.S. Court of Appeals for the Eighth Circuit vacated that amended rule in its entirety in Custom Communications, Inc. v. FTC, No. 24-3137. The court did not rule on the merits of the substantive requirements; it held that the FTC committed a procedural error by failing to issue a required preliminary regulatory analysis for a rule with an estimated annual economic impact of $100 million or more.

Critically, the vacatur addressed the regulation, not the underlying law. ROSCA itself remains in full effect, so its statutory requirements, clear disclosure, express informed consent, and a simple cancellation mechanism, continue to apply to online subscriptions. Reporting indicates the FTC moved to restart rulemaking, submitting a draft Advance Notice of Proposed Rulemaking on negative-option plans in early 2026. As of mid-2026 there is no separate finalized click-to-cancel regulation in force, but the statute's baseline obligations still govern.

ROSCA operates alongside, not instead of, state law. A number of states have enacted their own automatic-renewal statutes, such as California's Automatic Renewal Law, and some impose additional obligations like renewal reminders or specific online-cancellation methods. Depending on where a consumer lives, both federal and state rules may apply to the same subscription.

This page is general information about how ROSCA works, not legal advice, and it does not address any individual situation or dispute. Laws and regulations change, and the current status of any FTC rulemaking can shift. A consumer with a specific concern about a recurring charge can review the seller's own posted terms and, if warranted, report the practice to the FTC at reportfraud.ftc.gov or to their state attorney general; someone who needs advice about their own legal rights should consult a licensed attorney.