Chargeback Rights for Unauthorized Subscription Renewals

Subscription charges that renew without proper consent aren't just annoying, they're a legal problem with a fix attached, and cardholders have concrete, time-bound rights to get that money back. The billing model itself is what makes this different from a one-time purchase. A merchant keeps the card on file and re-charges on a schedule, sometimes for months or years after someone stopped using the service or ever knowingly agreed to keep paying for it. That structure runs on something called negative option billing: silence or inaction gets treated as consent to keep getting charged. It's only lawful under specific conditions, namely that the company made clear disclosures and got real consent before it ever collected billing information. Skip those steps, and the charge is unfair. It's disputable, under federal law and under the rules that Visa and Mastercard themselves enforce on merchants.

Three practices keep appearing in FTC enforcement records and settlement cases, and they consistently cross the line. Enrolling someone in recurring billing without disclosing the terms clearly before payment. Making cancellation harder than sign-up, through dark pattern flows or phone-only cancellation windows that only run a few hours a day. And skipping the confirmation email after purchase that's supposed to spell out renewal terms and how to cancel. Any one of these, on its own, can be grounds for a dispute.

This isn't an abstract risk. Nearly half of U.S. A CNET survey found that 48% of adults say they've forgotten to cancel a subscription at some point, and the average adult underestimates their own monthly subscription spending by $133. Do the math on that gap and it means most people reading this already have a charge sitting on a statement somewhere that might qualify for a dispute. What follows is a walkthrough of how to identify that charge, which legal grounds actually apply, and how to build a case that gets money back, not a general lecture on reading the fine print more carefully.

The legal framework that gives cardholders the right to dispute unauthorized subscription charges

Two federal laws anchor these rights no matter which state someone lives in. It applies to online negative option marketing everywhere in the country, regardless of state law. The second is Section 5 of the FTC Act, which bars unfair or deceptive practices broadly, including hiding a cancel button or burying renewal terms where no one will read them. The FTC has used Section 5 in enforcement actions even in periods when no specific rule covering subscriptions was in force.

That last point matters because the specific rule most people have heard about, the FTC's "click-to-cancel" rule, doesn't exist right now, and citing it in a dispute letter would be citing something that's gone. On July 8, 2025, the Eighth Circuit vacated the amended Negative Option Rule in Custom Communications, Inc. v. FTC. The court ruled on procedure, not on whether the rule's substance was sound, but the effect is the same either way: the rule is gone, and it isn't coming back in its old form Purchy state auto-renewal laws database. Then on March 11, 2026, the FTC opened an Advance Notice of Proposed Rulemaking on negative-option marketing, with the public comment period closing April 13, 2026. That's the earliest possible stage a rule can be in. It imposes no obligations on anyone today, and nobody should waste time citing a rule that hasn't been written yet.

None of that means enforcement stopped. The FTC kept building cases under ROSCA and Section 5 the entire time, and the largest subscription settlement in the agency's history, against Amazon, closed after the rule had already been vacated. Federal protection for subscription cancellation didn't evaporate when the rule did. It just moved back to the statutes that were always doing the heavy lifting.

Visa and Mastercard run their own rules for subscription merchants, and those rules operate independently of federal law. Visa requires at least seven days' notice before a free trial converts into a paid plan, and Mastercard requires three to seven days, for trials longer than a week. A merchant who skips that notice has already broken network rules before a single customer files a dispute, which is exactly the lever a cardholder pulls when they file a chargeback instead of just calling customer service. Enough disputes against a merchant, and the card networks start their own monitoring programs, sometimes ending in a closed merchant account.

A chargeback through the card network isn't the same mechanism as a billing-error dispute under federal consumer credit law. Mixing these up, or assuming the debit card process works like the credit card one, is a common way people miss their filing window.

State law now does most of the actual work beneath both federal tracks Your Subscription Cancellation Rights by State (2026) — CancelFreely. More than 30 states have their own automatic renewal laws, and in several cases those state laws are tougher than the federal rule that got struck down would have been Your Subscription Cancellation Rights by State (2026) — CancelFreely. ROSCA (Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401–8405) requires clear disclosure of all material terms before billing information is collected, express informed consent, and a simple mechanism to stop recurring charges, and applies to online negative option marketing nationwide. On February 12, 2026, the FTC formally restored the much narrower pre-2024 "Prenotification Negative Option Plans" rule (91 Fed. 6507), which covers only a narrow category of book-of-the-month-style clubs. The FCBA billing-error dispute for credit cards is governed by federal Reg Z, with a 60-day window from the statement on which the charge first appeared and written-notice rules that apply. The Reg E dispute for debit cards and electronic transfers is a separate statutory path with its own timelines.

State automatic renewal laws and your rights

With no federal click-to-cancel rule in force, state law is the main thing standing between a subscriber and a merchant who wants to make cancellation as painful as possible. Rights vary a lot depending on where someone lives, so knowing the state's tier changes what's actually enforceable.

Tier 1 states have the strongest, most specific protections. California updated its automatic renewal law (Cal. California also gives individuals a private right of action, meaning someone can sue directly without waiting on the FTC to act, and the state's most recent enforcement produced a $7.5 million settlement with HelloFresh in August 2025 Your Subscription Cancellation Rights by State (2026) — CancelFreely Purchy state auto-renewal laws database. Colorado's law (C.R.S. § 6-1-732) requires a one-step online cancellation link as of August 6, 2025, only allows retention offers if the cancel link stays visible, and expanded to cover business-to-business subscriptions starting February 16, 2026 Your Subscription Cancellation Rights by State (2026) — CancelFreely Purchy state auto-renewal laws database. Virginia's statute, effective July 1, 2026, requires cancellation to be at least as easy as signing up through every channel a company offers, plus free phone cancellation during business hours.

New York State's law (GBL 527/527-a), effective November 5, 2025, requires renewal terms to sit right next to the consent request before any billing information gets collected, affirmative consent before the first charge, and 5 to 30 days' notice of material changes or price increases. New York City layers its own rule on top, effective October 1, 2026, with penalties running $525, then $1,050, then $3,500 per violation, plus restitution to consumers. Massachusetts (940 CMR 38.00, effective September 2, 2025) requires total price and recurring terms disclosed before purchase and cancellation as easy as sign-up in the same medium. Maine, effective January 1, 2026, requires separate consent to auto-renewal specifically. Arkansas, effective August 3, 2025, requires clear disclosure and explicit consent before charges start. Louisiana's law takes effect January 1, 2027, so it is not in force yet. Maryland's takes effect June 1, 2026.

Tier 2 states have real automatic renewal laws, just with weaker enforcement or no requirement that cancellation match the ease of sign-up. Oregon requires clear disclosure and renewal notice for annual plans, and has a distinctive remedy: if a company violates the law, the customer may be entitled to treat what they received as an unconditional gift. North Carolina has existing disclosure rules with an amendment bill pending as of this writing. Vermont requires disclosure and renewal notice for annual subscriptions. Delaware, Hawaii, Florida, and Georgia round out this tier, with coverage that varies state to state.

They fall back on general unfair-and-deceptive-practices (UDAP) statutes, which all 50 states have. A cancellation flow that's deceptive or absurdly difficult can still violate those laws, but the main path to relief runs through a complaint to the state attorney general rather than a private lawsuit.

Most state automatic renewal laws treat a violation of these as an unfair or deceptive act under the state's consumer protection statute, which can mean actual damages, statutory damages, attorney's fees, and in some states treble damages or a private right of action. Knowing which tier a state falls into decides which law gets cited in a demand letter, and whether the next move is a lawsuit or a complaint filed with the attorney general. Connecticut (CT SB3, effective July 1, 2026) requires an annual reminder for every auto-renewing contract, online or email cancellation, no in-person or mail-only cancellation, and voicemail requests handled within one business day. Illinois (815 ILCS 601) requires clear disclosure and a 30–60 day advance renewal notice for annual contracts. There are five things every state ARL has in common, forming the floor any reader in any Tier 1 or 2 state can assert.

Major settlements and disputable charges

The clearest evidence of where the legal line sits isn't in a statute, it's in the enforcement record from 2025–2026, where each case follows the same pattern: easy sign-up, difficult exit, consumers left paying for services they did not knowingly continue. Every one of these cases follows the same shape: sign-up designed to be effortless, cancellation designed to be anything but, and customers left paying month after month for something they never knowingly agreed to keep.

Amazon's settlement is the largest, at $2.5 billion. The FTC's case alleged that Amazon enrolled millions of people in Prime between 2019 and 2025 without adequate consent, using a checkout flow built to nudge people toward enrollment without clearly disclosing what they were signing up for. Internally, the cancellation flow reportedly went by the name "Iliad Flow," a maze of screens deliberately built to be long and hard to navigate. The settlement, reached September 25, 2025, sets aside $1.5 billion for consumer refunds of up to $51 per person and adds $1 billion in civil penalties. This closed after the click-to-cancel rule had already been struck down, which is about as clear a signal as exists that FTC enforcement didn't need that rule to keep functioning.

People who signed up for Adobe's annual plans ended up paying hundreds of dollars to leave, without ever knowing that fee existed when they subscribed. Shutterstock paid $35 million over marketing subscription packs as "on-demand" purchases while quietly making online cancellation difficult and failing to disclose that the charges would auto-renew. Instacart paid $60 million tied to its subscription practices. Grubhub settled for $140 million in December 2024 after an 11-count FTC suit, with the order requiring cancellation to be "as easy to find and use as the method" people used to sign up in the first place. HelloFresh's $7.5 million settlement, mentioned earlier, came out of California enforcement in August 2025. Fitness International, sued by the FTC in August 2025, allegedly forced members through hurdles like mailing a specific form by certified mail or hand-delivering it to one particular manager.

Three patterns run through every one of these cases, and they form a checklist to hold up against any charge in question: enrollment deception, where the customer never knowingly agreed to a recurring charge; hidden or buried fees never disclosed before billing information was taken; and cancellation deliberately built to be harder than sign-up, whether through dark patterns, phone-only requirements, or certified mail. A charge that fits any one of these patterns is a clear case, carrying the same fingerprints as one regulators have already won. It's a charge with the same fingerprints as a case regulators have already won.

Documenting your case before you file anything

Card issuers and state regulators respond to evidence, not frustration. Whatever gets typed into a dispute form matters less than what backs it up, so pulling the paperwork together before contacting anyone is the difference between a dispute that gets approved and one that gets bounced back for lack of proof.

Start with the original sign-up confirmation email, if one exists. A missing confirmation violates the law in a lot of states. Next, try to reconstruct what the sign-up screen actually showed, whether that's a saved screenshot or a rebuilt version of the flow. The FTC's own standard is that disclosures need to be "virtually unavoidable" before a company collects billing information, so if the terms weren't obviously in the customer's path, that is the exact gap to point to. Pull up the company's published cancellation policy from around the time of sign-up, using an internet archive tool if the policy has since changed. Go through the statement line by line: every charge, its date, its amount, and the merchant descriptor attached to it, flagging anything unrecognized or anything that changed amount without warning. And check for renewal or price-change notices, because their absence matters too. Plenty of states require 5 to 30 days' advance notice before a renewal or price hike, so a missing notice is evidence on its own.

Cancellation attempts need their own paper trail, separate from the sign-up documentation, especially because companies sometimes claim a cancellation never happened. Screenshot every step of an online cancellation flow as it's completed. If cancellation happens over the phone, send a follow-up email the same day stating the date, the representative's name if one was given, and exactly what got confirmed on the call, since a phone call by itself leaves no record and an email does. Put the cancellation date in writing and ask for written confirmation back, referencing any earlier attempts that didn't go through. Keep everything, every screenshot, every email, every statement, in one folder. Disputes move faster when the whole case sits in one place, ready to hand over the moment someone asks for it.