ROSCA and Federal Restrictions on Free Trial Conversions

A federal law called ROSCA spells out exactly what a seller owes you before your free trial turns into a real charge, and it does so in three specific, enforceable ways. Before this law existed, silence was treated as a yes. Sellers online routinely took the absence of a cancellation as permission to bill, no disclosure required, no explicit agreement needed. The seller's silence-as-permission policy caused the charge to post.

The practice that pushed lawmakers to act had a name: data pass. A consumer would buy something from one company, and that company would quietly hand off the consumer's billing information to a completely different, unrelated seller, who then charged the same card for a product or service the consumer never asked for and often never heard of. Senate Commerce Committee investigations into three companies, Affinion, Webloyalty, and Vertrue, documented exactly this pattern: consumers auto-enrolled in continuity programs with no real consent involved. That record is what moved Congress to act.

Senator Jay Rockefeller introduced the bill, S.B. 3386, on May 19, 2010. The target was what regulators call negative option marketing, any setup where a customer's inaction gets treated as consent to be charged. Free trials that convert into paid subscriptions are the textbook case. ROSCA wasn't written with them as an afterthought, it was written for them.

Decades later, the same problem hasn't gone anywhere. A Self Financial survey found that 70% of respondents had, at some point, forgotten to cancel a free trial and gotten charged for it. That number alone says the abuses ROSCA targeted are alive and well, law or no law. So the law's response was structural: three specific, non-negotiable obligations that govern how a trial-to-paid conversion has to work.

The three-requirement structure ROSCA imposes on every trial-to-paid conversion

The FTC describes ROSCA's framework as three requirements that all have to be met, together, every time. Not all three. Not a partial version of one. All three, on every negative option offer.

They are as follows. First, clear and conspicuous disclosure of every material term, before the seller ever collects billing information. Second, express informed consent, obtained before the charge actually posts. Third, a cancellation mechanism that's genuinely simple to use. Each one closes off a specific way sellers used to exploit consumers, and each one is enforceable on its own.

Enforcement runs through the FTC, which treats ROSCA violations as violations of an FTC rule, opening the door to civil penalties and consumer redress. State attorneys general have standing too, though ROSCA itself limits what they can win to injunctive relief; many states layer their own consumer protection statutes on top, which opens up additional remedies.

Think of these three requirements less as a compliance checklist for businesses and more as a list of things owed to you, specifically, before your card ever gets charged. Each one stands on its own terms.

Requirements for "clear and conspicuous disclosure" before card number entry

Timing matters here more than most people assume. The disclosure has to happen before the seller collects your billing information, not at the final checkout screen, and definitely not in an email that shows up after the fact.

What has to be in that disclosure? The FTC's guidance requires that you'll be charged unless you cancel, the exact dollar amount, how often the charge recurs, the date you need to cancel by to avoid it, the date the charge actually gets submitted, and everything you need to know to cancel. That's specific language about "terms applying." It's the actual numbers and dates.

"Clear and conspicuous" has a real definition too. It means the disclosure has to stand out from everything around it, and it has to be visible without making you scroll, click a link, or hover over some icon to reveal it.

The Triangle Media case shows what failure looks like in practice. On mobile, the same terms sat hidden behind a "Terms & Conditions" link nobody was going to tap. The offer looked like a "risk free trial" costing about $4.95 for shipping. The reality, buried out of sight, was enrollment in an automatic shipment program running roughly $84.71 a month, with the first charge hitting on day 15.

That gives consumers a genuinely useful test. If you can't see the recurring charge amount, the date you'd need to cancel by, and how to cancel, all without clicking or scrolling, before you've entered payment details, the seller likely isn't meeting its legal obligation. On top of that, sellers are required to send a reminder before a trial actually converts, so the charge shouldn't arrive as a total surprise either.

What "express informed consent" excludes

Consent under ROSCA has to clear three bars at once: it has to be an affirmative act, it has to be based on real disclosure, and it has to be specific to the recurring charge itself, not folded into agreeing to the transaction generally.

The FTC's guidance requires at least two separate consents, one for the recurring charge and a separate one for the underlying purchase. A single click covering both doesn't satisfy the requirement. The seller also has to be able to produce a record that this consent happened, verifiable, not just claimed after the fact.

Several common practices fail this test. A pre-checked box doesn't count, because silence and inaction are precisely what the law says can't stand in for consent. Consent language buried inside, or contradicted by, surrounding marketing copy doesn't count either. Neither does any disclosure that muddies, contradicts, or otherwise undercuts a consumer's ability to understand what they're actually agreeing to.

Triangle Media illustrates this failure mode too. After a consumer clicked "complete checkout," they were routed to a page reading "Wait! Your Order Is Not Complete!" which enrolled them in a second automatic shipment program, this one for a supplement running about $79.31 a month, with zero separate consent obtained. That's a second charge riding in on the coattails of the first, with nothing resembling informed agreement behind it.

A box you never checked, a term you couldn't see, or a charge tied to an offer from a different seller entirely doesn't meet the standard, and the law treats that resulting charge as unauthorized. The data pass ban reinforces this directly. If a third party gets your billing information from the company you actually did business with, that third party needs its own separate, express consent before charging you. Agreeing to buy from seller A is not agreeing to be billed by seller B.

Seller boundary-pushing on "simple cancellation mechanism" requirements

The legal floor is straightforward: cancellation has to be at least as easy as signing up was. Sign up with one click online, and cancellation has to be available online too, not buried behind a phone call or a mailed letter.

That floor still leaves a lot of room, and sellers have used that room inventively, because every successful cancellation is recurring revenue walking out the door. Regulators have documented a recurring set of friction tactics: cancellation links tucked deep inside account settings where they're hard to find, requests for extra personal information before cancellation can proceed (often dressed up as fraud protection), confirmation requirements spread across multiple channels like text, phone, and email, alternate offers popping up mid-cancellation to redirect the customer, and confirmation pages that frame quitting as a loss rather than a neutral choice.

There's real economics behind why sellers do this. Stanford economist Neale Mahoney's 2025 paper in the American Economic Review found that consumers are roughly four times more likely to cancel when they're required to make an active decision, rather than one that happens passively. Researchers in that work estimate subscription sellers can roughly double their revenue through inertia and cancellation friction alone. That's not a rounding error; that's a business model built on making the exit door hard to find.

In 2017, six ROSCA enforcement actions covered products ranging from lingerie and teeth-whitening subscriptions to credit monitoring and fitness apps, and failure to provide simple cancellation mechanisms was a recurring allegation across all of them. That's not a coincidence across six unrelated industries, but a pattern.

If canceling takes more steps, more channels, or more delay than signing up did, write down that mismatch. Depending on the specifics, it may be a violation you can report to the FTC or your state attorney general.

The regulatory layer above ROSCA and the 2025 court ruling that changed the picture

The FTC tried to build something stronger on top of ROSCA: the Negative Option Rule, aimed at four categories of programs, free-trial conversions among them, with amendments that took effect January 14, 2025. The headline addition was a "click-to-cancel" requirement, meaning cancellation had to match the sign-up method exactly and happen through the same medium, plus civil penalties up to $51,744 per violation for material misrepresentations.

The rollout wasn't clean. The court's reasoning wasn't about the substance of click-to-cancel, it was procedural: the FTC hadn't done the preliminary regulatory analysis that section 22 of the FTC Act requires before a rule like this can stand. The stronger cancellation protections didn't survive that ruling.

What's left standing matters. ROSCA itself wasn't touched by the vacatur and remains fully enforceable. State automatic renewal laws, California's being the best-known example, keep applying on top of ROSCA regardless of what happened at the federal appellate level. And there's movement in Congress: the bipartisan Unsubscribe Act, introduced in the House in January 2026 with a Senate companion bill dating to July 2025, would add further federal protections, though it hadn't become law as of this writing.

The three ROSCA requirements are federal and enforceable right now. The stronger guardrail, requiring cancellation to mirror sign-up exactly, isn't currently in force federally, even though it briefly was. Protection varies by state from there. The FTC issued a 60-day enforcement deferral on May 9, 2025, with full compliance required starting July 14, 2025.

The law's protections are necessary but not sufficient for most people

A gap nobody talks about enough sits between compliance and consumer memory. ROSCA requires disclosure and consent, both of which can be technically satisfied, and the consumer can still forget the trial exists and get charged anyway. A fully compliant trial is still a trial someone forgot about, and the charge lands regardless.

The scale involved is not small. A CNET survey put average monthly subscription spending for U.S. adults at $91, more than $1,000 a year, and found that 48% of people had forgotten to cancel a free trial before it converted to paid. Nearly half. That's not a fringe problem, that's close to a coin flip.

The subscription industry has studied this moment closely, and it shows. Recurly's State of Subscriptions report, drawing on 76 million subscribers across more than 2,200 businesses, found that use of "pause before cancel" options jumped 337%, and three out of four customers who paused ended up coming back rather than actually leaving. That's a deliberate outcome of product design. That's a moment of intent to cancel getting identified, intercepted, and converted back into revenue, systematically.

Price creep adds another layer on top. Auto-renewal means those higher bills arrive without the consumer ever making a new, explicit decision to pay more.

And then there's memory itself. ROSCA's disclosure requirement puts the right information in front of someone exactly once, at sign-up. It has nothing to say about month six, when the trial converted long ago and the charge has become part of the background noise on a bank statement. The law gets the information to the right person at the right moment, the moment of sign-up, but it was never built to solve for attention, memory, or a dozen overlapping trials running at once across different services.

Turning ROSCA's requirements into a personal checklist and using automated monitoring to fill the gap

ROSCA gives anyone entering a free trial a concrete set of things to check, right there on the sign-up screen. Can the exact charge amount, the billing date, the cancellation deadline, and the cancellation method all be seen before the card goes in, without a scroll or a click? On consent: is there a separate, affirmative checkbox or click specifically for the recurring charge, distinct from agreeing to the trial itself? On cancellation: is the method spelled out clearly, and does it match how easy sign-up was, online if sign-up was online?

If any of those is absent, report it to the FTC or the consumer's state attorney general.

The checklist has a hard limit though: it only works at the moment of sign-up. It has nothing to offer three months later, when the trial has already converted, the price has crept up from what was originally disclosed, or an unfamiliar third-party charge appears on a statement with no memory of ever agreeing to it.

That's the exact space automated monitoring is built to cover. A tool that reads bank accounts, email, and subscription connections in read-only mode can flag a trial conversion the day it hits, catch a price increase against whatever was originally disclosed, and spot third-party charges nobody separately consented to, doing continuously what no one can realistically track by hand across a full stack of subscriptions. + operates on exactly that principle: it connects to accounts and subscription services in read-only mode and surfaces findings, trials about to convert, charges that showed up without clear authorization, each with a specific dollar figure attached and a clear next step. It's the ongoing watch that ROSCA's one-time disclosure moment always assumed a consumer would somehow keep up on their own.