The Restore Online Shoppers’ Confidence Act is a 2010 federal law, codified at 15 U.S.C. §§ 8401–8405, that targets two deceptive online billing practices: merchants passing a customer’s payment information to a third-party seller after a purchase, and subscription traps that charge consumers who never clearly agreed to recurring fees.1Office of the Law Revision Counsel. 15 USC Chapter 110 – Online Shopper Protection The Federal Trade Commission and state attorneys general enforce it, and civil penalties currently reach $53,088 per violation.2Federal Register. Adjustments to Civil Penalty Amounts
The Ban on Post-Transaction Data Pass
Before ROSCA, a common scheme worked like this: a consumer would buy something online and see an offer from a different company on the confirmation page. A single click accepted the offer, and the original merchant quietly handed the consumer’s card number to the second company. Because the consumer never re-entered payment details, the recurring charge that followed often came as a complete surprise.
ROSCA closes that pipeline at both ends. The original merchant may not disclose a consumer’s credit card, debit card, bank account, or other billing information to any post-transaction third-party seller for use in an internet sale.1Office of the Law Revision Counsel. 15 USC Chapter 110 – Online Shopper Protection And a third-party seller cannot charge the consumer unless it does three things: clearly discloses all material terms of its offer (including that it is not affiliated with the original merchant), obtains the full account number directly from the consumer, and gets the consumer’s express informed consent to be charged.
The upshot is straightforward. If you finished a purchase and are being billed by a company you never gave your card number to, that arrangement is unlawful under federal law.
What ROSCA Requires for Subscriptions and Free Trials
The second half of the statute governs “negative option” offers. That’s the industry term for any arrangement in which a consumer’s silence, inaction, or failure to cancel is treated as agreement to keep being charged. Subscription boxes, auto-renewing software, streaming services, and free trials that convert to paid plans all fall inside this definition.
Under 15 U.S.C. § 8403, an online negative option seller must clearly disclose the material terms before collecting billing information, obtain the consumer’s express informed consent to the recurring charge, and provide simple ways to cancel.3Office of the Law Revision Counsel. 15 USC 8403 – Negative Option Marketing on the Internet The FTC’s amended Negative Option Rule at 16 CFR Part 425 fills in the specifics.
Clear and Conspicuous Disclosure
The statute says “all material terms” without listing them. The Negative Option Rule spells out what counts: that the consumer will be charged and that charges will recur, each deadline by which the consumer must act to avoid a charge, the amount or range of costs, how often charges will hit, and how to cancel.4Federal Trade Commission. Negative Option Rule
Timing matters as much as content. The disclosure has to appear before the seller collects billing information, not on a later confirmation screen.5Federal Trade Commission. Enforcement Policy Statement Regarding Negative Option Marketing “Clear and conspicuous” also has teeth. Terms buried behind hyperlinks, printed in small font, or placed far from the checkout button routinely fail. The test is whether a reasonable consumer would actually notice and understand the terms in the normal flow of the transaction.
Express Informed Consent
Disclosure by itself is not enough. The consumer must take a deliberate, affirmative step agreeing to the recurring charge. In practice, that usually means a checkbox, signature, or similar mechanism tied specifically to the negative option feature.6eCFR. 16 CFR 425.5 – Consent Rolling the consent into a general “I agree to the terms of service” click is not compliant, because it is not specific to the recurring charge. The consent request also has to be free of extraneous information that might confuse the consumer about what they are agreeing to.
Simple Cancellation
ROSCA requires “simple mechanisms” to stop recurring charges, and the FTC’s amended rule, finalized in October 2024, sharpened that requirement into what the Commission calls the “click-to-cancel” standard.7Federal Trade Commission. Federal Trade Commission Announces Final Click-to-Cancel Rule Making It Easier for Consumers to End Recurring Subscriptions and Memberships The principle is that cancellation has to be at least as easy as the sign-up.
Specific guardrails follow from that principle:
- If the consumer did not have to speak to a person or virtual agent to sign up, the merchant cannot force one for cancellation. Routing users to retention agents to talk them out of leaving is no longer permitted.
- If phone cancellation is offered, the call cannot cost money, must be answerable during normal business hours, and messages must get prompt responses.
- If the consumer signed up in person, in-person cancellation can be one option but cannot be the only one. An online or phone path must exist.
The cancellation route also has to be easy to find. Hiding it behind multiple account-settings pages or a chain of “are you sure?” screens undermines the simplicity the statute requires.8Federal Trade Commission. Click to Cancel – The FTCs Amended Negative Option Rule and What It Means for Your Business
Penalties and Who Enforces the Law
Under 15 U.S.C. § 8404, any ROSCA violation is treated as an unfair or deceptive act under the FTC Act. That gives the Commission the same tools it uses in other consumer protection cases: injunctions to stop the conduct and orders returning money to affected consumers.9Office of the Law Revision Counsel. 15 USC 8404 – Enforcement by Federal Trade Commission
Civil penalties currently reach $53,088 per violation, adjusted annually for inflation.2Federal Register. Adjustments to Civil Penalty Amounts Each unauthorized charge to each consumer can count as a separate violation, so exposure scales quickly against a company running a deceptive program across thousands of customers.
State attorneys general share enforcement authority under 15 U.S.C. § 8405. They can sue in federal court on behalf of their state’s residents, seeking injunctions and damages.10Office of the Law Revision Counsel. 15 USC 8405 – Enforcement by State Attorneys General The dual structure means a company that escapes federal attention still has fifty potential state enforcers.
What Consumers Can Do About a Violation
ROSCA does not create a private right of action. If a company is charging you for a subscription you never clearly agreed to, you cannot file a ROSCA lawsuit yourself. Enforcement runs only through the FTC and state attorneys general.
Practical steps remain. A chargeback through your card issuer or bank, disputing the charge as unauthorized, is usually the fastest way to stop the bleeding. Filing a complaint at ftc.gov or with your state attorney general’s consumer protection division adds to the pattern that enforcers use to prioritize investigations. Many states also have their own automatic-renewal statutes, and some of those do allow consumers to sue directly.
How ROSCA Fits With State Subscription Laws
ROSCA does not preempt state law. A number of states have their own negative option and automatic renewal statutes, some of which impose requirements beyond the federal floor: specific disclosure language, particular cancellation methods, or the right to void a non-compliant contract.11Federal Register. Rule Concerning the Use of Prenotification Negative Option Plans A business selling nationwide has to satisfy ROSCA and whichever state law is strictest for the customers it reaches.