11 subscription cancellation laws most SaaS founders have never read (#5 requires a second button most products don't have)

Most founders find out about these laws the same way. A lawyer sends a letter.

Cancellation law exists in every major market where you have subscribers. United States, European Union, Australia, United Kingdom, Canada. If you have a paying customer there, their government has jurisdiction over how your cancellation works.

Your company doesn't need to be registered there. One paying customer is enough. What can they actually fine you?

$53,088
per violation
United States
4%
of annual turnover
European Union
A$100M
or 30% of turnover, per breach
Australia
10%
of global turnover · from spring 2027
United Kingdom
5%
of worldwide turnover
Canada
5 jurisdictions

These aren't hypothetical figures. These companies have already paid them. Recent fines and active lawsuits, with the regulator behind each and what went wrong.

Amazon
Fine $2.5 billion
What they did

Cancel process internally named "The Iliad Flow." Users sent in circles. One of the largest FTC penalties ever. September 2025.

United States
Adobe
Fine $150 million
What they did

50% Early Termination Fee not disclosed before purchase. Settled March 2026.

United States
Cleo AI
Fine $17 million
What they did

Cancellation deliberately obstructed. Fees charged after cancellation attempts. March 2025.

United States
Chegg
Fine $7.5 million
What they did

Multiple confusing screens before cancellation. Charges continued after the flow completed. September 2025.

United States
HelloFresh
Fine $7.5 million
What they did

Auto-renewal enrollment deceptive. Cancellation intentionally obstructed. August 2025.

California
Equinox
Fine $600,000
What they did

Subscription cancellation violations. June 2025.

New York
Vonage
Fine $100 million
What they did

Dark patterns and junk fees trapped users trying to cancel. Charged after cancellation. FTC, 2022.

United States
Starlink
Status Lost in court
What they did

No compliant cancellation button. "Deactivating payment" not recognized as cancellation. January 2026.

Germany
Uber
Status Lawsuit active
What they did

Charged without consent. Cancellation unnecessarily difficult. Filed April 2025.

United States
LA Fitness
Status Lawsuit active
What they did

No online cancellation. Required certified mail or in-person form. Filed August 2025.

United States
Match Group
Fine $14 million
What they did

Cancellation buried behind survey questions and dark patterns. FTC, August 2025.

United States
JustAnswer
Fine A$10 million
What they did

A "$2" chat answer that signed users into a $50–$90/month subscription. ACCC penalty, 2026.

Australia
12 companies

After Chegg and HelloFresh settled in 2025, private attorneys filed more than 12 new class actions against other subscription companies within weeks.

Regulators move first. Plaintiff attorneys follow with the same playbook. They already know which violations to look for.

These cases are built slowly and quietly. But when one succeeds, the penalty is extreme. The numbers above are what winning looks like for them.

How this actually works

Every market where you have a paying customer can act on its own. They don't coordinate, and they don't wait for each other. You can face the United States, California, the European Union and Germany at the same time, each applying its own law to the same product.

How the fine is worked out depends on the country. The United States and California fine you per customer affected there, so the more customers you have in that market, the bigger the bill. The European Union, United Kingdom, Canada and Australia instead take a percentage of your revenue, in some cases your worldwide revenue.

A country only acts when its own customers are affected. A German court won't take up a complaint from your customers in the United States. But once it does act, the fine it can impose is sized against your whole business, not just your customers there. So if you have customers across several of these markets, every one of them can come after you at the same time.

Who these laws apply to

These are consumer-protection laws. They protect individual people, not companies buying a business tool. So if you sell to businesses, it is reasonable to assume none of this is your problem.

That assumption is exactly what gets companies caught. Adobe was fined $150 million. Vonage was fined $100 million. Both of them sell to businesses, and both are on the list above.

The law doesn't care how you market your product. It cares how your customers sign up. If someone can subscribe with a personal name and a personal card, without ever entering company details, the law counts them as a consumer. The marketing manager who paid with their own card and typed their own name into the billing form is a consumer in most of these countries, even if what they bought is a serious enterprise tool.

To stay outside these rules, your checkout has to demand real company details at signup: a company name, a tax number, or a company email domain. If it doesn't, every customer who signed up without them counts as a consumer. Most self-service SaaS companies are exposed this way right now.

And going fully business-to-business still won't get you all the way clear. Some of these laws reach business subscribers too. The country-by-country breakdown below shows which laws apply to you, what each one demands, and what it costs to get it wrong.

Unlock the Requirements for All 11 Jurisdictions

Enter your email to unlock the full breakdown of 11 jurisdictions and weekly email digest on designing SaaS products people don't want to cancel.

Article unlocks now. Newsletter lands weekly. Cancel anytime.

  • The 2026 law that covers B2B subscribers, not just consumers.
  • Why one cancel button isn't enough in Germany.
  • The missing button that stretches a 14-day refund window to 12 months.
  • The consent you must collect before a free trial converts to paid.
  • The renewal reminder email the law requires, and its exact timing window.
  • The country arriving in 2027 with fines up to 10% of global turnover.

A note before you start

We design and build SaaS products for a living, so we see a lot of subscription flows.

Most of them break these laws. Our own clients do, and so do plenty of well-known SaaS startups you would recognise. They build cancellation to reduce churn, not to meet a legal standard they have never heard of.

The penalties are huge, and almost no founder we talk to knows these laws exist. That is why we put this together.

We are designers, not lawyers. We gathered all of this for our own work, so we can design and advise our clients correctly. But laws change, and interpretations vary.

United States

Federal FTC rules apply to every US subscriber, in every state

Before any state law, there is a federal floor.

The FTC governs how online subscriptions are sold and cancelled across the whole country. It sits on top of whatever California, New York, or Colorado require.

It applies to B2C, and it reaches B2B as well. ROSCA is one of the few US rules that also covers business subscribers.

At signup

At cancellation

Fines

Up to $53,088 per violation

Charged per customer affected, so a large subscriber base compounds into the biggest cancellation penalties on record:

Fined or in court
Amazon Amazon $2.5 billion · September 2025
Adobe Adobe $150 million · March 2026
Cleo AI Cleo AI $17 million · May 2025
Chegg Chegg $7.5 million · September 2025
Uber Uber Lawsuit active · April 2025
LA Fitness LA Fitness Lawsuit active · August 2025

Restore Online Shoppers' Confidence Act (ROSCA), 15 U.S.C. §8401, and FTC Act §5. The FTC's amended "Click-to-Cancel" Negative Option Rule was vacated by the Eighth Circuit in July 2025; enforcement continues under ROSCA.

California

The fine is $2,500 per subscriber, not per company

When you read "$2,500", maybe you think that's manageable. But then we do the math.

2,000 subscribers in California. A non-compliant cancellation process. That's $5 million in potential fines.

At signup

During the subscription

At cancellation

Records

Fines

Up to $2,500 per subscriber

Each subscriber is a separate violation under California's Unfair Competition Law. Same type of violation, same result:

Fined or in court
HelloFresh HelloFresh $7,500,000 · August 2025
Savage X Fenty Savage X Fenty $1,200,000 · November 2022

Cal. Bus. & Prof. Code §§17600–17606, amended by AB 2863, effective July 1, 2025.

New York

Cancellation must be at least as easy as signing up was

Here's how New York measures whether your cancellation is compliant.

They look at your signup. Then they look at your cancellation. If cancellation requires more effort than signup, you fail.

That's the test. A comparison.

At signup

During the subscription

At cancellation

Fines

Up to $1,000 per violation

The base penalty is $100 per violation, or $500 when a single act causes several. Both double, to $500 and $1,000, when the company breaks the rule knowingly. The Attorney General adds these up across every affected subscriber and can order refunds on top, which is how per-violation penalties reach the total below:

Fined or in court
Equinox Equinox $600,000 · June 2025

N.Y. Gen. Bus. Law §527-a (automatic renewal), amended effective November 5, 2025.

Colorado

The only US state that extended these laws to B2B companies in 2026

Every other US state on this list applies to consumers only.

Colorado is different.

It applies to individual consumers from August 6, 2025, and to business subscribers from February 16, 2026, wherever the company is based. If you sell SaaS to companies in Colorado, that second date already puts you in scope.

At signup

During the subscription

At cancellation

Fines

Up to $20,000 per violation

Breaking these rules counts as a deceptive trade practice under the Colorado Consumer Protection Act. The Attorney General and district attorneys can seek up to $20,000 per violation (up to $50,000 when the customer is elderly), and customers can also sue on their own.

Colo. Rev. Stat. §6-1-732 (automatic renewal), amended by SB25-145, effective August 6, 2025, extending to B2B February 16, 2026.

European Union

A mandatory withdrawal button is now required in every account area

This law came into force on June 19, 2026.

Most SaaS products built before that date don't have what it requires.

What makes this different: the law doesn't ask for a cancel button. It requires a withdrawal button, a separate element with its own label, for the 14-day withdrawal window. That is not the same as ending a subscription.

It applies to B2C contracts concluded online (not by phone, email or post), and non-EU companies directing activities at EU customers are in scope.

At signup

Withdrawal

Fines

Up to 4% of annual turnover

Each EU country sets its own penalties. For widespread cross-border breaches, EU-coordinated enforcement can reach up to 4% of the company's annual turnover.

Directive (EU) 2023/2673, inserting Article 11a (withdrawal function) into the Consumer Rights Directive 2011/83/EU; applies from June 19, 2026.

Germany

Two separate laws that both apply at the same time. Most products fail both.

Most SaaS products built outside Germany fail this section.

Not because the laws are complicated. Because most founders have never heard either one exists.

One has been law since 2022: the cancellation button and the lock-in limits. The other, the withdrawal button, applies from June 19, 2026.

At signup

Withdrawal

During the subscription

At cancellation

Fines

Up to 4% of annual turnover

The two laws carry different penalties. Breaking the cancellation-button rules (§312k) brings no direct government fine, but competitors and consumer groups can win a court injunction, and each violation can cost up to €250,000. Missing the withdrawal button (§356a) draws government fines up to €50,000, rising to 4% of annual turnover (or €2 million) for widespread cross-border breaches.

Microsoft 365 Microsoft 365 Ordered to comply · January 2026
Starlink Starlink Ordered to comply · January 2026

§309 No. 9 and §312k BGB (Fair Consumer Contracts Act, 2022) and §356a BGB (withdrawal button), in force June 19, 2026.

United Kingdom

Up to 10% of global annual turnover. Not just UK revenue. Everything.

Spring 2027 is the enforcement date. That sounds like there's time.

There isn't.

If you have UK subscribers and your process isn't compliant by Spring 2027, the fine is calculated on everything your company earns globally. Not just what you earn in the UK. Every pound, dollar, and euro, anywhere in the world.

At signup

Withdrawal

During the subscription

At cancellation

Fines

Up to 10% of global annual turnover

The fine is calculated on everything the company earns worldwide, not just its UK revenue (or up to £300,000 if that is greater). The CMA can impose it directly, without going to court.

Digital Markets, Competition and Consumers Act 2024 (DMCCA), Part 4, Chapter 2 (subscription contracts); regime expected in force Spring 2027.

Canada

Three provinces, three different laws, no federal standard

There is no single national law in Canada.

There are three provincial laws, each with different requirements, each tightening. If you have subscribers in Ontario, British Columbia, and Quebec, you have three separate compliance obligations.

At signup

During the subscription

At cancellation

Fines

Up to 5% of worldwide turnover

Penalties vary by province. Quebec's Bill 10 carries a criminal penalty of up to 5% of worldwide turnover, plus separate administrative fines. British Columbia and Ontario set their own under their consumer protection acts.

Ontario Consumer Protection Act, 2023 (regulations pending); B.C. Business Practices and Consumer Protection Act (2025 amendments); Quebec Bill 10 (2025).

Australia

No dedicated law, but the fine can reach A$100 million

There's no dedicated subscription law in Australia yet.

For now, the job is done by the law on unfair contract terms, which carries penalties up to A$100 million, and the regulator has made subscription traps a top target.

A dedicated law is coming: the Unfair Trading Practices reform, with subscription-specific rules, is proposed to start on July 1, 2027.

It applies to both B2C and B2B: the unfair-terms law covers individual customers and small businesses alike, and foreign companies are in scope.

At signup

During the subscription

At cancellation

Fines

Up to A$100 million

For each breach, the penalty is the greatest of: A$100 million, three times the benefit gained, or 30% of the company's turnover during the breach period. Each unfair term counts as a separate breach. The same penalties will back the incoming Unfair Trading Practices rules.

Australian Consumer Law, unfair contract terms regime (penalties from November 9, 2023); Unfair Trading Practices reform proposed to commence July 1, 2027.

Japan

The law specifies what must be on the checkout screen before anyone pays

Japan doesn't regulate cancellation the same way the US or EU do.

What it regulates is the moment someone agrees to pay.

Get the screen wrong, and the customer gets a legal right to unwind the contract after the fact, not just file a complaint or a chargeback.

At signup

Fines

Up to ¥100 million

Getting the final confirmation screen wrong (leaving out required information or misleading) is a crime. An individual faces up to 3 years in prison or a ¥3 million fine; the company faces up to ¥100 million. The Consumer Affairs Agency can also order the business to fix its practices or suspend operations, and consumer groups can seek injunctions.

Act on Specified Commercial Transactions, final confirmation screen rules (Art. 12-6), penalties under Art. 70; in force since June 1, 2022.

South Korea

Six specific dark patterns now explicitly prohibited since February 2025

Most countries prohibit cancellation dark patterns in general terms. South Korea lists them.

Since February 14, 2025, six specific patterns are explicitly prohibited by name. If your product uses any of them, it isn't a judgment call.

It's a violation.

It applies to B2C, and the Korea Fair Trade Commission has said it will enforce against foreign online platforms selling to Korean customers.

At signup

Withdrawal

During the subscription

Prohibited dark patterns

Fines

Up to KRW 5 million per violation

The Korea Fair Trade Commission can order the business to fix the practice and can fine it up to about KRW 5 million for breaking the consent-and-notification rules. For serious cases it can add penalty surcharges based on a share of revenue, and even suspend the business. Enforcement stepped up sharply through 2025.

Act on Consumer Protection in Electronic Commerce, dark-pattern rules in force February 14, 2025 (drip-pricing grace period to August 13, 2025).

Brazil

Every online customer has a 7-day right to a full refund. Including yours.

In Brazil, this right applies to everything purchased online.

Digital products. SaaS subscriptions. Annual plans. There are no exceptions.

If the customer cancels within 7 days of signing up, they're entitled to a full refund including any transaction fees. No questions asked. No minimum purchase required.

At signup

Withdrawal

At cancellation

Fines

Up to ~R$13 million per violation

Administrative fines under the Consumer Code reach about R$13 million per violation, issued by SENACON and state and municipal agencies. On top of that, any wrongful charge must be paid back to the customer at double the amount, plus interest and an inflation adjustment. Class actions under the Code are common, and often target foreign companies with Brazilian customers.

Consumer Defense Code (CDC, Law No. 8.078/1990), right of regret (Art. 49); Decree No. 7.962/2013 on e-commerce (Arts. 4–5).

Go through the requirements above for each country where you have subscribers and check your cancellation process against them.

If you want us to do that with you and tell you exactly what needs to change, book a call.

Book a call