Free Trial and Subscription Billing Rules in 2026: What Visa, Mastercard, ROSCA and the States Require

A supplement brand runs a $4.95 fourteen-day trial that rolls into $49 a month. A software company offers thirty days free and then bills annually. Both read last year that the FTC's click-to-cancel rule had been thrown out and concluded the rules had loosened. They had not. The federal rule was vacated on procedural grounds, but the statute behind it never moved, the card networks' subscription rules stayed where they were, and eight states have added or tightened their own laws since July 2025. This guide sets out what binds a merchant running trials or recurring billing as of September 2026, layer by layer, and ends with one checklist that satisfies all of it.

Where the federal click-to-cancel rule stands

The FTC finalised its amended Negative Option Rule, popularly called click-to-cancel, in October 2024. It would have required that cancelling be as easy as signing up and would have reached almost every subscription in the country. On July 8, 2025, the U.S. Court of Appeals for the Eighth Circuit vacated it in its entirety, six days before its July 14 compliance date. The court's reasoning was about process, not substance: the Commission had skipped a preliminary regulatory analysis the FTC Act requires for rules with an annual economic effect above $100 million. Nothing in the decision said a click-to-cancel requirement was itself unlawful.

The Commission has since started over. On March 11, 2026 it announced an Advance Notice of Proposed Rulemaking, published in the Federal Register on March 13 with comments due April 13, 2026, asking whether the rule should be amended, whether provisions of the vacated 2024 rule should be revived, and whether some industries should be treated differently. An ANPRM is the first step of a rulemaking, not a rule. As of September 2026 there is no proposed rule on the table, and the only Negative Option Rule in force is the 1973 original, which covers prenotification plans of the book-of-the-month kind and almost nothing a modern online merchant does.

That gap matters less than it sounds, because the FTC never relied on the rule alone. The Restore Online Shoppers' Confidence Act, a 2010 statute shortened to ROSCA, makes it unlawful to charge a consumer through a negative option feature online unless the seller clearly and conspicuously discloses all material terms before obtaining billing information, obtains the consumer's express informed consent before charging, and provides simple mechanisms to stop recurring charges. Section 5 of the FTC Act, which prohibits unfair or deceptive practices, sits underneath that. On September 25, 2025, ten weeks after the Eighth Circuit ruling, the FTC used those two authorities to settle with Amazon over Prime enrolment and cancellation for $2.5 billion: a $1 billion civil penalty and $1.5 billion in refunds to an estimated 35 million customers. A merchant that reads the vacatur as permission to make cancellation hard is misreading the law that was enforced ten weeks later.

What Visa requires of trial and subscription merchants

Visa's subscription rules predate all of this. It has regulated negative-option merchants since 2011, and on April 18, 2020 it brought in specific requirements for any merchant, physical or digital, whose free trial or introductory offer rolls into an ongoing subscription. They remain in force, and Visa said at the time it would enforce them through monitoring and mystery shopping:

• Express consent. At enrolment the cardholder must expressly agree to an ongoing subscription with recurring payments.
• Enhanced notification. At enrolment, even if nothing is charged that day, the merchant must send an electronic copy of the terms by email or, if the cardholder agreed, SMS: confirmation that they have agreed to a subscription unless they cancel, the start date, the goods or services, the ongoing amount and billing frequency, and a link or other simple way to cancel online.
• Reminder before the first real charge. When a trial or promotional period ends, or the price or billing period changes, the merchant must send an electronic reminder with a link to online cancellation at least seven days before initiating the recurring transaction.
• Explicit receipts. The receipt for the initial transaction must state the length of the trial, disclose clearly that the cardholder will be charged unless they cancel, show the amount and date of the initial transaction even if it is zero and of the recurring transactions to follow, and carry a simple online cancellation mechanism.
• Easy cancellation. The merchant must provide an easy way to cancel online regardless of how the cardholder originally signed up. Visa's comparison is that it should be about as easy as unsubscribing from an email list.
• A trial descriptor. The first financial transaction at the end of a trial must carry an additional descriptor in the merchant name field, such as trial, trial period or free trial, so it appears that way on statements and in purchase alerts, and the recurring payment indicator must be set on that transaction even when its amount differs from the ongoing amount.

Visa paired those obligations with a dispute right. Condition 13.5, Misrepresentation, was expanded so an issuer can use it when a cardholder bought through a trial and was not clearly told about further billing. The same bulletin gives compliant merchants their defence: the dispute fails if the merchant can show the cardholder expressly agreed to future transactions at enrolment and was electronically notified before the post-trial transaction was processed. In practice the enrolment email and the seven-day reminder are the evidence that wins a 13.5 representment, which is a good reason to keep both, with timestamps, for as long as the customer is billed.

What Mastercard requires

Mastercard's rules sit in section 5.4 of its Transaction Processing Rules, with separate standards for subscription billing merchants in 5.4.1 and negative option billing merchants in 5.4.2. A subscription merchant is any business a cardholder has agreed can deliver a service, membership, physical product or digital good on an ongoing basis. A negative option billing merchant starts the relationship with a trial, free or at a nominal price, and then bills for the full product until the cardholder cancels. A trial-to-subscription business is both and has to meet both sets.

For every subscription merchant, as set out in the June 2024 edition of the rules:

• Terms at the point of card entry. Price and billing frequency must be disclosed at the same time the merchant asks for card credentials, with the rulebook's own example: You will be billed USD 9.95 per month until you cancel the subscription. A trial merchant must also state any initial charge, the trial length, and the price and frequency after it. Online, the terms must be clearly and prominently displayed on the payment and order summary pages with the cardholder's affirmative acceptance captured before the order completes. A link to another page, a message box to expand, or terms below the fold do not satisfy the rule.
• Confirmation immediately after enrolment, by email or another electronic method, with the terms and instructions for cancelling.
• A receipt for each billing. Mastercard recommends an electronic receipt for every approved authorization with the amount, the reason and cancellation instructions. For an ordinary subscription merchant this is a recommendation. It becomes a requirement once a merchant has spent four months or more in the Acquirer Chargeback Monitoring Program as an Excessive Chargeback, High Excessive Chargeback or Excessive Fraud Merchant, with monthly assessments on the acquirer if it is still missing.
• Online cancellation. An online or electronic cancellation method, or clear instructions easily accessible online, such as a Manage Subscription link on the home page.
• Reminders for infrequent billing. Where billing happens every six months or less often, an electronic reminder must go out seven to thirty days before the next billing date, with the terms, cancellation instructions and a subject line that says it is about upcoming charges, sent separately from marketing email.

Those standards exclude utilities, telecommunications, insurance premiums and payments on existing debt. For negative option billing merchants, section 5.4.2 adds a stricter second layer:

• Trial-end reminder. For digital goods or services with a trial longer than seven days, a reminder must go out three to seven days before the trial ends, saying the subscription will start unless the cardholder cancels, with the basic terms and clear cancellation instructions. The same notice is required whenever the terms change.
• Physical products: same merchant, fresh consent. Every rebill after the trial must run under the same merchant ID and merchant name as the initial transaction. Before the first authorization for the full-price product, the merchant must give the cardholder the start date, amount, payment date, the merchant name as it will appear on the statement and cancellation instructions, and obtain explicit consent. Once consented, the payment date may not be changed.
• A receipt every time. For a negative option merchant the per-billing receipt with cancellation instructions is required, not recommended, and a receipt sent after a decline must state the reason.
• Seven days' notice before revising billing terms, and confirmation of any cancellation no more than seven days after the cardholder's decision.
• Registration. Negative option merchants selling physical goods are subject to registration under section 9.4.10 of Mastercard's Security Rules and Procedures, which the acquirer handles.

The state laws that filled the federal gap

While the federal rule was being litigated, state legislatures kept moving, and most of what click-to-cancel would have required is now law for a large share of US consumers anyway. These laws follow the customer's state, so a business selling nationally is in practice held to the strictest. The changes since mid-2025:

• California, AB 2863, for contracts entered into, amended or extended on or after July 1, 2025. Express affirmative consent to the automatic renewal terms, notice of any fee change no less than seven and no more than thirty days before it takes effect, cancellation through the same medium the customer used to sign up, and an annual reminder describing the service, the charges and how to cancel. A discount or retention offer may be shown at cancellation only alongside a prominently and continuously displayed click-to-cancel button.
• Colorado, SB 25-145, effective August 6, 2025. Any subscription offered online to a Colorado consumer must provide one-step online cancellation: a method that does not obstruct or delay termination or require further action once the customer has passed a reasonable authentication step. From February 16, 2026 the definition of consumer was broadened to include businesses.
• Massachusetts, Attorney General regulations effective September 2, 2025. Pre-transaction disclosure of recurring charges, price increases and cancellation methods, cancellation in the same medium as enrolment, a reminder five to thirty days before the cancellation deadline for subscriptions longer than a month, and trial offers that state the calendar dates by which the customer must cancel and on which they will be charged.
• New York, S-3008 Part W, effective November 5, 2025. Point-of-sale disclosures before billing information is requested, notice of material changes five to thirty days ahead in the channel the customer chose, and a price increase that requires either the customer's affirmative consent or at least fourteen days after the first charge at the new price to cancel for a pro-rata refund.
• Maine, SP 650, for agreements entered into or renewed on or after January 1, 2026. Separate consent to the automatic renewal provision itself, distinct from consent to the purchase, plus clear pre-enrolment disclosure and cancellation by the same method as sign-up.
• Maryland, Chapters 204 and 205 of 2025, effective June 1, 2026. Where an offer includes a free gift or trial longer than fourteen days, notice must go out no less than three and no more than twenty-one days before the renewal takes effect, and cancellation must be cost-effective, timely and easy to use.
• Connecticut, SB 3, effective July 1, 2026. An annual renewal reminder regardless of subscription term, sent the way the service was activated; cancellation by a prominent link in the account settings, by reply email or by a displayed phone number; a voicemail with enough information to cancel processed within one business day; and the right to cancel disclosed before any retention offer.
• Arkansas, HB 1820, effective August 3, 2025, according to the auto-renewal tracker maintained by the law firm ZwillGen, largely mirrors California.

One checklist that satisfies all of it

The layers overlap heavily, so a merchant that builds to the strictest version of each requirement is compliant with the rest without separate flows. Working through the customer's journey:

1. On the payment page, above the card fields and not behind a link or a scroll, state the trial length and any trial charge, the date of the first full charge, the amount and frequency after that, and how to cancel, using Mastercard's sentence as the template.
2. Require a separate, unticked checkbox or equivalent affirmative act for the recurring terms, distinct from the purchase button and from general terms acceptance. That meets ROSCA, Visa, Mastercard and the separate-consent laws in Maine and California at once.
3. Send the enrolment email immediately, even for a free trial, with every item on Visa's list and a working cancellation link, and store the send timestamp on the customer record.
4. For a trial longer than seven days, send the reminder exactly seven days before it ends, which satisfies Mastercard's three-to-seven-day window, Visa's seven-day minimum and Maryland's three-to-twenty-one-day window at once. For annual or semi-annual plans, send a reminder seven to thirty days before each renewal with a subject line naming the charge. California and Connecticut require an annual reminder even on monthly plans, so the simplest policy is an annual reminder to everyone.
5. Put the word trial in the descriptor on the first post-trial charge, keep the merchant name identical to the one in the reminder, and never move rebills to a different MID. For physical goods on a trial, collect fresh explicit consent to the first full-price charge with its date and amount.
6. Send a receipt for every rebill with a cancellation link. Mastercard only mandates this for negative option merchants and for subscription merchants in its monitoring program, but the email costs nothing and is the best defence against a cardholder who does not recognise the charge.
7. Make cancellation one step online, in the same channel the customer signed up in, immediately after login. If you present a retention offer, put a working cancel button on the same page. Confirm every cancellation within seven days and stop delivering the moment it is received.
8. Before raising a price, send notice at least seven days ahead and no more than thirty, which fits California's and New York's windows, and for New York customers either collect consent or allow at least fourteen days after the first charge at the new price to cancel for a pro-rata refund. Treat the change as a terms change for Visa and Mastercard and send the seven-day reminder as well.

Why this matters more on a high-risk account

Every one of these rules exists because trial and subscription billing generates disputes at rates the networks would not otherwise tolerate, and every dispute a cardholder files counts against your monitoring ratios whether or not you win it. Visa's Acquirer Monitoring Program and Mastercard's Excessive Chargeback Merchant program count disputes, not losses, and Mastercard has written the link into the rulebook: a subscription merchant that spends four months in the program loses the option of skipping receipts. A merchant with an unrecognisable descriptor, no reminder and a buried cancellation link hits those thresholds first; a merchant that kept the enrolment email and the reminder wins the 13.5 disputes it does get. PayKings underwrites trial, continuity and subscription merchants and reviews the trial terms, cancellation path and rebill flow as part of underwriting, because an account set up to these standards is one an acquirer can keep open.