The legal side of the paywall: subscriptions and cancellation in 2026
Every screen on which a user takes out or cancels a subscription is a moment when a contract is formed or ended. That is why, in recent high-profile cases, regulators increasingly assessed not the terms text but the screens themselves: how many actions it takes to cancel; how visible the price is next to the button; and even the team’s internal correspondence about why the inconvenient exit was left as it is. For a subscription business this means a shift in perspective: the payment screen (the paywall) and the cancellation process must be designed with the same legal care as the text of a contract. Below, in brief: what regulators actually punish, and what to check in your own product this week.
First, identify your model — it decides half of your risk
The legal picture depends on exactly how the user pays. There are three models.
| Model | How it works | Primary risk-bearer |
|---|---|---|
| In-app purchase | Payment through the app store | Store rules + consumer law |
| In-app redirect | The app leads to your own payment page | You: that payment screen is your paywall |
| Web funnel (web2app) | Subscription on the website, then sign-in to the app | You entirely: the whole consumer-law layer |
One thing is common to all three: the platform may take on part of the store-related risk — its own rules and part of the mandatory disclosure to the user — but no model removes consumer law. A web funnel makes you least dependent on store rules, but you pay for that with the full weight of responsibility: there is no intermediate store screen with the terms before payment, and no store-held confirmation of consent after it. All disclosure, consent and the cancellation mechanism sit entirely on your side.
What the paywall must say and how the exit must work
US: the headline rule was struck down, but the obligations remain
The federal “click-to-cancel” rule was vacated by a court on procedural grounds, and the regulator has begun fresh rulemaking. But it is a mistake to think the requirements have gone: the Restore Online Shoppers’ Confidence Act (ROSCA) remains in force, and regulators continue to bring cases under it. It rests on four requirements:
- do not mislead the consumer about material facts — about the product itself as well as the subscription;
- before you take billing information, clearly show that payment will recur until cancellation, in what amount, on what terms the trial runs, and how to cancel — and show this next to the consent, not somewhere else;
- obtain separate, informed consent to the subscription before the first charge, and keep proof of it in a retrievable form;
- make cancellation at least as simple as sign-up, and through the same channel.
Federal requirements are the necessary minimum, on top of which the states add their own rules. So you should build to the most demanding market among those where you have paying users: if the flow holds up there, it passes the simpler markets automatically. Some require separate consent to a price increase with a right to a refund; some require one-step online cancellation where sign-up also happened online; and some rules reach even business subscriptions. In the strictest states, proof of consent must be kept for years — around three is the benchmark.
EU: the price and terms belong on the payment screen, not behind a link
Under Article 6 of the Consumer Rights Directive (2011/83/EU), the price, billing frequency and cancellation conditions must be on the same screen where the user taps “Subscribe” or “Start free trial”, rather than hidden behind a link to a separate “Terms” page. A simple guide: if, to see the price and renewal terms, the user has to scroll the purchase screen or leave it, the requirement is most likely already breached. Terms written in tiny grey text under the button are treated by the law as merely formal: they are present, but not conspicuous — and conspicuousness is exactly the point.
The Unfair Commercial Practices Directive separately prohibits “dark patterns”: countdown timers that reset by themselves; the most expensive plan pre-selected; cancellation driven through several “are you sure?” screens; a barely visible opt-out button next to a bright “Continue”. Here the design itself becomes the object of assessment — button prominence and step count, not just the wording.
In the EU it is easy to underestimate the “exit”: in fact it is not one action but three separate consumer rights, and they are not interchangeable. First — the right to withdraw from the contract within 14 days. Second — to terminate the contract (in some countries this requires a dedicated cancellation button). Third — to cancel the subscription going forward. A single “Cancel” button in settings may not cover all three. Case law has already set the bar: courts count the clicks, assess contrast and menu-nesting depth, and if the trial terms were disclosed carelessly, the right of withdrawal can revive at the very moment of the first charge.
Download the full paywall review checklist (PDF)
What regulators actually punish
In such cases regulators assess, above all, the flow itself rather than the terms text: how many steps and screens must be gone through, where the buttons sit and what their contrast is. A telling example is one of the most high-profile cases, where taking out a subscription took mere seconds while cancelling led the user through a string of unnecessary screens. But the decisive evidence there was not even the design of the interface, but the company’s internal correspondence: from the employees’ messages it was clear that the inconvenient cancellation was known about and deliberately not fixed. It was precisely these written traces that led to executives being held personally liable. The main takeaway is simple: the greatest risk comes not from an imperfect flow in itself, but from its combination with evidence that the company understood everything and changed nothing.
There are at least four channels through which liability can arrive, and each acts independently: the federal regulator; state and county prosecutors, who need no involvement from the federal body; private class actions; and coordinated action by EU consumer regulators, as well as separate proceedings under European digital-services law. Settlement figures in such cases have ranged from millions to billions of dollars, and the maximum penalties in the EU are calculated as a percentage of turnover. Settling with one channel does not close the others. And the evidence here lies on the surface: anyone — from a dissatisfied user to a competitor — can run through your flow and record it on a phone screen.
Jurisdiction: what matters is where the consumer is, not where you are registered
Consumer-protection duties arise where the consumer is, not where your company is registered or which legal entity processes the payments. Passing review in the app store guarantees nothing — it is an operational check, not a legal one. In the EU, the Consumer Protection Cooperation Regulation (EU) 2017/2394 allows countries to coordinate their action, but each assesses the situation under its own law. Hence a simple logic: the extent of your liability is determined not by turnover or company size, but by the number of countries and states whose consumers you sell to.
An important nuance for businesses with foreign structures: an international structure in itself — say, a foreign company plus a separate entity for payments — is not a violation. Many entirely legitimate product teams operate this way. In the relevant cases, regulators allege not the structure but its purpose and pattern: concealing real control over the business, evading oversight by payment systems, and deliberately misleading the user. The difference lies in the actual conduct, not in the scheme on paper.
What to fix first
- Check the visibility of the price. Open your own paywall and, without scrolling anything, try to find the amount after the trial and the date of the first charge. Not visible straight away — that is the first thing to fix.
- Compare the way in and the way out. Go through sign-up and cancellation yourself and count the actions in both directions. If leaving is noticeably harder than subscribing, record exactly where the gap is.
- Work out which exits you are obliged to provide. It varies by market: somewhere it is one-step online cancellation, in the EU it is also the 14-day right of withdrawal, unless you validly dealt with it at the outset.
- Make sure consent can be retrieved. Take a user who subscribed eighteen months ago: can you reproduce what they saw and agreed to then, and for how long are you required to keep it?
- Choose the model, and only then the markets. It is the payment model that determines whose rules apply to you, so that decision is taken first.
The general rule: treat the purchase and cancellation flow as scrupulously as the text of a contract, and check it step by step before launch. Re-reading the terms alone would not have caught any of the problems described.
How Dextra Law helps subscription businesses
We work with product and subscription companies precisely at the intersection of law and interface — where the real risk sits today. Dextra Law:
- reviews the paywall and cancellation flow step by step — disclosure, consent, step count, contrast, button wording — and gives you a list of what to fix first;
- maps the jurisdictions for your markets: ROSCA and US state requirements, EU directives, the local rules of individual countries — instead of a “universal” flow that in fact passes nowhere;
- works through your payment model and the obligations that come with it — including the trader role and the merchant-of-record role;
- builds a consent-evidence system and retention periods, so you have something to show the moment a regulator asks;
- supports the business structure so that foreign elements serve legitimate operating purposes.
Instead of learning about a defect in the flow from a complaint or a lawsuit, you get its map in advance — and a clear order of action: what to fix in which market.
Frequently asked questions
No. “Click-to-cancel” was a US federal rule that required making the cancellation of a subscription as simple as sign-up. A court struck it down over a flaw in the adoption procedure, not because it found the requirement itself unnecessary. Besides, a separate US law (ROSCA) already obliges you to disclose terms honestly and provide simple cancellation, and regulators fine for it. And some states, such as California, set even stricter rules. So nothing has become easier for business.
Yes. What matters is not where the company is registered, but where the consumer is. If your subscriptions are bought by users in the US or EU, you must comply with their consumer-protection rules.
No. Regulators look not only at the texts but at the process itself: what the user sees on the payment screen, how many steps it takes to cancel a subscription, how visible the price and the opt-out button are. Flawless terms in a contract do not help if the screen itself misleads the person.
If messages, tracker tickets or presentations show that the team knew about the inconvenient cancellation but decided to leave it alone, that becomes evidence of intent. It is precisely such internal documents that, in high-profile cases, led to personal liability for executives — even more than the interface itself.
Open your own payment page on a phone and check two things. First: is the price after the trial and the charge date visible straight away, without scrolling. Second: go through sign-up and cancellation yourself and compare how much harder it is to leave than to subscribe. It is the fastest and cheapest risk check there is.
Need an audit of your paywall and cancellation flow?
The Dextra Law team will check your subscription flow against the requirements of the markets you sell to, map the risks and give you an order of fixes — from the paywall screen to the consent-evidence system. Contact us to run this check before a regulator does.
This material is for information only and is not legal advice.
