Picture your own signup flow from the customer's side. They click your ad, enter their card, and start a free trial. Fourteen days later the first charge lands — and somewhere in that chain, did they ever clearly agree to be billed, or did the billing just happen because they never said stop? If you cannot point to the exact screen where they gave express consent, and to the one-click path where they could have cancelled, your business has the same exposure that cost the country's largest online retailer $2.5 billion.
In September 2025, Amazon agreed to pay $2.5 billion — a $1 billion civil penalty plus up to $1.5 billion in consumer refunds — to resolve Federal Trade Commission charges that it enrolled shoppers in Prime through confusing checkout flows and then made cancellation deliberately hard. The law behind that settlement is the Restore Online Shoppers' Confidence Act, or ROSCA, and it applies to every online seller with a recurring charge, not just giants. This post covers what ROSCA requires of your signup and cancellation flows, why the end of the FTC's click-to-cancel rule changes nothing about those duties, and how to book signups, renewals, cancellations, and refunds so your revenue ledger agrees with what your customers actually consented to pay.
The $2.5 billion lesson in one paragraph
The FTC's case, filed in 2023, alleged two things about Prime: enrollment flows that pushed shoppers into a paid subscription without clear consent, and a cancellation process designed to discourage people from finishing it — multiple retention screens, confusing choices, friction at every step. The September 2025 settlement split the $2.5 billion into a $1 billion civil penalty, which punishes the past, and up to $1.5 billion in redress, which repays the customers. That structure is the part small subscription sellers should study: when consent was never properly obtained, the revenue was never really yours. The enforcer's remedy is to give it back, with interest in the form of a penalty.
Note what the settlement does not say. It does not say subscriptions are suspect, free trials are illegal, or retention offers are banned. It says the signup must be honest and the exit must be easy. Both of those are bookkeeping problems as much as legal ones, because every consenting subscriber creates deferred revenue and every cancelling one creates either a refund or an earned-revenue event. Get the flows right and the ledger mostly writes itself; get them wrong and no journal entry fixes it.
ROSCA's three duties apply to your checkout today
ROSCA, 15 U.S.C. § 8403, has governed online negative-option billing since 2010. A "negative option" is any arrangement where the customer's silence means "keep charging me" — auto-renewing subscriptions, free trials that convert to paid plans, and continuity shipments all qualify. Before you charge a customer through one, the statute requires three things:
1. Clear and conspicuous disclosure of all material terms before you take the billing information. Price, billing frequency, trial length and what happens when it ends, how to cancel, and the amount of the first post-trial charge must all appear before the card form — not below it, not behind a tooltip, and not only in the terms of service. "Clearly and conspicuously" means unavoidable in the ordinary flow: same screen, readable type, no pre-checked boxes carrying terms nobody reads.
2. The customer's express informed consent before you charge. The buyer must actively agree to the recurring charge — a checked box they check themselves, an "I agree to be billed $X monthly" button, something affirmative and specific. A pre-checked box is not consent. A general "I accept the terms" checkbox that also covers the privacy policy, the EULA, and the recurring charge is weak consent at best. Each subscription needs its own unambiguous yes.
3. A simple mechanism to stop the recurring charges. Cancellation must be simple — generally understood as no harder than signing up. If enrollment took two clicks online, a cancel flow that requires a phone call during business hours, a chat with a retention specialist, or a six-screen obstacle course fails the test. The mechanism must also actually work: a cancel button that errors out, or a confirmation email that never arrives, is the same as no button at all.
These duties sit on top of state auto-renewal laws — California's is the strictest and most-copied — which add their own disclosure, consent, reminder, and cancel requirements. Complying with ROSCA gets you most of the way there, but check the states where your customers live.
Click-to-cancel died; ROSCA did not
You may have followed the FTC's 2024 "click-to-cancel" rule, which would have spelled out exactly how simple cancellation must be. On July 8, 2025, the Eighth Circuit vacated that rule in full on procedural grounds, days before its main provisions took effect. In February 2026 the FTC restored the pre-2024 Negative Option Rule, which covers only old-style prenotification plans, and opened a new rulemaking that, as of this writing, has produced no replacement.
None of that touches ROSCA, because ROSCA is a statute passed by Congress, not an FTC rule. The Amazon settlement itself was built substantially on ROSCA and Section 5 of the FTC Act — proof that the agency needs no click-to-cancel rule to bring a $2.5 billion case. If your compliance plan was "wait and see what the final rule requires," stop waiting: the three duties above are the law now, they were the law when the conduct in the Amazon case occurred, and the settlement shows what violating them costs.
From consent to ledger: booking the subscriber lifecycle
Here is where the legal duties turn into debits and credits. Under ASC 606, cash collected before you deliver service is not revenue — it is a contract liability, usually called deferred revenue. You earn it month by month as you provide access. A cancellation then resolves the leftover liability one of two ways, depending on what your terms promise:
- Refund owed: the unearned balance goes back to the customer. Debit deferred revenue, credit cash (or a refund payable). No revenue is recognized on the refunded portion — it was never earned.
- No refund owed: your obligation ends at cancellation, so the remaining deferred balance is earned at that moment. Debit deferred revenue, credit revenue. The common error is leaving it parked in the liability account forever, which understates revenue and overstates what you owe.
Both treatments assume you know, per subscriber, how much is earned versus unearned at any date. That means your billing system and your books must agree on three timestamps: when consent and payment happened, when service started and stopped, and when the refund (if any) went out. The consent record and the cancellation record are therefore accounting source documents, not just legal paperwork — they are what ties each journal entry to a real customer event.
A concrete example makes this tangible. Suppose a customer buys a $1,200 annual plan on February 1, you recognize revenue monthly, and they cancel March 15 under a prorated-refund policy. The ledger entries look like this:
2026-01-01 open Assets:Checking USD
2026-01-01 open Liabilities:Deferred-Revenue:Subscriptions USD
2026-01-01 open Income:Subscriptions USD
2026-02-01 * "Annual plan collected — service not yet delivered"
Assets:Checking 1200.00 USD
Liabilities:Deferred-Revenue:Subscriptions
2026-02-28 * "February revenue earned (1 of 12 months)"
Liabilities:Deferred-Revenue:Subscriptions 100.00 USD
Income:Subscriptions -100.00 USD
2026-03-15 * "Mid-cycle cancel — prorated refund for unused months"
Liabilities:Deferred-Revenue:Subscriptions 950.00 USD
Assets:Checking -950.00 USD
2026-03-15 * "Earned portion through cancel date"
Liabilities:Deferred-Revenue:Subscriptions 150.00 USD
Income:Subscriptions -150.00 USDWalk through it: the $1,200 lands in deferred revenue, not income, because on February 1 you owe a year of service. February earns $100. At cancellation on March 15, the customer has used about a month and a half ($150 earned) and is owed the remaining $950, which leaves deferred revenue at exactly zero. If your terms instead said "no refunds on annual plans," the March 15 entries would collapse into one: debit the full $1,100 remaining liability to income, because your obligation ended. If you keep your books in plain text, the Beancount documentation walks through deferred-revenue patterns like this in more depth.
Three related items deserve their own accounts rather than being netted into subscription income. Chargebacks reverse the original collection and usually add a dispute fee: book the fee to a processing-cost expense so you can see what involuntary churn costs you. Trial conversions should record the consent date, not just the first charge date, so a customer who disputes "I never agreed to this" meets a timestamped record instead of your memory. And sales tax or VAT collected on subscriptions is never revenue — it passes through a tax-payable liability — which matters more each year as states expand taxability of digital products.
The five bookkeeping mistakes that echo the Amazon allegations
Each of these has shown up in real subscription ledgers, and each maps uncomfortably onto something the FTC alleged about Prime's flows:
1. Recording renewals as revenue on the charge date. Charging the card is a cash event, not an earning event. If you book twelve months of revenue the day the annual renewal bills, your income statement shows money you would have to refund if the customer cancelled the next day — which, under ROSCA, they have every right to do simply. Recognize ratably as service is delivered.
2. Making cancellation hard to avoid booking refunds. This is the dark-pattern-to-ledger pipeline: a retention maze that "saves" subscribers also suppresses legitimate refund liabilities, so deferred revenue stays overstated and churn stays understated. When the maze eventually comes down — voluntarily or by enforcement — the refunds hit all at once. Simple cancellation keeps both the lawyers and the balance sheet calm.
3. Netting refunds against revenue instead of reversing them. Recording a $950 refund as negative cash with no corresponding deferred-revenue entry, or burying it in an expense account, breaks the audit trail between the customer's cancellation and your books. Refunds of unearned amounts reduce the liability; refunds of already-recognized revenue reverse revenue through a refund liability. Either way, the entry should reference the cancellation event.
4. No per-subscriber earned/unearned schedule. If you cannot produce, for any customer on any date, the split between earned and unearned balances, you cannot process a mid-cycle cancel correctly, respond to a chargeback with evidence, or prove your deferred revenue balance to an auditor or lender. A monthly schedule — opening liability, new collections, revenue earned, refunds paid, closing liability — is the minimum viable control.
5. Keeping consent records where accounting cannot reach them. The checkbox log lives in the web app, the billing history in the payment processor, and the books in a third system, and nobody reconciles the three. At minimum, reconcile monthly: new deferred-revenue postings should tie to new collections in the processor, and refunds paid should tie to cancellation events. The month those stop tying is the month something — fraud, a broken webhook, or a cancel button that quietly stopped working — started costing you money.
Audit your flows and your books this week
Start on the customer side. Sign up for your own product in a private browser window and screenshot every screen: is the price, frequency, and trial-to-paid conversion disclosed before the card form? Is there an affirmative, subscription-specific consent action? Then cancel the same way a customer would, counting clicks and screens, and confirm the confirmation arrives. Fix pre-checked boxes, buried terms, and retention gauntlets before an enforcer — or a chargeback analyst — shops you first.
Then open the ledger. Confirm every prepaid plan sits in deferred revenue until earned, pull the per-subscriber schedule for three recently cancelled accounts and verify the liabilities cleared to zero, and reconcile last month's new collections and refunds against the payment processor. The businesses that survive ROSCA scrutiny are not the ones with the cleverest retention flows; they are the ones whose books could prove, customer by customer, that every dollar of recognized revenue was consented to, earned, and still theirs to keep.
