Magento 2 Membership and Auto-Renewal: A Compliance Checklist for US Stores

Amazon agreed to a $2.5 billion settlement over how it enrolled and retained subscribers, and the FTC says it has started five negative option cases and approved six settlements since January 2025, according to a Kirkland & Ellis summary of the FTC’s own notice. The agency also reports more than 100,000 complaints in five years about negative options and related practices.

The FTC’s 2024 click-to-cancel rule is gone. The Eighth Circuit struck it down on July 8 2025, on grounds as Cooley’s analysis explains. That did not repeal the rules that matter to a membership store: the Restore Online Shoppers’ Confidence Act (ROSCA), Section 5 of the FTC Act, and a growing set of state auto‑renewal laws. In March 2026, the FTC restarted rulemaking, so the federal picture is still moving.

This guide gives a US compliance checklist for Magento 2 membership programs, built around MageDelight’s Membership Subscription extension. This is information taken from public sources. It is not advice. The author is not a lawyer. Laws vary by state. Laws can change at any time. Before you launch, have a lawyer review your flow.

Where the Law Stands in October 2026

Five layers apply to a US membership store. The first applies nationwide, and the others add to it.

The state layer is where most new obligations sit. ZwillGen’s law firm update summarises the 2025 and 2026 changes below. This list is not exhaustive: other states, including Illinois, Oregon and Virginia, have their own rules.

The practical rule is to design for the state you sell into and then use that same flow everywhere. One single flow is easier to build, test and defend than a state-by-state maze.

Which Membership Model Do You Run?

Not every membership is a negative option. The model decides how much of the checklist applies.

What the Extension Covers, and What It Does Not Say

According to the user manual, which was last updated in August 2025, the extension allows you to:

• Create membership plans as products, each with a duration that can be in days, weeks, months or years, a price and a sort order.

• Tie each plan to a customer group and to a catalogue price rule, so members see discounted prices on the products you choose.

• Show a plans page and a plan detail page on the storefront, and a My Membership Plan section in the customer account with a My Discountable Products list.

• Send an automatic email a set number of days before a plan expires, using the Send Mail Before Days setting.

• Let admins assign a membership to a customer, and set or edit the expiry date.

• Keep only the latest plan active when a customer buys successive plans, with earlier plans expiring or closing.

The manual does not document automatic charging, a customer self-cancellation button or consent recording. MageDelight’s older product description mentioned auto-renewal through Magento’s Braintree credit card method, and its FAQ covers renewal emails and plan transfers. Confirm with MageDelight exactly what your version does before you design the flow. If you need card-on-file recurring billing, ask about Subscribe Now Pro or the customization option. The product page lists Magento 2.4.7 to 2.4.9 compatibility for Open Source, Adobe Commerce and Adobe Commerce Cloud, plus Hyvä, GraphQL and REST API compatibility and prices start at $179 for Open Source, $359 for Adobe Commerce and $459 for Cloud per year, then $119 a year for updates and support.

Prerequisites

• A staging store and a full backup before installing, as the manual advises.

• A list of every membership plan, its price, duration and whether anything charges automatically.

• Your payment method details: whether a card is stored and charged off-session, and which processor you use.

• A list of the states you sell into, and the strictest rules among them.

• A named owner for subscription compliance, plus a lawyer for sign-off.

The Eight-Step Checklist

Step 1: Classify Every Plan

Open the plan grid in Membership Subscription. Look at the model table. For each plan, mark it as fixed-term auto-renewing, trial-to-paid or price-changing. Write down how the customer pays. Also note if any charge happens without a checkout. Do this for every plan. Make sure your records are clear and match the model. This one sheet drives every later step.

Success looks like this: a one-page register that shows each plan, the model, and the rules that apply to each plan.

Step 2: Disclose the Terms Before Payment

Federal and state guidance generally treats the following as material terms for an auto-renewing plan. Confirm the list with counsel and place each item next to where the customer agrees, not in a footer.

New York has a rule that says you must show point-of-sale disclosures before asking for billing information. This can cause issues if you keep cards on file. Make sure the disclosure is shown before the payment step.

Step 3: Capture Express Consent and Keep Proof

• Use an unchecked box. Magento’s Terms and Conditions feature (Stores > Settings > Terms and Conditions, with the mode set to manual) makes the customer tick a box. Never pre-check it.

• Keep the renewal consent separate. California requires express consent. I believe the safest interpretation is that express affirmative consent must be a step, not just general terms acceptance. Please add a checkbox for the auto-renewal terms.

• Place it next to the terms. The consent text and the terms it refers to should sit together.

• Record the evidence. A 2026 merchant guide reports that California expects consent records for three years, or one year after the contract ends if longer. Store the timestamp, customer ID, order ID, consent text version, and IP address. Confirm what Magento keeps by default, and add what is missing, for example with Order Attributes or custom development.

• Re-test after any checkout change. A theme or checkout upgrade can drop the checkbox without anyone noticing.

Step 4: Send an Acknowledgment After Purchase

California-style rules require an acknowledgment that includes the renewal terms and shows how to cancel. In Magento, go to Marketing > Communications > Email. Edit the order confirmation template. Make sure the membership email includes the plan name, price, renewal date, renewal price, and a cancellation link. Keep this email in the channel that the customer used to sign up.

Step 5: Set Up Renewal Reminders and Price-Change Notices

• Use the expiry email. The extension’s Send Mail Before Days setting controls when customers are told a plan is ending.

• Pick a window that fits your states. Law-firm summaries explain that California reminders are sent 15 to 45 days before renewals and that Colorado reminders are sent 25 to 40 days before. A value near 30 days sits inside both. Confirm the windows for your states, because the extension has one setting and monthly plans may need different handling.

• Write a complete reminder. Include the renewal date, price, how to cancel and a direct link.

• Notice before price increases. California requires advance notice even if the customer agreed to increases earlier. New York requires affirmative consent or a chance to cancel within 14 days for a pro rata refund. Build a separate email for this.

• Test the timing. Create a test plan that expires in a day. Then confirm that the email arrives on the day you expect.

Step 6: Make Cancellation Easy

ROSCA needs a simple way to stop recurring charges. Many states want the cancellation to work the same as the sign‑up process. Colorado wants a single online link to cancel. The manual does not describe a customer-facing cancellation control, so check this step with particular care.

• Add a Cancel or Turn Off Renewal action in the customer account, next to My Membership Plan, reachable without calling anyone.

• Match the signup channel. If customers can join online, they must be able to leave online. If you accept phone signups, accept phone cancellations.

• Keep retention offers honest. California, Colorado and Arkansas allow a discount or retention offer only if a button that immediately cancels is shown prominently on the same page. Connecticut adds rules for phone cancellations.

• Confirm in writing. Send a cancellation email stating the end date and any refund.

• Stop the charge. Test that no renewal is charged after cancellation, including edge cases around cron timing.

• Handle admin changes. When staff edit the Membership Expiry Date or remove a customer, follow the same notice and refund rules.

• Process refunds as promised. If you offer store credit, say so clearly. MageDelight’s Store Credit extension can support that, and an RMA process can handle disputes.

Step 7: Handle Plan Changes and Stacking

According to the manual, customers may purchase plans. However, only the newest plan remains active, while all previous plans will expire or close. Please inform customers about this before they buy a plan. Also explain what happens to any time and whether it will be refunded. The FAQ states that customers can transfer plans. Verify that a plan transfer preserves the disclosures and renewal terms.

Step 8: Keep Records and Monitor

• Keep a settings log: note plan changes, note template edits, note reminder timing. Note the date of each in the settings log.

• Archive each version of the consent text, the plan page and the emails.

• Track complaints about billing and cancellation. Rising numbers are an early warning.

• Measure the flow. Use GA4 with GTM to see where customers drop off during signup and cancellation, but never hide the cancel path.

• Re-test quarterly in a private window, as a new customer, in each state you target.

• Audit your marketing claims. A digital marketing audit can check ads and landing pages against what the plan really offers.

The One-Page Compliance Checklist

Common Mistakes and Troubleshooting

• Consent inside general terms. A single "I agree" box covering everything is the pattern the new state laws target.

• A pre-ticked box. Never acceptable as express consent.

• Treating manual renewal as exempt without checking. If any stored card is ever charged automatically, the plan is a negative option.

• Phone-only cancellation for online signups. This fails the same-medium rule in several states.

• Save offers that hide the cancel button. The state rules allow offers only when cancellation stays one click away.

• Silent price increases. California and New York have specific rules for these.

• Reminders that arrive too late. Wrong timing is a failure even if an email goes out.

• Comping or admin-assigning members who later start paying. Review the terms and consent for anyone moved from free to paid.

• Backfilling consent for legacy members. Do not invent records. Re-consent customers at their next renewal where the law requires it.

Which Setup Fits Your Store

• Fixed-term memberships, manual renewal: the lightest path. Focus on disclosure, the expiry email and honest benefit claims. The membership guide covers plan design.

• Auto-renewal with a card on file: the full checklist applies. Add the consent box, proof, acknowledgment, reminders and an account-level cancel button before launch.

• Trials that convert to paid: add trial-end notices, and design for Maryland and California timing.

• Selling in California, Colorado, Massachusetts or New York: design to the strictest rules and use that flow everywhere.

• Business memberships: Colorado’s law arguably covers B2B subscriptions from February 16, 2026. ROSCA applies to online negative options, regardless of the buyer.

• Customers outside the US: this checklist does not cover other countries. Check local rules.

• Customisations or audits: if you need a cancel button, consent logging or a review of your flow, MageDelight’s Magento support service and its code quality audit can help.

For most stores, the order is: classify plans, fix disclosures and consent, add cancellation, then tune reminders. The Membership Subscription extension manages plans, groups and expiry emails. The FAQ page covers setup questions.

FAQ

Is the FTC click-to-cancel rule in force?

No. The Eighth Circuit cancelled the 2024 changes in July 2025. The FTC started a rulemaking process with an advance notice in March 2026. ROSCA, Section 5, and state laws remain in effect during this time.

Does ROSCA apply if customers renew manually?

ROSCA focuses on option features, where silence or no action is treated as agreement. A plan that renews only if the customer places a new order is usually not considered a ROSCA. You must check if any charges happen automatically using a stored card. Always keep your disclosures clear and honest.

Can I offer a discount when someone tries to cancel?

In California, Colorado and Arkansas, yes. Only if a button that immediately cancels is shown prominently on the same page. I do not want customers to talk to anyone or click through screens first.

Do I need a separate checkbox for auto-renewal?

California requires specific permission, and Maine seems to require separate permission. The best approach is a separate, unchecked box next to the renewal terms.

What are the penalties, and who enforces these rules?

The FTC enforces ROSCA and treats violations as violations of an FTC rule. State attorneys general enforce state laws, as I have seen. FTC lists a civil penalty maximum of $53,088 per violation in FTC notices, so check the figure. FTC offers redress. FTC can also seek injunctions.