The 2026 compliance guide for subscription apps: Paywalls, checkout, and cancellation

Your paywall and your cancel button look like product decisions, but in 2026, they’re also legal documents.

Teams write careful terms, link them under the paywall, and assume they’re covered. Regulators barely read the Terms page. They open the app, count the taps to subscribe and to cancel, check which button is bigger and brighter, and whether the price sits next to the button or hidden in grey text below. That’s the case against you, and it’s built entirely from screens you control.

This article draws on a webinar we hosted with Legal Nodes — a firm that helps app companies list on the App Store and Google Play and stay compliant as they scale — led by their Virtual Legal Officer, Oleh Skibiak. His summary of the current state was blunt:

This article is a practical overview, not legal advice — rules vary by country and state, and several areas below are still being decided in court. Confirm specifics with counsel for your markets.

Three payment models, three different risk profiles

There are three ways to take payment for an app subscription: in-app purchase, an external payment link, and web2app. They aren’t mutually exclusive (many apps run more than one), but each route carries a different compliance and cost profile, so it helps to look at them separately.

In-app purchase (IAP). The store collects the payment. You pay the 15–30% commission, and refunds run through Apple — you can’t issue them yourself. Your consumer-law obligations still apply to your UI and terms, but the money flow is not yours to control.

In-app with an external link. Since the Epic v. Apple ruling in the US and the DMA in the EU, apps can send users to their own checkout from inside the app — with different rules in each market. In the US, you can link out and promote external pricing in-app, but your link can’t be more prominent than Apple’s, and Apple still polices the wording. (The US position is unsettled — the Supreme Court took the Apple case in June 2026.) In the EU, you choose your billing model per storefront, but can’t run in-app purchase and external payment on the same one.

Web2app. The user buys the subscription on your website first, then enters the app already subscribed. Google is permissive here. Apple’s rule: if your app unlocks something bought on the web, it usually has to be buyable in-app too. Narrow exceptions let some apps stay web-only — mainly reader apps (streaming, news, books), plus enterprise and person-to-person services. Outside those, going web-only is a grey area at review.

How they compare on the dimensions that decide your exposure:

	In-app purchase	In-app + external link	Web2app
Store commission on the subscription	15–30%	US: unsettled (before the Supreme Court); EU: reduced but layered	None on the subscription
Who owns refunds, chargebacks, fraud	The store	You	You
Consumer-law burden on your UI and terms	Yours	Yours	Yours
Main constraint	Store owns the payment and refund flow	Link can’t outrank Apple’s, wording policed; EU per-storefront entitlement	Apple multiplatform rules; case-by-case review

Moving off IAP removes the commission, not consumer law — it concentrates it. With no store in the middle absorbing refunds and disputes, the obligations that always sat on your interface become the whole game.

What changes legally when you move app payments to the web?

Selling on the web sidesteps the store rules entirely: no commission on the subscription, no link-out or entitlement restrictions to manage. For a low-ARPU app, keeping that 15–30% is real margin.

In exchange, the moment you collect payments yourself, four responsibilities move onto you in full:

1. Refunds. You process refund requests directly — an upside as much as a burden, since owning the process gives you control the store never did.
2. Chargebacks and fraud. These become your liability. This is where payment infrastructure earns its place — multi-provider routing, tokenization for billing continuity, and dispute tooling keep this from eating your revenue once the store is no longer handling it.
3. Sales tax and VAT. You need to know what you owe and where: state-by-state sales tax rules in the US, VAT rules that differ by country in the EU.
4. Proof of consent. You have to be able to show, per user, that they agreed to the specific terms — price, billing frequency, renewal. Not a generic terms checkbox, but retrievable evidence tied to the individual.

So web2app doesn’t escape compliance obligations; it owns them — an advantage if you build the flow deliberately, a liability if you treat the web checkout as a lighter version of the store’s.

One distinction to hold onto: payment orchestration and merchant-of-record setups change who processes the payment and who faces the card networks. Neither changes who the trader is. That follows from your contract with the customer, and you can’t outsource it.

What you can hand off is the operational side, and it’s where FunnelFox Payments comes in — subscription billing, payment routing, disputes management, and revenue recovery, all in one platform.

What does a subscription paywall have to disclose?

Whatever the market, the paywall has to show the same core facts at the point of purchase — not behind a linked terms page: the price, the billing frequency, the first charge date, any trial terms, and how to cancel.

In the US, that comes from ROSCA (clear disclosure and informed consent); in the EU, from Article 6 of the Consumer Rights Directive, which puts price, billing frequency, and cancellation terms on the screen itself. Split the post-trial price and the first charge date across separate pages, and you’re exposed under both.

The rule of thumb: price, first charge date, and consent in one place, on the screen where the user commits. If any of the three is a tap away, fix that first.

Is click-to-cancel still required in the US in 2026?

Short version: the rule is gone, the obligations aren’t.

The FTC’s “click-to-cancel” rule was vacated in 2025. But an older law — ROSCA, the Restore Online Shoppers’ Confidence Act — still requires the same things: clear disclosure, express informed consent, and a simple way to cancel. So the requirements still bind. The timeline:

• October 2024 — the FTC finalized the Negative Option Rule, the “click-to-cancel” rule, built on four requirements.
• July 2025 — the Eighth Circuit vacated the entire rule on procedural grounds.
• March 2026 — the FTC reopened the rulemaking.

ROSCA predates all of it, so the four requirements are still the design target:

• No misrepresentation of the subscription or how to cancel.
• Disclose the price, billing date, trial terms, and how to cancel — before you take payment.
• Get explicit consent that the user understood the terms.
• Make cancelling as simple as signing up.

And enforcement never paused. The FTC keeps bringing these cases under ROSCA and Section 5 of the FTC Act, neither of which the vacatur touched. Shutterstock paid $35 million in May 2026 for hidden terms, uninformed consent, and a cancellation the FTC called difficult. California district attorneys hit HelloFresh for $7.5 million in August 2025, with the FTC never involved. Noom settled a private class action for $56 million. The rule is gone; the obligations are enforced anyway.

On top of the federal floor sit the states:

• California — the strictest. Renewal reminders on set timing, and a trial longer than 31 days triggers one; that’s why so many trials run exactly 30 days.
• New York (since November 2025) — a price increase needs the user’s consent, not just an email.
• Colorado (since February 2026) — consumer protections now cover businesses too, so more parties can sue.

Cities are moving too: New York City passed its own click-to-cancel rule, effective October 1, 2026. With ~30 states now running auto-renewal laws on top of ROSCA, the takeaway holds — build to California and the federal floor, and you cover most of the country. Just treat the state and city layer as a moving target.

What makes a subscription cancellation flow compliant?

Start with one rule: leaving has to be as easy as joining. Count the taps — if signup takes three, so should cancellation. No maze of “are you sure?” screens, no required phone call, and the cancel option never greyed out or buried. In the EU, manipulative design is a violation in itself under the Unfair Commercial Practices Directive — a countdown timer that resets, a pre-checked priciest plan, or a cancel button that fades beside a bright “Continue.”

Amazon is the cautionary tale. Its Prime cancellation — internally nicknamed the “Iliad flow” — took a click or two to join and six across four pages to leave. Three executives were named personally in the FTC case, and what put them there wasn’t the interface: internal messages showed the fix was known and postponed because clarity would hurt the numbers. The lesson — a bad flow plus a written record that you knew it is what becomes personal liability. And the evidence is trivial: a screen recording on a clean device is the whole exhibit.

Then add whatever your users’ regions require on top of that baseline:

• EU users — they also get a 14-day withdrawal right (Consumer Rights Directive, Art. 11a): a way to get their money back within 14 days of signup, separate from cancelling going forward. Waivable only if the service was fully delivered and they explicitly consented. And if a free trial converts to paid, show the exact price and first-charge date up front — otherwise that right reopens at conversion for everyone who saw the vague screen.
• German users — include a dedicated cancel button in the app — the Kündigungsbutton (§ 312k BGB) — even for memberships that don’t auto-renew. Courts there have struck down flows that bury it behind extra clicks and grey text.
• French users — cancellation must mirror signup step for step (Consumer Code, Art. L215-1-1): three taps in, three taps out.
• US users — cancellation must work online wherever signup was online.

One more design call: a frictionless cancel button is a conversion cost, but the fix isn’t friction. Offer real alternatives beside the exit — a pause, a cheaper plan, a free extension — with the cancel option at the same visual weight, never greyed out or buried. Retention offers themselves are fine — the ban people assume exists was never in the final rule; what regulators look at is whether the cancel option stays as visible as the offers.

Which country’s consumer law applies to your app subscriptions?

The one where your users are — not where your company is registered. Incorporating somewhere convenient doesn’t move disputes onto friendlier ground. If anything, it backfires:

Having several entities is normal. What drew the FTC in a June 2026 case was using them to hide — the company kept spinning up new companies and merchant accounts to dodge fraud checks and move money abroad. Those apps were live on the stores the whole time, too: App Review is an operational filter, and clearing it says nothing about whether you’re compliant.

Don’t count on a single regulator, either. In the US, action can come from the FTC, from state prosecutors, or from private class actions. In the EU, the Consumer Protection Cooperation network lets several countries move against you together. These routes are independent — settling with one closes none of the others. Exposure scales with the number of markets you bill into, not with the size of your company.

Is your subscription flow exposed? A seven-point check

Not a score — just seven places regulators keep looking. If none is true of your flow, it’s defensible today.

• US + EU — the post-trial price and first charge date aren’t both on the sign-up screen → fails CRD Article 6 and ROSCA disclosure, and reopens the EU withdrawal right at conversion.
• US + EU — consent to auto-renewal isn’t collected separately from consent to purchase → the unauthorised-charge allegation, and the first document a regulator asks for.
• US + EU — you can’t retrieve what a named user agreed to 18 months ago → no defence when a complaint lands; California requires three years of records.
• US + EU — leaving is harder than joining, with more steps or a retention screen you can’t skip → the central allegation in every major cancellation case.
• US — you built to the federal floor, not the strictest state you bill into → California, New York, and Colorado each add rules the floor doesn’t.
• EU — you haven’t checked whether the withdrawal right was validly waived → you don’t know if you owe a 14-day refund function (in force since June 2026).
• Web funnel — you never held your web checkout to the same standard as an in-app paywall → no store sheet in front, no store record behind; every duty lands on your screen.

How to make a compliant subscription flow?

1. Put the price, the first charge date, and the consent in one place. Everything the user needs to understand what they’re committing to belongs on the screen where they commit, including retrievable proof that they agreed.
2. Count the taps in both directions. If signup takes three steps, cancellation should take three. Map both flows and compare them literally.
3. Work out which exits you owe. Withdrawal (EU), termination (Germany), and cancellation (US) can apply at the same time, and only withdrawal can be switched off. Map it to where your users actually are.
4. Keep proof of consent, per user, and make it retrievable. A technical requirement you build once. Not being able to produce it is exposure on its own.
5. Decide the model before the market. In-app, in-app with a link-out, or web2app changes your entire compliance surface. Decide first — web2app gives you the most control over monetization and cancellation, and the most responsibility for both.

The bottom line

The purchase and cancellation flow is no longer a product decision with a legal footnote — it’s a legal document that happens to be rendered as UI. The fines, refunds, and multi-state actions come from your own paywall and your own cancel button — the disclosures you show, the consent you can prove, and whether the exit is as easy as the entrance.

The teams that get this right design the entrance and the exit together — disclosed, symmetric, with the record to prove it. It lives in the flows you already control.