FTC & State AG

CFPB Seeking to Make its Mark on Subscription and Auto-Renewal Practices

Published: Jan. 30, 2023

The Consumer Financial Protection Bureau (“CFPB”) has kicked off 2023 by releasing a Circular on unlawful negative option marketing practices with a particular eye towards dark patterns. The guidance warns covered entities and service providers that activities related to negative option programs may violate the Consumer Financial Protection Act (“CFPA”)’s prohibition on unfair, deceptive, or abusive acts or practices where sellers:

  • misrepresent or fail to clearly and conspicuously disclose the material terms of a negative option program;
  • fail to obtain consumers’ informed consent; or
  • mislead consumers who want to cancel, place unreasonable barriers to cancellation, or fail to honor cancellation requests that comply with the seller’s promised cancellation procedures.

A “negative option” refers to terms or conditions under which sellers interpret consumers’ silence or failure to take affirmative action to reject or cancel a product or service as acceptance of the offer. For example, these may include auto-renewal services, continuity plans, and free-to-pay conversions.

Last year, the CFPB brought two enforcement actions in this area. In April, the CFPB filed a complaint against TransUnion LLC, alleging that the company used dark patterns that caused consumers seeking free credit scores to unknowingly sign up for a credit monitoring service with recurring monthly charges. Later in the year, the CFPB filed a complaint against ACTIVE Network for allegedly failing to disclose that consumers were enrolling in an annual subscription discount club when they tried to sign up for fundraising road races and other events.

In its recent guidance, the CFPB emphasizes three areas where covered persons and service providers—namely, those that provide consumer financial products or services for personal, family, or household purposes (e.g., extending credit; offering stored value or payment instruments, engaging in deposit-taking activities; providing payment or financial data processing)—must avoid deceptive acts or practices: disclosure, consent, and cancellations.


According to the guidance, covered persons and service providers must clearly, conspicuously, and accurately disclose the material terms of the offer, which typically include: (1) that the consumer is enrolling in and will be charged for the product or service; (2) the amount (or range of amounts) that the consumer will be charged; (3) that charges will be on a recurring basis unless the consumer takes affirmative steps to cancel the product or service; and (4) that, in a trial marketing plan, charges will begin (or increase) after the trial period unless the consumer takes affirmative action.

The CFPB has previously enforced the CFPA against consumer reporting agencies for allegedly deceiving consumers into believing their credit-related products were “free” when consumers who signed up for a “free” trial were automatically enrolled in a subscription program with a recurring monthly fee. The disclosures there were in fine print, low contrast, generally placed in a less prominent location (e.g., bottom of the web page), and grouped with other disclosures.


The CFPB emphasizes that regulated sellers must obtain a consumer’s informed consent before charging them. According to the guidance, consent should not be considered “informed” if the seller “mischaracterizes or conceals the negative option feature, provides contradictory or misleading information, or otherwise interferes with the consumer’s understanding of the agreement.”

Previously, the CFPB found that credit card issuers engaged in deceptive practices when they falsely represented to consumers that they were agreeing to receive information about an add-on product rather than purchasing the product. Additionally, the CFPB found that a debt relief company engaged in unfair practices by charging consumers on an automatic, recurring basis where the recurring charges were not clearly explained or disclosed to consumers at the time of purchase.


With respect to cancellation, the CFPB notes that regulated sellers must be careful about the representations they make regarding cancellations. For instance, the guidance cites prior enforcement against a credit card issuer alleging that their representation that consumers could cancel an add-on product “immediately” and with “no questions asked” was deceptive when, in reality, consumers were directed to sales representatives who repeatedly rebut requests to cancel.

Additionally, the CFPB warns that erecting unreasonable barriers to cancellation and failing to honor cancellation requests that comply with the advertised procedures also violates the law. For instance, the CFPB threatens action against sellers who hang up on consumers who call to cancel, place them on hold for an unreasonably long time, provide false information about how to cancel, or misrepresent the reasons for delays when processing cancellation requests.


The CFPB’s guidance on potential pitfalls in negative option sales and marketing is in line with the general landscape of regulations for companies that sell auto-renewing subscriptions. Disclosure, consent, and cancellation are critical pillars in the compliance obligations under Section 5 of the FTC Act, the Restore Online Shoppers’ Confidence Act, the patchwork of state laws governing auto-renewing subscriptions and continuous service agreements, and rules imposed by credit card processors. The CFPB even emphasized that its approach to this topic aligns with the Federal Trade Commission’s (as announced in the FTC’s 2021 policy statement on negative options and 2022 staff report on dark patterns and reflected in its numerous enforcements, including the recently finalized consent order against Credit Karma). But the CFPB’s attention to these issues means that there is another “cop on the beat” and for covered entities and service providers, it will be particularly important to heed the CFPB’s recent guidance and, where applicable, implement processes to comply with the relevant obligations under the Electronic Fund Transfer Act (“EFTA”) and Regulation E.