California's Auto-Renewal Law Just Produced Two $7.5M Settlements — Here's the Exact Rule Most Suits Turn On

Every SaaS compliance conversation about cancellation flows this year has orbited the FTC's click-to-cancel rule — proposed, finalized, vacated, revived, argued about in court. California's own law never went through any of that theater. It just sat there, got amended in 2024, took effect in the middle of 2025, and has spent 2026 quietly generating some of the largest auto-renewal settlements on record. Two of them landed at exactly the same number: $7.5 million.

HelloFresh paid its $7.5 million to a government prosecutor — the Santa Barbara County District Attorney's office, over allegations of deceptive enrollment into auto-renewing plans. YouTube TV's $7.5 million went the other direction: a private class action, settled at roughly $92 per class member once you divide it across everyone who filed a claim. Different plaintiffs, different legal theories, same law, same order of magnitude. That's the part worth sitting with. Our earlier look at the FTC rule covers what California's Automatic Renewal Law (ARL, sometimes called CARL) actually requires on paper — express affirmative consent, same-medium cancellation, annual reminders. This one is about what's actually landing companies in court a year after those requirements took effect, and it isn't always the headline provisions.

Two plaintiffs, two very different cost structures

California's ARL can be enforced two ways, and SaaS teams tend to only plan for one of them.

The government track is episodic — a handful of high-profile actions a year, usually against large, recognizable brands, usually preceded by a consumer-complaint pattern a prosecutor's office noticed. The private track is the one that actually scales down to mid-market SaaS: a CLRA claim doesn't need a prosecutor to notice you, it needs one plaintiff who tried to cancel, hit a specific friction point, and has a law firm willing to turn that into a class. Benesch's 2026 client alert counted a dozen new ARL-related suits filed in a matter of months, on top of the two $7.5M settlements — a volume that has nothing to do with company size and everything to do with which specific pattern your flow happens to reproduce.

That breakdown is the government track's signature: the bulk of the number is a civil penalty, not money that flows back to any individual subscriber, which is exactly why the private CLRA track — where the whole point is statutory damages paid toward the class — is the one worth watching if you're not a household name.

The specific trap: an offer with no cancel button next to it

AB 2863 didn't ban retention offers. It's explicit about that — a business can present a discount, a "before you go" retention benefit, or information about what cancelling means, and doing so is not, by itself, an ARL violation. What the amended law added is a condition: that offer screen has to simultaneously display a prominently located, continuously and proximately displayed "click to cancel" link or button, so the subscriber can still finish cancelling without engaging with the offer at all.

Read that condition against how most cancellation flows are actually built, and the trap is obvious. A lot of "best practice" retention flows are explicitly sequential — show the offer, and only reveal the actual cancel button after the subscriber declines it, or clicks through a second confirmation screen, or answers a reason survey first. Under California's law as amended, that sequencing is exactly the "obstruct or delay" pattern the statute prohibits, even if the underlying offer itself would have been fine on its own.

This is worth separating from the broader dark patterns research we've covered before, which looks at usability and trust costs of manipulative cancel flows in general. California's rule is narrower and more mechanical than "don't be manipulative" — it's a specific, testable condition: is a functioning cancel control visibly present on the same screen as any offer, at every step, with nothing the subscriber has to click through first. A flow can pass a general UX dark-patterns audit and still fail this specific test, because the test isn't about tone or persuasion. It's about whether the button was there.

Why the same handful of failure points keep getting sued

ARL litigation in California runs on a pattern familiar from other test-purchase-driven consumer statutes: plaintiffs' firms, or their clients acting as test subscribers, sign up for a subscription, then attempt to cancel it and document exactly where the flow deviates from the statute. That's a cheap, repeatable investigation — no discovery required to find the fact pattern, because the flow itself is the evidence, and it's sitting live on the internet for anyone to walk through. It's the same dynamic that drives the volume of website-accessibility suits we've covered in the context of ADA accessibility claims against cancellation flows: a public-facing flow with a specific, checkable defect is a low-cost target regardless of company size, and cancellation pages get checked disproportionately often precisely because they're the page people are motivated to interact with when something's already gone wrong for them.

That's also why "we're a small SaaS company, this is a big-brand problem" doesn't hold up as a risk assessment. HelloFresh and YouTube TV are the settlements that make headlines because they're recognizable names and round numbers. The dozen newer filings Benesch tracked in 2026 aren't uniformly directed at companies of that size — CLRA doesn't require government attention or brand recognition to file, just a subscriber, a documented cancel-flow defect, and counsel willing to bring the claim.

What the audit actually checks

None of this requires rebuilding your billing stack. It requires walking your own cancellation flow the way a plaintiff's investigator would, screen by screen:

The first row is the one worth checking today, not on the next roadmap cycle. If your flow shows any kind of offer — a discount, a pause, a downgrade, even just a "here's what you'll lose" message — go look at whether a working cancel control is visible on that exact same screen, or whether someone has to get past the offer first. Our retention offer comparison and the sequencing advice in our Stripe cancellation flow guide both assume the offer is a fork in the road, not a gate — that's the version California's law now requires by name, and it happens to also be the version that saves better, because a subscriber who feels boxed in is less likely to accept an offer in good faith than one who knows they could leave for free right now.

The multi-state picture, briefly

If you've already built a compliance layer for the Colorado and New York rules or Maryland's notice windows, the good news is the offer-plus-cancel-button pattern isn't unique to California — it's close enough to what a compliant flow needs everywhere that fixing it once covers most of the map. The bad news is California is the one state in that group with a mature, well-funded private right of action actually generating settlements at this scale right now, which makes it the state where a gap in this specific pattern is most likely to turn into an actual claim rather than a theoretical risk.

A cancellation flow built around a persistent, always-visible cancel path — with any offer sitting next to it rather than in front of it — is the same design principle CancelFlow is built around by default, for reasons that started as retention math and now happen to double as the exact legal standard California settled on. That overlap isn't an accident. A flow subscribers don't feel trapped in converts better and gets sued less, and this year's settlements are a fairly expensive way to confirm which of those two facts California decided to legislate first.

Frequently asked questions

Stop losing subscribers today

One script tag. One function call. A live cancellation flow in under 10 minutes.