Maryland's New Auto-Renewal Law Has Notice Windows That Don't Match Colorado's or New York's

Every state that passes its own automatic renewal law adds a new set of numbers to track: a notice window measured in days, a threshold for what counts as a "long" trial, a definition of who counts as a "consumer." Maryland's version, SB49 and its companion HB107, took effect June 1, 2026, and it didn't reuse anyone else's numbers. The result isn't a fifth unrelated compliance project — it's a fourth set of day-counts that mostly overlaps with the three you may already be tracking, except where it doesn't, and the places it doesn't are exactly where a team that copied Colorado's or New York's build will quietly fall short.

We've tracked this pattern all year — Colorado extending its law to B2B subscriptions, Virginia stripping out its good-faith defense, Australia passing a subscription law with nine-figure penalties. Maryland's contribution to the pile isn't a scope expansion or a defense removal. It's a state writing its own version of a rule that already exists in three other places, with just enough numeric drift to break a compliance build that assumed "one state's window" was a stand-in for all of them.

What SB49 and HB107 actually require

Maryland's law is built from two companion bills that passed together: SB49, now Chapter 204, and HB107, now Chapter 205. Between them, they lay out a fairly standard set of automatic-renewal obligations — clear and conspicuous disclosure of the renewal terms before the consumer accepts, the price that applies after the initial term, and a cancellation mechanism that has to be at least as easy to use as the original sign-up method, whether that's an online link, an email option, or a phone line. None of that is unusual by 2026 standards. What's specific to Maryland is the timing math layered on top.

Neither tier is enforced through a private lawsuit. Maryland's statute treats a violation as an unfair, abusive, or deceptive trade practice under the state's existing Consumer Protection Act, which puts enforcement in the hands of the Attorney General's office rather than individual subscribers. That's a meaningfully different risk shape than Virginia, where the same kind of miss now exposes a business to $500 statutory damages per subscriber with no good-faith defense available. Maryland concentrates the risk in one enforcer with the power to seek $10,000 for a first violation and $25,000 for each one after that — smaller in per-incident dollar terms than a Virginia class of subscribers, but backed by a regulator who can investigate a pattern across your entire Maryland subscriber base at once rather than waiting for individual claims to accumulate.

The numbers that almost match, and the ones that don't

Line Maryland's windows up against what's already in force elsewhere and the picture is mostly reassuring, with two specific gaps worth building for on purpose rather than discovering later.

Sources: Cal. Bus. & Prof. Code § 17602 (AB 2863); Colo. Rev. Stat. § 6-1-732; N.Y. GBL § 527-a; Md. SB49/HB107, Chapters 204–205 of the 2025 Session Laws.

Two things stand out. First, Maryland's long-term window is a literal copy of California's — 15 to 45 days, same trigger, same "one year or longer" threshold. If your annual-renewal notice system was already built for California, it satisfies Maryland's equivalent provision without any changes. Second, Maryland's trial-notice window is a copy of New York's day-count — 3 to 21 days — but not its trigger. New York only requires that notice for trials or discounts longer than 31 days. Maryland requires it for anything longer than 14 days. A 20-day free trial is exempt in New York and covered in Maryland. If your trial-reminder logic has a hardcoded "only trials over 30 days get a notice" rule copied from a New York compliance pass, it will silently skip every Maryland subscriber on a shorter trial — not because the code is broken, but because it was built for a different state's threshold.

Colorado's window is the narrowest of the four, which is what makes it useful as a target rather than a problem: a 15-day-wide window that sits entirely inside California's and Maryland's 30-day-wide window means one send schedule can clear all three long-term-renewal rules at once, covered in the next section.

Building one notice schedule instead of four

The instinct after reading a table like the one above is to build a lookup table keyed by subscriber state — send the Colorado notice to Colorado subscribers, the Maryland notice to Maryland subscribers, and so on. That works, but it's more infrastructure than the actual math requires, because the windows aren't scattered at random. They overlap on purpose, or at least by accident in a way you can exploit.

• For any subscription with a 12-month or longer term, send the renewal notice 25 to 40 days before the renewal date. That's Colorado's exact window, and because it falls entirely inside California's and Maryland's wider 15–45 day window, the same send satisfies all three states without a state-specific branch in your notification logic. You lose nothing by using the narrower window universally — you're just choosing the strictest common floor instead of the loosest one.
• Send trial and discount-period end notices to every subscriber whose trial or discount runs longer than 14 days, not 30 or 31. New York's 31-day trigger is the one most compliance builds default to, because it was the first version of this rule teams encountered. Maryland's 14-day trigger is stricter, and since the actual notice window — 3 to 21 days before the trial ends — is identical between the two states, lowering your trigger threshold to 14 days costs you nothing in New York and closes the Maryland gap completely.
• Treat the price-increase consent flow as its own track. New York's requirement — notice 5 to 30 days before a price increase, plus affirmative consent or a pro-rated refund path — doesn't currently have a Maryland or Colorado equivalent, so it stays a New York-specific flow rather than something you can fold into the renewal-notice schedule above.
• Keep the B2B/B2C line drawn at the account level, and keep it current. Maryland, like California, Virginia, and New York, only reaches consumer transactions. Colorado reaches both as of February 2026. If you already segment notice logic by state for Colorado's B2B scope, Maryland doesn't need a similar carve-out — it stays consumer-only regardless of how your other three states are configured.

None of this requires a rules engine that grows by one branch every time a new state passes a law. It requires picking the strictest number in each category — window width and trigger threshold — and applying it everywhere, which is the same approach we recommended after Colorado's B2B expansion and Virginia's per-channel requirement, just with the actual day-counts worked out this time instead of left as a general principle.

Where this fits with what you're probably already sending

If you've already built pre-renewal reminder emails off a Stripe upcoming-invoice webhook, you have most of the plumbing this requires — a scheduled send tied to a known renewal date, with the actual charge amount and a cancellation link. What state-by-state notice laws add on top isn't a new sending mechanism, it's a timing constraint on the mechanism you already have: the notice has to land inside a specific window, not just "before the charge," and for trial-ending notices specifically, it has to fire based on a trigger threshold — trial length in days — that your existing reminder logic may not currently check at all.

The cancellation-parity requirement running through all four states — Maryland included — is also not a new build if your cancellation flow already treats "cancel" as a first-class action rather than a support-ticket fallback. The specific thing worth auditing for Maryland is whether that same one-click or one-email cancellation path is actually reachable by every enrollment channel your Maryland subscribers came through, not just the main web checkout — the same audit we walked through for Virginia's per-channel standard, applied to a state that, unlike Virginia, won't let an individual subscriber sue you over the gap, but will let the Attorney General's office find it across your entire book of Maryland accounts at once.

Maryland won't be the last state to pass its own version of this law with its own numbers attached, and treating each new one as a from-scratch project is how compliance debt accumulates one state at a time. Building to the strictest overlapping window — 25 to 40 days for long-term renewals, a 14-day trial trigger with a 3-to-21-day notice — covers what's actually in force today and most of what a fifth state is likely to require tomorrow, since new statutes tend to converge toward whatever's already working rather than inventing something stranger. And for the subscribers this doesn't reach — the ones who read every notice and still want to leave — that's the moment a real cancellation flow like CancelFlow is built to catch, compliant by default because the cancel action was never buried behind a ticket queue in the first place.

Frequently asked questions

Stop losing subscribers today

One script tag. One function call. A live cancellation flow in under 10 minutes.