Colorado Just Extended Click-to-Cancel to B2B SaaS — And New York Added a Price-Increase Rule

Every cancellation-compliance piece we've written this year — our coverage of the FTC's click-to-cancel rule and the EU's withdrawal button included — shares one quiet assumption: these laws protect consumers, not businesses. If your product sells to other companies, that's been a reasonable place to file the whole topic under "not mine." Colorado just made that assumption wrong for a meaningful slice of B2B SaaS, and almost nobody writing about cancellation-flow compliance has caught up to it yet.

That's the part that makes this more than a curiosity for compliance nerds. A self-serve B2B SaaS product isn't a business selling to a legal entity in any meaningful procurement sense — it's a person with a corporate card, signing up the same way a consumer signs up for a streaming service. Colorado's legislature apparently agreed, and rewrote its auto-renewal statute so the label on the buyer's invoice no longer determines whether the cancellation rules apply.

Why every other cancellation law stopped at the consumer line

Until this year, the pattern across every framework worth tracking was consistent enough that you could treat "B2B" as a blanket exemption. The FTC's Negative Option Rule and the underlying ROSCA statute govern "consumer" negative-option sales. California's CARL, even after last year's AB 2863 amendments, protects "consumers" as defined by the state's consumer protection code. The EU's withdrawal-button rule under Directive 2023/2673 is explicit that it only reaches contracts with a natural person acting outside their trade or profession — a two-person startup buying on a business account is outside its scope entirely, as we covered when that rule took effect in June.

Colorado is the outlier in that table, and it's worth sitting with why. Every other rule was written to fix a specific consumer-harm story — someone signing up for a gym membership or a streaming trial and then getting stuck in a cancellation maze. Colorado's amendment instead targeted the mechanism itself: a subscription sold and renewed through an online, self-serve interface, regardless of who's on the other end of the transaction. That framing happens to describe most of modern B2B SaaS.

More than 30 states now have some version of an auto-renewal statute on the books. Almost all of them still draw the same consumer-only line the FTC and California do. Colorado is currently the only one that's actually crossed it — which matters less because of how many states have followed so far, and more because it establishes that a state legislature is willing to write "any purpose" instead of "personal, family, or household purposes" into a cancellation law. Once one state proves that's politically viable, it stops being a one-off.

What Colorado's SB25-145 actually requires

Colorado has had an unusually strict auto-renewal law since it first took effect on January 1, 2022 — it was already the first state to require renewal notices for monthly subscriptions, not just annual ones, sending a reminder 25 to 40 days before any renewal that would push the contract past a 12-month interval. SB25-145, the Online Cancellation of Automatic Renewal Contracts Act, layered a new requirement on top: a one-step online cancellation mechanism, effective August 6, 2025 for consumer contracts and February 16, 2026 for business ones.

"One-step" is doing real work in that phrase. The statute requires a cancellation link or button available on the seller's website or through an electronic communication to the customer, that terminates the contract immediately after a reasonable authentication step — no phone call, no support-ticket queue, no forced detour through a retention offer before the cancellation completes. That's a meaningfully higher bar than "same medium," the language California and the FTC both use. Same-medium just means you can't force an online signup to cancel by phone. One-step means the cancellation itself can't be gated behind more than a single action once the customer reaches it.

Practically, if your signup flow already routes through something like our Stripe cancellation flow guide — a reachable cancel action, a single retention offer that's easy to decline, immediate confirmation — you're most of the way to compliant for Colorado's consumer side already. The gap most B2B SaaS teams actually have is narrower but specific: does that same one-step path exist for accounts on your business/team plans, or does your cancellation flow silently assume "business account" means "call your account manager"? As of February 16, 2026, that assumption is a compliance gap in Colorado, not just a UX one.

New York's separate change: price increases need consent, not just a heads-up

Colorado wasn't the only state that moved. New York quietly amended General Business Law Section 527-a through S5615/A3928, signed by Governor Hochul in May 2025 as part of the state budget package. Unlike Colorado's cancellation-mechanics focus, New York's changes target a different moment in the subscription lifecycle: the price increase.

The amended law requires sellers to give notice 5 to 30 days before a price increase on an automatically renewing subscription takes effect. That notice alone isn't enough — you also need the customer's affirmative consent to the new price, or you have to let them cancel and get a pro-rated refund if they don't consent, for at least 14 days after the higher charge lands. New York also added a reasonable-notice requirement for trial conversions longer than 31 days (notice 3 to 21 days before the charge that ends the trial) and restrictions on when you can bundle a discount offer into a cancellation attempt.

We've written before about how to raise SaaS prices without spiking churn — 30-plus days of notice and clear grandfathering as retention best practice, not a legal floor. New York just turned part of that voluntary playbook into a hard requirement for at least one state, and did it from the other direction: instead of mandating a notice window like Colorado's renewal reminders, it mandates an actual choice — consent to the new price, or get your money back for the difference. New York's Attorney General isn't shy about enforcing this territory either; her office settled with fitness company Equinox for $600,000 in June 2025 over allegations that cancelling a membership was made unreasonably difficult, a signal of appetite that predates these amendments even taking effect.

Building toward the strictest common floor instead of chasing states one by one

With more than 30 states now running their own version of this law, treating each new statute as a one-off compliance project doesn't scale. The practical move is building your cancellation and billing-change flows to the strictest requirement across the states you actually have subscribers in, then treating the rest as already covered:

• Make cancellation completable in one action, for every account type. Not just consumer-labeled accounts — team and business plans too, if you have Colorado subscribers on them.
• Never require a phone call or ticket to finish a cancellation. An optional "talk to us first" offer is fine as long as declining it doesn't block the cancel action itself.
• Send price-increase notices with a real consent step, not just an FYI. If a subscriber doesn't affirmatively respond, default to letting the cancel-and-refund path apply rather than silently rolling them onto the new price.
• Log the enrollment channel per account. If a cancellation ever gets disputed, being able to show it went through the same online medium the customer signed up in — and completed in one step — is the specific fact pattern regulators in both states are checking for.

None of this requires rebuilding a working flow from scratch. It requires auditing whether the compliant path you already built for consumer subscribers quietly stops at the wall between "individual" and "business" accounts — a wall that, in Colorado at least, no longer exists. If you haven't built a purpose-built cancellation flow at all, this is exactly the gap CancelFlow is designed to close: a one-step, always-completable cancel action with a single non-blocking offer, applied consistently whether the subscriber checked out as a person or as a company — because as of this year, the law in at least one state doesn't care which box they checked.

Frequently asked questions

Stop losing subscribers today

One script tag. One function call. A live cancellation flow in under 10 minutes.