The UK Delayed Its Subscription Law to Spring 2027 Again. The CMA Didn't Wait to Start Fining.

Every jurisdiction we've tracked this year has moved on its own clock — Colorado extending to B2B, Maryland writing its first-ever statute, Australia stacking nine-figure penalties on top of a 2027 commencement date. The UK's version of this story is different in one specific way: it's the only major market where the actual subscription rules just got pushed back for the second time, and yet the regulator behind them has already issued a multimillion-pound fine using a completely different lever. Both of those things are true at once, and treating "delayed" as "nothing to do" misses the second one entirely.

That fine has nothing directly to do with subscriptions — it was drip pricing on driving lessons, a hidden £3 booking fee revealed only at checkout. But it shows how the CMA behaves once it has a power in hand: it used its brand-new ability to fine without going to court first, on its first eligible case, within roughly a year of getting that ability. The subscription contracts regime is a different, more specific set of rules than the one that caught the AA. It is not a different regulator, and it is not a regulator that waits.

Two different clocks, and only one of them just slipped

The DMCCA does two things that are easy to conflate and important to separate. The first is a general modernization of UK consumer protection: it lets the CMA investigate and fine directly for unfair commercial practices — drip pricing, fake urgency claims, misleading reviews — without the slower route of a court referral it relied on before. Those powers commenced in April 2025 and are live now, which is what the AA fine ran on. The second is a purpose-built subscription contracts regime, sitting in its own part of the Act, that adds cooling-off periods, mandatory reminder notices, and an easy-exit requirement specifically for subscription and continuous-payment contracts. That second piece is what keeps slipping.

It was expected to commence in 2026, then Autumn 2026 after the first consultation response, then Spring 2027 after a second one in April 2026 — a full year past its original target, and the second postponement in a row. Reed Smith, which has tracked the consultation closely, put the practical implication plainly: the delay "should not be read as a reason to pause" preparation, because the compliance work doesn't get smaller while the date moves.

Sources: Reed Smith, "DMCC subscription rules delayed to spring 2027" (2026); Freshfields, "DMCCA Subscription Reforms Now Set for Spring 2027" (2026); White & Case, CMA infringement decision analysis (2026).

A SaaS team that only tracks the top row of that table — "when do the subscription rules land" — is measuring the wrong clock. The general enforcement regime is what actually reaches a badly disclosed renewal term or a buried cancellation step right now, under existing unfair-practices law, the same way the ACCC has been pursuing Australian subscription traps under existing law well ahead of that country's 2027-commencing Unfair Trading Practices Act.

What the subscription regime will actually require when it lands

The mechanics, once in force, are more specific than most of what we've covered from other jurisdictions. Three pieces do most of the work.

Two 14-day cooling-off periods, not one. An initial cooling-off period applies from the start of the contract, matching existing UK distance-selling rights. A second, new renewal cooling-off period triggers separately — after a free or discounted trial converts to paid, and after certain longer-term contracts (12 months or more) auto-renew. Neither can be contracted away, and cancelling inside either window entitles the consumer to a proportionate refund for what they didn't use, regardless of how much of the period they'd already consumed. The government's own consultation response acknowledges this opens the door to "binge and cancel" behavior — someone deliberately timing cancellation to land inside the refund window — and kept the protection anyway.

Reminder notices, on a schedule the business itself sets. For contracts that auto-renew on a 12-month-or-longer cycle, the trader must send a reminder before the first renewal and every renewal after that. For shorter or irregular renewal patterns, a reminder is required whenever the next payment is due six months or more after the last one. Every reminder has to be delivered in writing on a durable medium — email, SMS, a letter — and needs to say plainly what it is: the amount due, the date it's due, and exactly how to cancel before then, including a specific deadline for taking that action.

An exit that's no harder than the entry. If a consumer signed up online, they need to be able to cancel online — the same "no harder to leave than to join" standard the FTC's click-to-cancel rule and California's amended ARL both use. The DMCCA's version doesn't require the exit to happen in a single communication the way an earlier draft proposed — that specific requirement was softened during consultation — but a multi-step retention gauntlet standing between "I want to cancel" and it actually happening is still the failure pattern regulators are watching for.

The UK's ceiling — 10% of a trader's global annual turnover, or £300,000, whichever is higher — applies to both the general powers already in force and, once commenced, the subscription regime itself. That's the same order of magnitude as Australia's AU$100 million figure, and both dwarf the per-violation civil penalty structure most US state auto-renewal laws use. For a company with meaningful UK revenue, a subscription compliance gap is priced against the same percentage-of-turnover ceiling that competition-law fines use.

The trap in "a reasonable period"

Here's where the UK's approach genuinely differs from every other jurisdiction we've covered, and it's the part worth building for now rather than in 2027. Colorado gives you 25 to 40 days. Maryland gives you 15 to 45. New York gives you 3 to 21. Every US state auto-renewal law hands you a government-defined day-count window and says: send the reminder inside it. The DMCCA doesn't. It requires the trader to state a "reasonable period" for issuing the reminder notice in the pre-contract information — and then actually send it inside that self-declared window, consistently, for every renewal.

That sounds like more flexibility. In practice it's a compliance obligation with no numeric floor to check against, which is a harder thing to get right than a fixed range. Declare a "reasonable period" of three days and a regulator can argue it wasn't reasonable at all — not enough time for a consumer to actually act on the notice before being charged. Declare something vague or don't declare a period at all in your pre-contract disclosures, and you haven't satisfied the requirement regardless of when you actually send the reminder. Unlike Maryland's or Colorado's fixed windows, where the entire compliance question is "did the notice land inside these specific days," the UK's version adds a second question first: did you commit, in writing, to a period a regulator would agree is reasonable — and can you show you kept to it every time.

The safest move for a SaaS team already sending renewal reminders elsewhere is to pick a period on the stricter end of what other jurisdictions already require — something in the 14-to-30-day range mirrors what most well-built pre-renewal reminder systems already send off a Stripe upcoming-invoice event — state that period explicitly in your terms at signup, and hold to it. That turns an open-ended standard into something closer to the fixed-window compliance you've likely already built for other markets, just with the number written into your own disclosures instead of a statute.

Why "Spring 2027" isn't the date that matters

Two things make the delay less protective than it sounds. The DMCCA's redress powers let the CMA order a business to contact every affected consumer and offer cancellation with a full refund, on top of any fine — a remedy that reaches backward across however long a non-compliant practice ran, not just forward from a future commencement date. And the "reasonable period" disclosure has to exist in your terms before a consumer ever signs up under it, which means the actual work — deciding the number, writing it into pre-contract information, wiring up durable-medium delivery, building the second cooling-off window into your billing logic — has to happen well before Spring 2027 if it's going to be live on day one rather than retrofitted under a regulator's attention. A commencement date measures when enforcement starts, not when the underlying practice starts being unfair — the same lesson the Colorado B2B expansion and EU withdrawal button both taught.

What to build now

• Pick and publish a reminder-notice period today, don't wait for the statute. Something in the 14-to-30-day range, stated explicitly in your terms and pre-contract disclosures, gives you a documented "reasonable period" you can point to rather than an argument you'll have to win after the fact.
• Build the second cooling-off window into your billing logic, not just the first. Most teams already handle a standard returns/cooling-off period at signup. The renewal-triggered one — firing on trial-to-paid conversion and on 12-month-plus auto-renewals — is the piece that doesn't exist in most systems yet, and it needs a proportionate-refund calculation, not a flat refund-or-nothing rule.
• Move renewal reminders to a durable medium if they aren't already. An in-app banner that disappears when the tab closes won't satisfy the "durable medium" requirement. Email or SMS, retained and resendable, will.
• Audit your UK cancellation path against the general unfair-practices standard now, not the subscription-specific one later. A hidden fee, an undisclosed renewal price, or a buried cancel step is already exposed under the powers that produced the AA fine — the 2027 date doesn't gate that exposure.
• Confirm your B2B/B2C line is drawn correctly for UK signups. The subscription regime, like California's and Maryland's laws, only reaches consumer contracts — but a solo UK signup on a personal card, regardless of the business name on the account, is very likely a consumer for these purposes.

None of this requires rebuilding a cancellation flow from scratch if it's already built around a persistent, unblocked cancel path rather than a forced offer sequence — the same shape we've argued for across every jurisdiction's version of this rule this year. What UK teams specifically need that most haven't built yet is the reminder-notice disclosure and the second cooling-off calculation, and both are worth having in place well before Spring 2027 — especially given how little that date has stayed put so far. If you want to see what a UK-specific compliance gap is costing you in the meantime, our churn calculator turns a segment's cancellation and refund rate into an MRR number in under a minute. CancelFlow's cancel path is built the same way regardless of which regulator is watching it this year — always visible, never gated behind an offer.

Frequently asked questions

Stop losing subscribers today

One script tag. One function call. A live cancellation flow in under 10 minutes.