Virginia Just Killed the 'Good Faith Effort' Defense for a Bad Cancellation Flow

Every state auto-renewal law we've tracked this year has added a new requirement on top of what was already there. Virginia's amendments, which took effect July 1, 2026, do something different: they take a defense away. Until this summer, a Virginia business sued over a broken cancellation flow could point to a good-faith effort at compliance and get some legal cover for the mistake. HB1022 and SB493 stripped that defense out of the statute entirely, and paired the removal with a requirement that's easy to miss if you're only tracking Colorado and New York — cancellation now has to work through every channel you use to sign someone up, not just one.

We've written before about how Colorado extended its cancellation law to reach B2B subscriptions and how the FTC's own rule keeps getting vacated and revived at the federal level. Virginia's changes sit apart from both. They don't expand who's covered — the law stays limited to consumers, same as it always was. What changed is how much room a business has to get it wrong.

What actually changed on July 1

HB1022 and SB493 amend Virginia Code §§ 59.1-207.45 through 59.1-207.49, the sections of the Virginia Consumer Protection Act governing automatic renewal and continuous service offers. Two changes matter more than the rest of the bill text.

Neither change is complicated to state. Both are harder to build for than they sound, because most cancellation flows were never designed around the idea that "cancel" might need to mean something different depending on where the subscription started.

It's also not a bill that slipped through on a technicality nobody noticed. HB1022, sponsored by Del. Reaser, and its Senate companion SB493, sponsored by Sen. Pekarsky, passed the General Assembly unanimously, and Virginia's Attorney General's office listed it by name — branded internally as the state's own "click to cancel" law — among its headline legislative wins for the 2026 session. An office that publicly claims credit for a consumer-protection statute tends to be the same office that opens the first cases under it.

"Every channel" is a stricter standard than "same medium"

Colorado and California both use some version of a same-medium rule: if a customer signed up online, you can't force them to call a phone number to cancel. That's a floor, and most modern cancellation flows already clear it. Virginia's standard is narrower and more literal. The statute doesn't ask whether cancellation is available online in general — it asks whether cancellation is available through each specific channel a business uses to enroll customers, and whether that specific path is as easy to use as the one that got them in.

For a SaaS company selling through a single self-serve web checkout, that distinction barely matters — one enrollment channel means one required cancellation path, and same-medium and every-channel collapse into the same rule. It stops collapsing the moment a second channel shows up: a mobile app with in-app purchase, an enterprise deal closed by a sales rep and provisioned manually, a reseller or marketplace listing. Route all of those customers to a single generic cancellation web form and you've satisfied a same-medium rule. You likely haven't satisfied Virginia's, because the app-store subscriber didn't sign up through that web form and the enterprise account didn't sign up through any form at all.

A self-serve motion running alongside sales-assisted expansion — the standard shape of B2B SaaS go-to-market today — means most companies already enroll customers through more than one path. Virginia's law doesn't care that the paths were built at different times by different teams for different reasons. It just asks whether each one has a matching, equally easy way out.

Why removing the good-faith defense is the bigger change

A good-faith defense is what lets a business survive an isolated failure — a deploy that briefly broke the cancel button, a support agent who mishandled one request, a channel that got added without anyone updating the cancellation flow to match. The defense doesn't excuse a pattern of bad behavior, but it gives a court somewhere to land short of statutory liability when the underlying effort at compliance was real.

New York still has something like it. GBL § 349(h), the statute underlying New York's private consumer-protection claims, preserves an exception for a seller who can show it attempted to comply in good faith and the violation resulted from a bona fide error. Virginia's amendments remove the equivalent language from its own statute outright. The practical effect: a Virginia subscriber doesn't need to show your company was careless, indifferent, or acting in bad faith. They need to show the cancellation path that applied to them didn't exist or wasn't as easy as sign-up. Everything about why it happened — a bug, a vendor's outage, a channel someone forgot — stops being a legal defense and becomes, at most, a mitigating fact for a jury to weigh after liability is already established.

Layer that onto the private right of action from Va. Code § 59.1-204 and the numbers get real fast. A subscriber recovers actual damages or $500, whichever is greater — meaning someone who lost nothing more than the hassle of a stuck cancellation still clears the statutory floor. A willful violation — plausible if the company knew a channel's cancel path was broken and didn't fix it — pushes that to treble damages or $1,000, whichever is greater, plus attorneys' fees. Multiply either number by every subscriber affected by the same gap and a single missed channel stops being a UX ticket and starts being a class-action fact pattern.

What to actually check if you have subscribers in Virginia

The law applies based on where your subscriber is, not where your company is incorporated, the same way California's and Colorado's do. Any SaaS company running self-serve signups almost certainly has Virginia subscribers whether or not anyone has looked into this yet. The audit isn't complicated, but it does require listing every path a customer can use to start a subscription, not just the main one:

• Map every enrollment channel. Web checkout, mobile app store purchase, a sales-closed contract provisioned manually, a reseller or marketplace listing — anywhere a Virginia customer's subscription could have originated.
• Confirm a cancellation path exists for each one. Not a support email that eventually routes to cancellation — an actual mechanism reachable through that same channel.
• Check that each path is genuinely as easy as its sign-up counterpart. If enrolling through a sales rep took one email, a Virginia subscriber who enrolled that way arguably needs a comparably low-friction way to cancel, not a multi-step offboarding process built for enterprise churn risk management.
• Treat the cancel flow as production infrastructure, not a static page. With the good-faith defense gone, an outage or a broken deploy on the cancellation path isn't a footnote — it's the exact fact pattern the statute now punishes without asking why it happened. Our guide to testing a cancellation flow covers how to validate changes here without shipping a regression to the one page you can least afford to have quietly break.
• Log which channel each subscriber actually enrolled through. If a claim ever comes in, you need to be able to show which cancellation path applied to that specific account and that it was live and working on the date they tried to use it — not just that a cancellation path existed somewhere in the product.

None of this requires rebuilding a working flow from the ground up. It requires confirming that a working flow actually reaches every channel a Virginia customer might have used to sign up in the first place — the same audit we recommended after Colorado's B2B expansion, just applied to channels instead of account types. A cancellation flow built around a single consistent mechanism, like the one a well-configured Stripe setup or CancelFlow provides, is easier to extend to a second or third enrollment channel than a flow that was hand-built once for the web checkout and never touched again. Our churn calculator is built around the cost of losing a subscriber, not the cost of a claim — but the same instinct applies here: the gap that's cheapest to close is the one nobody's checked yet, not the one that already got someone sued.

Frequently asked questions

Stop losing subscribers today

One script tag. One function call. A live cancellation flow in under 10 minutes.