If you sell an auto-renewing subscription, your SaaS subscription agreement — and the cancellation flow that goes with it — is under more legal pressure now than it was a year ago, even though the FTC’s federal “click-to-cancel” rule was struck down in 2025. Enforcement didn’t stop; it just shifted to older federal statutes, a $35 million settlement, and the first city-level cancellation rule in the country.

I represent lots — literally 100s and 100s — of SaaS companies, and “negative option” billing (the auto-renew model almost every subscription runs on) is one of those spots where the law is moving faster than most vendors’ order forms. So here’s where things actually stand, and what to check in your own contract.

What a “negative option” actually is.

A negative option is any deal where your customer’s silence or inaction counts as agreement to keep paying — the classic auto-renewing subscription. Your customer signs up, and the plan renews and charges again unless they affirmatively cancel. It’s a perfectly legal model (it’s how most of the SaaS world bills). The legal risk isn’t the auto-renew itself — it’s whether you disclosed it clearly, got real consent to it, and made canceling easy. Pro Tip: Those three duties are exactly what your auto-renewal clause or even better you checkout screen are supposed to handle. I think it is much better in the checkout screen (aka order) vs the underlying agreement.

The federal click-to-cancel rule got vacated — but don’t relax.

In October 2024 the Federal Trade Commission finalized its “Click-to-Cancel” Rule, which would have imposed detailed nationwide disclosure, consent, and easy-cancellation requirements on negative-option sellers. The Eighth Circuit vacated that rule in its entirety in July 2025, holding the FTC skipped a required preliminary regulatory analysis under its Magnuson-Moss rulemaking authority. (Translation: the rule died on procedure — the court did not bless subscription traps.) The FTC reopened the process in March 2026 with a fresh advance notice of proposed rulemaking, so a narrower federal rule is likely coming back. The takeaway for vendors: the federal standard is paused, not gone, and waiting for the rerun is the wrong way to plan.

The FTC is still enforcing. Just ask Shutterstock.

Here’s the part vendors miss: losing the rule did not disarm the FTC. It still enforces negative-option practices under Section 5 of the FTC Act and the Restore Online Shoppers’ Confidence Act (ROSCA). In May 2026 the FTC announced a $35 million settlement with Shutterstock over exactly this. The FTC alleged Shutterstock buried its auto-renewal terms and early-termination fees, converted “free trials” into paid annual plans without clear notice (Pro Tip again), and made cancellation a slog. The order now requires Shutterstock to clearly disclose material terms, get express informed consent to the charge, and offer a simple way to cancel. That’s the FTC’s enforcement playbook with or without a rule on the books — and it applies to a SaaS vendor the same way it applied to a stock-image platform.

New York City just went first.

While the federal rule sorts itself out, states and cities are filling the gap. In April 2026 New York City’s Department of Consumer and Worker Protection proposed the first municipal “click-to-cancel” rule in the country. If adopted, it would require clear pre-enrollment disclosure (price, billing frequency, cancellation deadline and method), a cancellation mechanism at least as easy as sign-up and through the same channel, and renewal reminders 15–45 days out — with penalties starting at $525 per violation. It largely tracks existing New York State law (General Business Law § 527-a) and stacks on top of California’s Automatic Renewal Law and similar state statutes. The practical upshot: even with no federal rule, a SaaS vendor selling nationwide now faces a patchwork of state — and now city — cancellation requirements, and you generally have to design to the strictest one.

What your SaaS subscription agreement should say.

For most vendors, the fix is “a small update, not a rewrite.” The state and FTC standards all point the same direction, so a compliant SaaS subscription agreement and sign-up flow should do five things:

• Disclose before the charge — Put price, billing cadence, renewal date, and how to cancel in front of the customer before they pay, not buried in the terms. This is where your online consent flow earns its keep.
• Capture real consent — Use a separate, affirmative checkbox or click for the auto-renew term. Don’t let it ride on the general “I agree to the terms.”
• Make canceling as easy as signing up — If they joined online in two clicks, they should be able to cancel online in about two clicks. No phone-only cancellation, no retention maze.
• Send renewal reminders — A reminder before each renewal (and before a free trial converts to paid) is now a baseline expectation, not a courtesy. Great Pro Tip!

None of this is hard to fix — it’s just easy to overlook until a demand letter or a chargeback wave shows up. If you want a second set of eyes on your renewal and cancellation language, that’s exactly the kind of cleanup a SaaS agreement attorney handles in an afternoon. Trust me on this one: tighten it now, while it’s a 30-minute fix and not a $35 million problem.

I hope this helps and reach out if you have any questions!

Resources:

• SaaS Contracts & Agreements for Software Vendors
• 3 Nuggets Every SaaS Company Needs to Remember
• What is Up with Signing Contracts Online?
• SaaS Agreement vs. Software EULA: Which Template Do I Need?

Disclaimer:

This post is for informational and educational purposes only, and is not legal advice. You should hire an attorney if you need legal advice, which should be provided only after review of all relevant facts and applicable law.

The post Click-to-Cancel Rules and Your SaaS Subscription Agreement appeared first on Aber Law Firm.

       

When negotiating a saas terms of service (representing the vendor of course), I am often trying to explain to my client the difference between an indemnity and a breach of contract claim. I have been noodling on this for years, trying to figure out a simple way of explaining probably the most complex contractual legal concept that exists.

So here goes (shortcut: it is all about the $). The key differences are as follows:

INDEMNITY: (1) the VENDOR must spend $ to defend the CUSTOMER (or vendor will incur liability under the indemnity), even before it is proven that the vendor is at fault, and (2) the VENDOR has very few defenses to a claim.

BREACH OF CONTRACT: (1) the CUSTOMER must spend $ to sue the VENDOR, (2) the CUSTOMER has the burden of proof, and (3) the VENDOR has several strong defenses to any claim.

Which one would you want if you were the customer?

For the vendor-side mechanics in detail, a few related reads. SaaS Indemnity: What Types of Insurance Should a SaaS Company Purchase? covers the insurance coverages SaaS vendors need beyond standard E&O. Why You Need a Disclaimer In Your SaaS Agreement shows how a tight disclaimer changed a real case outcome. What Does Your SaaS Agreement Liability Model Look Like? walks through three liability-cap models. Indemnities: 4 Things You Should Know breaks down the four practical indemnity issues. SaaS Contract Negotiations Are Not All About the Software covers the emotional dimension of customer deals. SaaS Agreements Are NOT Good Communication Vehicles argues for using FAQs and policies alongside the contract. SaaS Agreement vs. Software EULA: Which Template Do I Need? is the foundational EULA-vs-SaaS decision tree. Contract or Policy? explains when each is the right tool.

Disclaimer: This post is for informational and educational purposes only, and is not legal advice. You should hire an attorney if you need legal advice, which should be provided only after a review of all relevant facts and applicable law.

The post Indemnity vs Breach of Contract Claim in a SaaS Terms of Service? appeared first on Aber Law Firm.

        

Comments

• In reply to JD. great! Jeremy by Jeremy Aber
• Thank you this was helpful by JD

Related Stories

• Indemnity vs Breach of Contract Claim in a SaaS Terms of Service?

 

Machine learning agreements or AI agreements are super new, and actually very interesting. Not much has been written on these agreements, so I thought I would share a few thoughts on the big issues (from the perspective of the AI/machine learning software vendor).

So here goes.

HOW THE AI SYSTEM WORKS AND WHO DOES WHAT MATTERS.

• Everything starts and ends with the answers to this question.
• This will drive what warranties you provide, the IP ownership model and in general the rights and obligations of the parties.
• Example: whose algorithm is being used? Is this a perpetual or term based deal?

WHO OWNS THE MACHINE LEARNING MODEL?

• Usually customers own their input and output data from software programs, but it is not that simple with AI and machine learning agreements.
• Machine learning models are generally viewed as the output from training a learning algorithm. The model will then be applied to the dataset. The model may contain parts of the underlying algorithm within the software, so I don’t think the ownership of the model matters, as much as who has what rights to the model and for how long.
• One way to solve it is to allow the parties to use the machine learning model during the term of the agreement and then have the vendor destroy the model at the end of the agreement. This way, the vendor is free to independently recreate any future machine learning models, and the customer gets the protection from the vendor re-using the model for other customers.

WHAT ABOUT THE UNDERLYING SOFTWARE AND ALGORITHM.

• This one is much easier.
• The vendor brings the software to the party, and it should own any enhancements, modifications or changes to it (and its algorithms).
• All AI and machine learning systems are on top of or embedded in a software program, so the industry standard licensing terms should apply to the underlying software. 

So when you are working on drafting your AI or machine learning agreement, remember that it will not be as simple as a standard software licensing agreement. Dig in, and figure out the issues so that you and your customers know what they can and cannot do with your software and the output.

Resources: 

• Here is an article from the other side, which I think is too simplistic as to who should own what. Link

Disclaimer: This post is for informational and educational purposes only, and is not legal advice. You should hire an attorney if you need legal advice, which should be provided only after review of all relevant facts and applicable law.

The post Few Thoughts on Machine Learning Agreements or AI Agreements appeared first on Aber Law Firm.

      

Related Stories

• Few Thoughts on Machine Learning Agreements or AI Agreements

 

The VSA is a super new group called the Vendor Security Alliance. As soon as I read this article about it Link,  I realized it was a great idea for all Software as a Service (SaaS companies) and will help get cloud service contracts signed. And hey, as attorneys that help SaaS companies get SaaS contracts signed, we were very excited.  So here is our thinking:

1. What is the VSA?
   • Here is their quote: “In collaboration with the VSA, top security experts and experienced compliance officers will release a yearly questionnaire to benchmark their risk. Companies can leverage this questionnaire to qualify vendors and ensure the appropriate controls are in place to improve security for everyone.”
   • The questionnaire is only stage 1, as it appears that they plan to come up with a VSA certified score. This scoring system could really help SaaS companies communicate their security practices.

2. Security issues are the #1 due diligence item we see in SaaS deals.
   • Security due dilligence is really slowing deals up, and the level of detail required to close a deal keeps increasing. In fact, info sec managers and directors at customers are on more and more conference calls during the contracting process and asking lots of questions.
   • It is not a bad thing, in fact it is a good thing, but we have to find a technological way to speed this process up. Hello VSA!

3. The VSA process (if it works and is executed well), could provide an efficient and effective way for SaaS vendors to explain their security practices.
   • In essence, if the VSA develops an accepted rating system, potential customers can use this rating system as the main part of their info sec due diligence, and more quickly figure who to work with and (more importantly) who to skip over.
   • It is really hard, if not impossible, to tell anything about info sec from the outside, so customers have to get under the covers quickly and reliably.
   • The whole goal here is to create a trusted framework.

4. If your project the role of the VSA out long term, SaaS services could one day (maybe) talk to each other and electronically communicate their VSA ratings and security practices.
   • This can help every SaaS company, as nearly all of them are relying on third party integrated web based services for more and more of their offerings, as they move from point offerings to solutions.
   • I am not making this up, as it is exactly what the Cloud Security Alliance is predicting regarding security practices in the future. https://cloudsecurityalliance.org

If you are a SaaS company, you should keep up with the VSA as they are just getting started. If they do it right, they may help you close your next cloud services contract with an enterprise customer.

Resources.

See this ‘related’ WSJ article re closing enterprise SaaS deals. https://goo.gl/kN4cvW

The post VSA. Why this is Great for SaaS Companies! appeared first on Aber Law Firm.

        

Comments

• In reply to Jascha Preuss. I will send you a reply via email by Jeremy Aber
• Thanks for the interesting article. How do the VSA standards ... by Jascha Preuss

Related Stories

• VSA. Why this is Great for SaaS Companies!

 

The post 3 Nuggets Every SaaS Company Needs to Remember appeared first on Aber Law Firm.

        

Comments

• In reply to Patrick McNichol. thanks. I fixed the link. Jeremy by Jeremy Aber
• FYI the link to the visualization chart is not functioning at ... by Patrick McNichol

Related Stories

• 3 Nuggets Every SaaS Company Needs to Remember

 

I have always thought disclaimers were good things to add to SaaS agreements, but this recent case shows they really can make a difference in a legal dispute. A disclaimer is a statement regarding things you are not liable for.

Example: if you provide medical software, it is a good idea to state that you are not providing medical advice, and that the doctors are solely responsible. You get the picture.

In this case, a building material company was certifying contractors as Master Craftsman regarding their products. If a customer wanted to search for a Master Craftsman on the building company’s site, they had to agree to a Terms of Service that stated:

“Although we take certain steps to examine the credentials of our listed service professionals, CertainTeed makes no guarantees or representations regarding the skills or representations of such service professional or the quality of the job that he or she may perform for you if you elect to retain their services. CertainTeed does not endorse or recommend the services of any particular service professional.”

Despite that warning, a customer sued the building company for fraud. The court got it right and threw the case out — there was no misrepresentation, so no fraud.

The takeaway for every SaaS company: think about decisions your customer should own and be responsible for (i.e. things they should not expect from your service). Add those to a disclaimer on your website or in your SaaS agreement to make it clear those are their responsibility.

For the foundational distinction that drives most SaaS liability disputes — and why a disclaimer matters within it — see SaaS Indemnity vs. Breach of Contract: What’s the Difference?

Resources:
Solum v. CertainTeed Corporation

Disclaimer: This post is for informational and educational purposes only, and is not legal advice.

The post Why You Need a Disclaimer In Your SaaS Agreement? appeared first on Aber Law Firm.

      

Related Stories

• Why You Need a Disclaimer In Your SaaS Agreement?

 

The post SaaS Agreements Are NOT Good Communication Vehicles appeared first on Aber Law Firm.

      

Related Stories

• SaaS Agreements Are NOT Good Communication Vehicles

 

The post One Thing a Software Developer Should Never Do. appeared first on Aber Law Firm.

        

Comments

• good site thanks for sharing by Praxent
• In reply to Nick Weynand. I will email you re this. Thanks, ... by Jeremy Aber
• Great article here. We have a clause that we can shut down ... by Nick Weynand

Related Stories

• One Thing a Software Developer Should Never Do.

 

The Network Advertising Initiative (NAI) has useful information in their 2015 Code of Conduct regarding SaaS privacy for the online third-party ad business. The NAI is a self-regulatory governing body of third parties in the online advertising ecosystem. The group is useful not just for ad networks, but for platforms, aggregators, yield optimization firms, and anyone dealing in third-party ads.

The most interesting issue in their Code of Conduct is in their definitions:

• Personally Identifiable Information (PII) — data used to identify an individual.
• Non-PII — data that is not linkable to an individual, but is linkable to a device.
• De-Identified Data — data that is not linkable to an individual or device.

What’s fascinating is that these definitions don’t only focus on identifying a person (which is how the world used to work); they’re now about identifying a computer or device or a person. Before, if you couldn’t identify a specific person you were considered safe. Now you have to be careful if you’re tracking or identifying a computer or device — especially across platforms.

The Federal Trade Commission is also very interested in tracking devices and computers and is concerned about what are called persistent identifiers.

The takeaway for every third-party ad network company: read this Code of Conduct. SaaS privacy is no longer simply about disclosure and choice — it is now very much about tracking devices and computers.

For the framework regulators expect SaaS vendors to bake into product design from day one, see Privacy by Design: A Framework for SaaS and Software Vendors.

Resources

General Info on the 2015 NAI Code of Conduct

The post A Few Things You Should Know About the NAI – SaaS Privacy appeared first on Aber Law Firm.

       

Can you obtain copyright protection for your GUI?

This is an important issue, and one that many vendors do not understand. As a general matter, obtaining copyright protection for source code is easy, but obtaining protection for GUIs is not that simple. Here is a deeper post on the ins and outs.

What is the difference between Contract and Copyright Protection for Software?

Contracts and Copyright are two totally different ways to legally protect your software. This post explains the difference and why you should use both methods.

What is Fair Use?

Fair use is an important defense to copyright infringement, and a concept that is rarely understood. It is essentially a 4-part balancing-of-interests test. Keep in mind it is subjective, so relying on it is not always the best way to go.

Protecting your software really matters. If you don’t take steps to protect your software today, it may leave your product vulnerable to competitors creating lookalikes and stealing your customers.

For the foundational frame on the four IP regimes that protect software — copyright, trademark, patent, and trade secret — see Intellectual Property Basics for Software Companies.

Disclaimer:

This post is for informational and educational purposes only, and is not legal advice.

The post Copyright Issues: SaaS Software. appeared first on Aber Law Firm.