Terms of Service: Consent, Clauses & Enforceability (2026)

What Makes a Terms of Service Agreement Actually Enforceable?

A terms of service (ToS) is a legally binding contract between you and every person who uses your website or app. It sets rules for use, caps your liability, establishes IP ownership, and controls how disputes are resolved. A well-written ToS is worthless, however, if users never validly agreed to it — and courts in 2025–2026 are just as likely to examine your consent UI and cancellation flow as your clause language. Every major FTC enforcement action from the past two years failed not because the company lacked a ToS, but because its consent architecture, billing disclosures, or cancellation UX contradicted what the document said.

Key takeaways

• A ToS is a four-layer system: document quality, consent architecture, cancellation UX, and evidence logging. Failure at any layer can make the others irrelevant.
• Clickwrap achieved approximately a 70% litigation success rate; browsewrap achieved only about 14%, per Ironclad's analysis.
• The Ninth Circuit struck down a sign-in wrap on February 27, 2025 (Chabolla v. ClassPass) because the terms link was too small relative to surrounding elements.
• ROSCA civil penalties reach $53,088 per violation. The FTC settled with Amazon for $2.5 billion (September 2025) and Shutterstock for $35 million (May 2026) — both companies had written ToS documents. Both failed at the other three layers.
• The EU's Digital Services Act has applied to all online platforms since February 17, 2024. The European Commission issued its first DSA fine — €120 million against X — on December 5, 2025.

---

The Four-Layer System: Why Most ToS Failures Aren't About the Document

Every guide to terms of service focuses on clauses. That framing is incomplete. The 2025–2026 FTC enforcement wave produced seven nine-figure settlements and not one of them turned on bad clause language. They all failed at one or more of the other three layers: consent architecture, cancellation UX, or evidence logging.

Think of your ToS as a four-layer system:

Layer	What It Is	What Failure Looks Like
1 — Document	The written agreement: clauses, scope, jurisdiction	Missing clauses; stale law; marketing that contradicts the document
2 — Consent Architecture	How users are shown the terms and how they signal agreement	Browsewrap; sign-in wrap with small-font links; pre-checked boxes
3 — Cancellation UX	How easily users can stop a recurring charge	8-screen flows; phone-only cancellation; save-offer screens that hide the cancel button
4 — Evidence Logging	Your backend record of who agreed to what and when	No version stamps; no timestamp logs; no immutable audit trail

The Shutterstock case — all three non-document layers failed simultaneously. On May 13, 2026, the FTC filed and simultaneously settled claims against Shutterstock for $35 million (FTC v. Shutterstock, Inc., No. 26-03955, S.D.N.Y., stipulated order entered May 14, 2026).

Layer 1 failure — marketing contradicted the document. Shutterstock marketed on-demand image packs as "best for a one-time project" with "no commitment." The actual subscription terms — auto-renewal triggers when the last download in the pack was used, plus a one-year renewal — appeared in gray text below the call-to-action button and were omitted entirely from the final enrollment screen. The FTC found that a "no commitment" headline cannot be cured by buried fine print.

Layer 3 failure — eight-screen cancellation. Before 2024, consumers could not cancel online at all. After that, the FTC complaint described a "multi-step, eight-screen online cancellation flow" with hard-to-find phone and email support channels. ROSCA (15 U.S.C. § 8403) requires a "simple mechanism" to stop recurring charges; the FTC treats eight screens as the structural opposite of simple. The internal Shutterstock emails made this worse: when an employee flagged the FTC's 2024 lawsuit against Adobe and worried "we'll be next," a Senior Product Manager responded: "hopefully we can get away with it." That message became exhibit-level evidence in a federal enforcement complaint.

Amazon's $2.5 billion settlement (September 25, 2025) — $1 billion in civil penalties plus $1.5 billion in consumer refunds — included a finding that the company collected billing information before disclosing Prime subscription material terms, in direct violation of ROSCA § 8403. Chegg's $7.5 million settlement (September 15, 2025) included findings that approximately 200,000 customers were charged after requesting cancellation, and that Chegg required subscribers to navigate through multiple confusing pages to reach the cancellation option. Neither company failed because of clause drafting.

---

Which Consent Mechanism Should You Use?

Courts evaluate consent mechanisms on a spectrum of legal validity. The mechanism must match the stakes of the transaction — account creation, purchase, subscription enrollment, and data processing consent each create legal consequences requiring defensible consent design.

Consent Type	How It Works	Litigation Success	Best Use Case	Key Authority
Scroll-wrap	User must scroll to bottom before the "I Agree" button activates	Very high	High-stakes consumer agreements	Widely upheld; no significant adverse decisions
Clickwrap	User clicks "I Agree" or checks a dedicated box before proceeding	~70%	SaaS sign-up, subscriptions, purchases	Feldman v. Google, E.D. Pa. 2007; upheld consistently
Sign-in wrap	Notice near a login button; no separate click required	Mixed — design-dependent	Higher risk; outcome varies by font size and link prominence	Chabolla v. ClassPass, 9th Cir. Feb. 27, 2025 (struck down); Meyer v. Uber, 2d Cir. 2017 (upheld)
Hybridwrap	Notice present; implicit agreement via submit/purchase button	Moderate	E-commerce checkout, B2B	Domer v. Menard, 7th Cir. Sept. 2024 (upheld with caveats)
Browsewrap	Footer link; continued use equals acceptance	~14% (consumer); higher for sophisticated B2B	Informational sites; narrow B2B exception	Nguyen v. Barnes & Noble, 9th Cir. 2014 (struck down); OCLC v. Anna's Archive, Jan. 2026 (upheld for sophisticated repeat user)

The design standard in two cases. In Berman v. Freedom Financial Network (9th Cir.), terms appeared in "tiny" font "considerably smaller than the font used in the surrounding website elements" and "barely legible to the naked eye" — struck down. In Domer v. Menard (7th Cir., September 2024), the Seventh Circuit upheld a hybridwrap that placed the terms link close to the purchase button with explicit language stating that clicking constituted acceptance, used contrasting text, and gave users a real opportunity to review. The Chabolla dissent warned that the majority opinion would "drive websites to the only safe harbors available to them — clickwrap or scrollwrap agreements." That is functionally correct guidance. For any transaction creating legal consequences, use clickwrap. For subscription enrollment specifically, use a second, separate clickwrap step — not bundled into general signup ToS acceptance.

The January 2026 case OCLC, Inc. v. Anna's Archive offers one browsewrap exception: a federal court upheld browsewrap terms against a sophisticated B2B party that accessed the service extensively and was deemed to have accepted terms through its pattern of use. For consumer-facing or small business platforms, this exception will not apply.

For a broader look at how electronic consent works across contract types, see how to sign a contract online and what makes a contract legally binding.

---

The 10 Essential Clauses Every Terms of Service Needs

Clause	What It Does	Why It Matters
Acceptance of Terms	Establishes how agreement is formed (clickwrap preferred)	Foundational — all other clauses depend on valid acceptance
Service Description	Defines what you offer, availability, and scope limitations	Limits reasonable-expectation claims; sets the consideration
User Obligations & Acceptable Use	Lists prohibited activities; sets minimum age (13 under COPPA, 16 under GDPR)	Contractual right to terminate bad actors; COPPA compliance
Intellectual Property	Claims platform content ownership; grants you a license to user-generated content	Prevents infringement; enables DMCA safe harbor under 17 U.S.C. § 512
Limitation of Liability	Caps your exposure; disclaims warranties	Highest-value protective clause for businesses
Dispute Resolution	Arbitration, governing law, informal notice period	Controls venue and eliminates class actions if drafted correctly
Auto-Renewal / Payment Terms	Discloses billing cycles, price changes, trial-to-paid conversions	Mandatory under ROSCA, California ARL, New York GBL § 527-a
Modification Clause	Reserves the right to update terms; sets notice method	Prevents users from freezing you on outdated terms; must include actual notice
Termination Rights	Outlines when you can suspend or close accounts	Lets you act without proving a separate legal wrong
Privacy Policy Reference	Cross-links your data handling document	Legally required integration under GDPR Article 13 and CCPA

For platform operators hosting user-generated content, a DMCA notice-and-takedown procedure (17 U.S.C. § 512) must sit alongside the IP clause. Without a compliant procedure, the copyright safe harbor for user-posted content does not apply. For a detailed breakdown of how courts evaluate limitation of liability caps, see limitation of liability in contracts. For dispute resolution design and the growing mass arbitration risk, see arbitration clause explained.

---

Auto-Renewal Terms: The FTC's Highest-Priority Enforcement Zone

If your product charges recurring fees, your ToS's auto-renewal section carries more legal risk right now than any other clause. The FTC under multiple administrations has made subscription cancellation an explicit enforcement priority — and the 2025–2026 settlements confirm the trend is accelerating.

The federal baseline — ROSCA (15 U.S.C. § 8403). Any online subscription must (1) clearly and conspicuously disclose all material terms before collecting billing information, (2) obtain express informed consent before billing, and (3) provide a simple mechanism to stop recurring charges. Violations carry civil penalties up to $53,088 per violation, and the FTC may also seek consumer redress.

The enforcement scorecard — 2025–2026:

Case	Date	Amount	Core Violation
Amazon Prime	Sept. 25, 2025	$2.5B ($1B penalties + $1.5B refunds)	Billing before material terms disclosed; dark-pattern cancellation
Instacart	Dec. 18, 2025	$60M consumer refunds	Free trials auto-enrolling into paid annual plan without adequate notice
Chegg	Sept. 15, 2025	$7.5M	Multi-page cancellation maze; 200K customers charged after requesting cancellation
Cleo AI	March 2025	$17M	Difficult cancellation; advertised cash advances not delivered as described
Vonage	Earlier	$100M	Cancellation unreasonably difficult for residential and business customers
Shutterstock	May 13, 2026	$35M	"No commitment" packs that auto-renewed; omitted terms on final enrollment screen; 8-screen cancellation
Uber One	Filed April 21, 2025; amended Dec. 15, 2025	Ongoing	28M consumers enrolled; 21 state co-plaintiffs; complex cancellation flow

The FTC's Click-to-Cancel Rule was vacated by the Eighth Circuit in July 2025 on procedural grounds, but the FTC immediately began new rulemaking (ANPRM submitted to OIRA on January 30, 2026; public comment launched March 2026) and has continued filing suits at the same pace. ROSCA enforcement authority was not affected by the vacatur.

What ROSCA-compliant vs. non-compliant disclosure looks like in practice:

Disclosure Element	Non-Compliant (Shutterstock pattern)	ROSCA-Compliant
Placement	Gray text below the CTA button	Adjacent to the payment button, same or larger font
Renewal amount	Omitted from final enrollment screen	Dollar amount stated explicitly before billing info collected
Renewal timing	Buried in ToS or omitted	Stated on the same screen: "Renews annually on [date] at $X"
Cancellation method	Phone or email only; 8+ screens online	Online, ≤3 clicks; same medium as enrollment
Trial conversion	"Free trial" converts without separate consent step	Separate affirmative step for paid plan before trial ends
Marketing claims	"No commitment" / "one-time project" for auto-renewing product	No headline claim that contradicts the actual billing structure

State law adds another layer. Federal ROSCA is the floor. States have enacted their own requirements that frequently go further:

State	Law	Key Requirements	Effective
California	Bus. & Prof. Code § 17600 et seq. (amended AB 2863)	Annual reminder before yearly renewals; cancellation via same medium as enrollment	July 1, 2025
New York	GBL § 527-a (amended 2025)	Advance affirmative consent to price increases OR 14-day cancel right with pro-rata refund	November 2025

Approximately 30 states have enacted their own automatic-renewal or negative-option laws; requirements vary. For a deep dive on drafting a compliant auto-renewal clause, see auto-renewal clause explained. SaaS operators should also check the SaaS subscription agreement guide for product-specific structures.

---

The 20-Point ToS Self-Audit Scorecard

No competitor guide offers a scored self-audit. Use this to identify which of the four layers is your highest-risk area before a regulator or court does it for you. Score 1 point for each item fully satisfied.

Layer 1 — Document Quality (5 points)

1. All 10 core clauses from the table above are present and customized to your actual business model (not generic template language).
2. Auto-renewal terms appear as a standalone section — not buried in general ToS text — and disclose price, billing frequency, promotion end date, post-promotional price, and trial conversion terms explicitly.
3. Written in plain English throughout: no "whereas," "hereinafter," "party of the first part," or "notwithstanding the foregoing."
4. Jurisdiction-specific addenda or sections address the EU DSA (if you serve EU users), California ARL (if you serve California subscribers), and New York GBL § 527-a (if you serve New York subscribers).
5. Reviewed within the past 12 months, or within 30 days of any material change to your business model or applicable law.

Layer 2 — Consent Architecture (5 points)

6. Clickwrap is used for account creation: a dedicated, unchecked checkbox adjacent to the submit button with language "I have read and agree to the Terms of Service."
7. A second, separate clickwrap step is used for any subscription or recurring charge enrollment — not bundled into general signup acceptance.
8. The terms link is displayed in body-size, visually distinct (contrasting color) type, not gray text below the fold.
9. No pre-checked consent boxes anywhere in the flow (courts treat pre-checked boxes as invalid; EU law under GDPR explicitly prohibits them for data consent).
10. The auto-renewal disclosure screen appears before you collect payment information — not after (ROSCA § 8403 requirement confirmed in the Amazon summary judgment, September 2025).

Layer 3 — Cancellation UX (5 points)

11. Online cancellation is available 24/7 without requiring users to contact customer support by phone or email.
12. Cancellation completes in ≤3 screens from the account dashboard.
13. The cancellation method matches the enrollment method: if a user enrolled online, online cancellation is available without exception.
14. No save-offer screen that obscures the cancel button or adds a mandatory delay before displaying it.
15. Written confirmation of cancellation is delivered immediately, stating the effective date and any refund amount.

Layer 4 — Evidence Logging (5 points)

16. Each consent event logs: timestamp in UTC, IP address, device and browser string, and the exact ToS version number or hash accepted.
17. A versioned archive of every historical ToS is maintained and each version is retrievable by version ID and effective date.
18. The consent log is immutable: append-only, no updates or deletions; cancellation events are logged as new records, not edits to the original.
19. Consent records are retained for a minimum of five years; subscription businesses should target 10 years, consistent with retention periods in recent FTC consent orders.
20. Cancellation requests are logged with date, time, method of request, and a confirmation ID that can be produced in response to a regulatory inquiry.

Scoring: 18–20 = low risk. 12–17 = moderate risk — address gaps before your next annual review. Below 12 = high risk — reassess before your next subscription renewal cycle and consider legal review of your current flows.

Create your Website Terms of Service with Pactlio's AI agents — Researcher, Drafter, Critic, Validator, and Adversary — debating and refining the language against your specific platform model before you review a word.

---

Jurisdiction Requirements: What Your ToS Must Address by Region

You don't need four separate documents — but you do need explicit, jurisdiction-specific provisions. A single ToS can cover multiple jurisdictions through clearly labeled addenda.

Jurisdiction	Key Law	What Your ToS Must Address
United States (federal)	ROSCA (15 U.S.C. § 8403); COPPA; FTC Act § 5	Auto-renewal disclosures before billing; parental consent for under-13 users; simple cancellation mechanism
California	Bus. & Prof. Code § 17600 et seq.; CCPA/CPRA	Annual renewal reminders; same-medium cancellation; data rights cross-reference
European Union	EU Unfair Contract Terms Directive 93/13/EEC; Consumer Rights Directive; Digital Services Act (Regulation 2022/2065); GDPR	Plain language throughout; advance notice of material changes; content moderation explanation and appeals; GDPR Article 13 cross-reference
United Kingdom	Digital Markets, Competition and Consumers Act 2024 (DMCCA)	Unfair commercial practices provisions effective April 2025; CMA can fine up to 10% of global group turnover
All jurisdictions	General contract law	Governing law clause; dispute resolution; valid documented consent

EU and DSA specifics. The Digital Services Act has applied to all online platforms since February 17, 2024. DSA Article 17 requires any platform that restricts content or suspends accounts to explain the decision and provide an appeal mechanism. DSA Article 25 prohibits deceptive design practices in interfaces and terms — this is the provision under which the European Commission fined X €120 million on December 5, 2025. That fine was calculated across three violations: €45 million for the deceptive blue-checkmark design (Article 25), €40 million for inadequate researcher data access (Article 40), and €35 million for an incomplete advertising repository (Article 26). Fines for very large online platforms (45M+ monthly EU users) can reach 6% of global annual turnover.

EU Unfair Contract Terms Directive (93/13/EEC). Standard terms must be drafted in plain, understandable language. Ambiguous clauses are interpreted in the consumer's favor, and unfair terms are void even if the user clicked to accept.

For the full GDPR impact on your ToS and privacy policy, see the GDPR compliance guide and how to create a privacy policy. E-commerce operators should also review the e-commerce contracts guide. For a comprehensive map of state-level privacy and auto-renewal laws, see the state privacy laws 2026 guide.

---

Common Mistakes to Avoid

• Relying on browsewrap for any transaction with legal consequences. Footer links alone achieve only about a 14% litigation success rate. If a user can plausibly say they never noticed the terms, you cannot enforce them — including an arbitration clause you spent real money drafting. The narrow B2B browsewrap exception (OCLC v. Anna's Archive, Jan. 2026) does not apply to consumer or small-business platforms.
• Marketing a product as "no commitment" or "one-time" when it auto-renews. The Shutterstock $35M FTC settlement turned on exactly this gap between headline marketing and billing reality. Prominent claims cannot be contradicted by buried fine-print disclosures and survive ROSCA scrutiny.
• Building more than three steps into your cancellation flow. The Chegg complaint described navigating "through multiple confusing pages" to reach cancellation. The Shutterstock complaint described an eight-screen flow. ROSCA requires a "simple mechanism" — regulators treat complexity itself as a violation.
• Bundling subscription consent into general signup acceptance. ROSCA requires disclosure of all material subscription terms before billing information is collected. If your subscription checkbox is part of the general "I agree to Terms" step, you have a timing problem that no clause language can fix.
• Not logging consent events with version numbers. Without a backend record of who accepted which version of your ToS and when, you cannot prove consent in a dispute. Log IP address, timestamp, device, and document version at every acceptance event.
• Copying a competitor's ToS verbatim. Their document reflects their legal structure, jurisdiction exposure, and business model — not yours. Copying it is also copyright infringement.
• Not reviewing terms after state law changes. California's ARL was amended (effective July 1, 2025). New York's auto-renewal law was amended (effective November 2025). Any ToS not reviewed since mid-2024 almost certainly has compliance gaps in at least one of these areas.

---

Sources

• Restore Online Shoppers' Confidence Act (ROSCA), 15 U.S.C. § 8403: https://www.law.cornell.edu/uscode/text/15/8403
• FTC v. Shutterstock, Inc., No. 26-03955, S.D.N.Y. (Stipulated Order May 14, 2026 — $35M settlement): https://www.ftc.gov/news-events/news/press-releases/2026/05/shutterstock-pay-35-million-settle-ftc-allegations-over-illegal-subscription-cancellation-practices
• FTC v. Shutterstock — Proskauer Analysis (July 2026): https://newmedialaw.proskauer.com/2026/07/24/ftcs-shutterstock-settlement-signals-continued-scrutiny-of-auto-renewal-practices/
• FTC v. Shutterstock — Kelley Drye Analysis (May 2026): https://www.kelleydrye.com/viewpoints/blogs/ad-law-access/shutterstock-to-pay-35-million-over-auto-renewal-and-cancellation-practices
• FTC v. Uber Technologies, Inc. (complaint filed April 21, 2025; amended December 15, 2025): https://www.ftc.gov/legal-library/browse/cases-proceedings/2423216-uber-technologies-inc
• FTC v. Chegg, Inc. Settlement (September 15, 2025 — $7.5M): https://www.ftc.gov/legal-library/browse/cases-proceedings/2323072-chegg-inc
• Benesch Law — Chegg $7.5M Settlement Analysis and ARL Enforcement Wave: https://www.beneschlaw.com/insight/a-dozen-new-lawsuits-and-two-7-5m-settlements-signal-a-new-era-for-automatic-renewal-compliance/
• Amazon Prime FTC Settlement ($2.5B, September 25, 2025): https://www.goodwinlaw.com/en/insights/publications/2026/02/alerts-practices-ba-ftcs-click-to-cancel-rule-gets-new-life
• Arnold & Porter — FTC and State AGs on Subscription Practices (February 2026): https://www.arnoldporter.com/en/perspectives/advisories/2026/02/ftc-and-state-ags-continue-to-scrutinize-subscription-practices
• Jones Day — FTC Revives Click-to-Cancel Rule (May 2026): https://www.jonesday.com/en/insights/2026/05/ftc-revives-clicktocancel-rule-new-risks-for-subscription-businesses
• California Automatic Renewal Law Amendments, Assembly Bill No. 2863 (effective July 1, 2025): https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB2863
• Chabolla v. ClassPass Inc., No. 22-16507 (9th Cir. Feb. 27, 2025) — sign-in wrap struck down: https://www.hunton.com/privacy-and-cybersecurity-law-blog/its-a-wrap-the-latest-from-the-ninth-circuit-on-sign-in-wrap-agreements
• Domer v. Menard, 7th Cir. (September 2024) — hybridwrap guidance: https://www.techcontracts.com/2025/04/21/judicial-guidance-on-enforceable-clickwraps-and-hybrid-wraps/
• Berman v. Freedom Financial Network LLC, 9th Cir. — "reasonably conspicuous" standard: https://www.maddinhauser.com/clickwrap-v-browsewrap-recent-9th-circuit-decision-illustrates-that-enforceability-of-website-terms-and-conditions-lies-in-the-details/
• Nguyen v. Barnes & Noble, Inc., 9th Cir. (2014) — browsewrap with footer arbitration clause struck down: https://legalwritingexperts.com/business-corporate/terms-and-conditions-terms-of-service
• Ironclad — Clickwrap and browsewrap litigation success rate data: https://ironcladapp.com/journal/contract-management/6-components-of-clickwrap-enforceability
• European Commission — First DSA Non-Compliance Decision: X Fined €120M (December 5, 2025): https://digital-strategy.ec.europa.eu/en/news/commission-fines-x-eu120-million-under-digital-services-act
• Goodwin — EC Issues First DSA Fine Against X (December 2025): https://www.goodwinlaw.com/en/insights/publications/2025/12/alerts-practices-antc-ec-issues-first-non-compliance-fine-under
• EU Digital Services Act, Regulation 2022/2065: https://digital-strategy.ec.europa.eu/en/policies/dsa-enforcement
• EU Unfair Contract Terms Directive 93/13/EEC: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A31993L0013
• UK Digital Markets, Competition and Consumers Act 2024 (DMCCA): https://www.gov.uk/government/consultations/consultation-on-the-implementation-of-the-new-subscription-contracts-regime/outcome/government-response-to-consultation-on-the-implementation-of-the-new-subscription-contracts-regime-web-accessible-version
• DMCA Safe Harbor, 17 U.S.C. § 512: https://www.law.cornell.edu/uscode/text/17/512
• HK Law — How the FTC Is Stepping Up Subscription Enforcement: https://www.hklaw.com/-/media/files/insights/publications/2025/10/law360_howtheftcissteppingupsubscriptionenforcement.pdf
• Wiley — FTC Subscription Cancellation Enforcement and ROSCA Civil Penalties: https://www.wileyconnect.com/ftc-consumer-protection-and-privacy-enforcement-series-subscription-cancellation-policies-remain-a-top-ftc-priority

This article is general information, not legal advice. Laws vary by jurisdiction. Pactlio generates professional drafts for review — have a licensed attorney review anything important.