Terms of Service Guide: Consent & Enforcement (2026)
Terms of service enforceability in 2026: four-layer compliance, $2.5B+ in FTC settlements, and a 20-point self-audit scorecard for subscription businesses.
Generate a website terms in 60 seconds
Describe what you need in plain English. A panel of AI agents (Researcher, Drafter, Critic, Validator, Adversary) writes a review-ready draft you can edit, sign, and send.
What Makes a Terms of Service Agreement Actually Enforceable?
A terms of service (ToS) is a legally binding contract between you and every person who uses your website or app. It caps liability, establishes IP ownership, sets rules for use, and controls how disputes are resolved. A well-written ToS is worthless, however, if users never validly agreed to it — and courts in 2025–2026 are just as likely to examine your consent UI and cancellation flow as your clause language.
Key takeaways
- A ToS is a four-layer system: document quality, consent architecture, cancellation UX, and evidence logging. Failure at any single layer can make the others irrelevant.
- Clickwrap achieved approximately a 70% litigation success rate; browsewrap achieved only about 14%, per Ironclad's analysis.
- The Ninth Circuit struck down a sign-in wrap on February 27, 2025 (Chabolla v. ClassPass) because the terms link was too small relative to surrounding elements.
- ROSCA (15 U.S.C. § 8403) civil penalties reach $53,088 per violation. The FTC settled with Amazon for $2.5 billion (September 2025) and Shutterstock for $35 million (May 2026) — both companies had written ToS documents. Both failed at the other three layers.
- The EU's Digital Services Act has applied to all online platforms since February 17, 2024. The European Commission fined X €120 million under the DSA on December 5, 2025.
Why Most ToS Failures Are Operational, Not Textual
Every standard guide to terms of service focuses on clauses. That framing is incomplete. The 2025–2026 FTC enforcement wave produced nine-figure settlements and not one turned on bad clause language. They all failed at one or more of the other three layers: consent architecture, cancellation UX, or evidence logging.
| Layer | What It Is | What Failure Looks Like |
|---|---|---|
| 1 — Document | The written agreement: clauses, scope, jurisdiction | Missing clauses; stale law; marketing that contradicts the document |
| 2 — Consent Architecture | How users are shown the terms and how they signal agreement | Browsewrap; sign-in wrap with small-font links; pre-checked boxes |
| 3 — Cancellation UX | How easily users can stop a recurring charge | 8-screen flows; phone-only cancellation; save-offer screens that hide the cancel button |
| 4 — Evidence Logging | Your backend record of who agreed to what and when | No version stamps; no timestamp logs; no immutable audit trail |
The Shutterstock case — all three non-document layers failed simultaneously. On May 13, 2026, the FTC filed and simultaneously settled claims against Shutterstock for $35 million (FTC v. Shutterstock, Inc., No. 26-03955, S.D.N.Y., stipulated order entered May 14, 2026).
Layer 1 failure — marketing contradicted the document. Shutterstock marketed on-demand image packs as "best for a one-time project" with "no commitment." The actual subscription terms — auto-renewal plus a one-year renewal trigger — appeared in gray text below the call-to-action button and were omitted entirely from the final enrollment screen. The FTC found that a "no commitment" headline cannot be cured by buried fine print.
Layer 3 failure — eight-screen cancellation. Before 2024, consumers could not cancel online at all. After that, the FTC complaint described a "multi-step, eight-screen online cancellation flow." ROSCA requires a "simple mechanism" to stop recurring charges; the FTC treats eight screens as the structural opposite of simple. When an employee flagged the FTC's 2024 lawsuit against Adobe, a Senior Product Manager responded: "hopefully we can get away with it." That message became exhibit-level evidence in a federal enforcement complaint.
The Amazon summary judgment (September 19, 2025) established that collecting billing information before disclosing material subscription terms is a per se ROSCA violation — regardless of what appears in the terms document itself.
Which Consent Mechanism Should You Use?
Courts evaluate consent on a spectrum. The mechanism must match the stakes of the transaction — account creation, purchase, subscription enrollment, and data processing each carry legal consequences requiring defensible consent design.
| Consent Type | How It Works | Litigation Success | Best Use Case |
|---|---|---|---|
| Scroll-wrap | User must scroll to bottom before "I Agree" activates | Very high | High-stakes consumer agreements |
| Clickwrap | User clicks "I Agree" or checks a dedicated unchecked box | ~70% | SaaS sign-up, subscriptions, purchases |
| Sign-in wrap | Notice near a login button; no separate click required | Mixed — design-dependent | Higher risk; outcome varies by font size and link prominence |
| Hybridwrap | Notice present; implicit agreement via submit/purchase | Moderate | E-commerce checkout, B2B |
| Browsewrap | Footer link; continued use equals acceptance | ~14% (consumer); higher for sophisticated B2B | Informational sites only; narrow B2B exception |
The design standard in two decisions. In Berman v. Freedom Financial Network (9th Cir.), terms appeared in "tiny" font "considerably smaller than the font used in the surrounding website elements" and "barely legible to the naked eye" — struck down. In Domer v. Menard (7th Cir., September 2024), the Seventh Circuit upheld a hybridwrap that placed the terms link close to the purchase button with explicit language, used contrasting text, and gave users a real opportunity to review.
The January 2026 case OCLC, Inc. v. Anna's Archive offers one browsewrap exception: a federal court upheld browsewrap terms against a sophisticated B2B party that accessed the service repeatedly and was deemed to have accepted terms through its pattern of use. For consumer-facing platforms, this exception will not apply.
For broader guidance on how electronic consent works across contract types, see how to sign a contract online and what makes a contract legally binding.
The 10 Essential Clauses Every Terms of Service Needs
| Clause | What It Does | Why It Matters |
|---|---|---|
| Acceptance of Terms | Establishes how agreement is formed (clickwrap preferred) | Foundational — all other clauses depend on valid acceptance |
| Service Description | Defines what you offer, availability, and scope limitations | Limits reasonable-expectation claims; sets the consideration |
| User Obligations & Acceptable Use | Lists prohibited activities; sets minimum age (13 under COPPA, 16 under GDPR) | Contractual right to terminate bad actors; COPPA compliance |
| Intellectual Property | Claims platform content ownership; grants you a license to user-generated content | Prevents infringement; enables DMCA safe harbor under 17 U.S.C. § 512 |
| Limitation of Liability | Caps your exposure; disclaims warranties | Highest-value protective clause for businesses |
| Dispute Resolution | Arbitration, governing law, informal notice period | Controls venue and eliminates class actions if drafted correctly |
| Auto-Renewal / Payment Terms | Discloses billing cycles, price changes, trial-to-paid conversions | Mandatory under ROSCA, California ARL, New York GBL § 527-a |
| Modification Clause | Reserves the right to update terms; sets notice method | Prevents users from freezing you on outdated terms; must include actual notice |
| Termination Rights | Outlines when you can suspend or close accounts | Lets you act without proving a separate legal wrong |
| Privacy Policy Reference | Cross-links your data handling document | Legally required under GDPR Article 13 and CCPA |
One clause competitors routinely underplay: mass arbitration risk. A well-drafted arbitration clause eliminates class actions — but the same clause, if activated against a large user base, can generate thousands of individual arbitration demands simultaneously. JAMS filing fees (currently $1,750 per claimant for the first filing) can reach into the hundreds of millions of dollars when aggregated at scale. Companies including DoorDash and Uber have faced this dynamic. The practical fix is a small-claims carve-out, a bellwether-trial process, and a staged arbitration procedure.
For detailed guidance on limitation of liability, see limitation of liability in contracts. For dispute resolution design and mass arbitration risk, see arbitration clause explained.
Auto-Renewal Terms: The FTC's Highest-Priority Enforcement Zone
If your product charges recurring fees, your ToS's auto-renewal section carries more legal risk than any other clause right now. The FTC under multiple administrations has made subscription cancellation an explicit enforcement priority.
The federal baseline — ROSCA (15 U.S.C. § 8403). Any online subscription must (1) clearly and conspicuously disclose all material terms before collecting billing information, (2) obtain express informed consent before billing, and (3) provide a simple mechanism to stop recurring charges. Violations carry civil penalties up to $53,088 per violation.
The FTC's Click-to-Cancel Rule was vacated by the Eighth Circuit in July 2025 on procedural grounds, but the FTC submitted an Advance Notice of Proposed Rulemaking (ANPRM) to OIRA on January 30, 2026, and formally announced it in March 2026. ROSCA enforcement authority was not affected by the vacatur. FTC Bureau of Consumer Protection Director Christopher Mufarrige reaffirmed on March 5, 2026 that the agency remains committed to "combating deceptive negative option subscriptions."
The 2025–2026 enforcement scorecard:
| Case | Date | Amount | Core Violation |
|---|---|---|---|
| Match Group (Match.com) | Aug. 12, 2025 | $14M | Multi-step cancellation; misleading guarantees; locked out accounts post-dispute |
| Amazon Prime | Sept. 25, 2025 | $2.5B ($1B penalties + $1.5B refunds) | Billing before material terms disclosed; dark-pattern cancellation |
| Chegg | Sept. 15, 2025 | $7.5M | Multi-page cancellation maze; 200K customers charged after requesting cancellation |
| Instacart | Dec. 18, 2025 | $60M consumer refunds | Free trials auto-enrolling into paid annual plan without adequate notice |
| Cleo AI | March 2025 | $17M | Difficult cancellation; advertised cash advances not delivered as described |
| LA Fitness | Aug. 20, 2025 | Ongoing | Mail-only cancellation; staff trained to reject requests |
| HelloFresh (CART) | Aug. 18, 2025 | $7.5M | Failed to disclose subscription terms before collecting payment |
| JustAnswer | Jan. 13, 2026 | Ongoing | Subscription charges without adequate prior disclosure |
| Uber One | Filed Apr. 2025; amended Dec. 2025 | Ongoing | 28M consumers enrolled; 21 state co-plaintiffs; complex cancellation flow |
| Shutterstock | May 13, 2026 | $35M | "No commitment" packs that auto-renewed; omitted terms on final screen; 8-screen cancellation |
A critical pattern from the Uber case: ROSCA requires material subscription terms to be disclosed before obtaining billing information. When a user has already stored payment credentials from a prior transaction (e.g., ordering a ride), the FTC's position is that a new subscription enrollment must still present all material terms before any charge — a stored card on file does not satisfy the pre-billing disclosure requirement.
State law adds another layer. Approximately 30 states have enacted their own automatic-renewal or negative-option laws. The requirements vary significantly:
| State | Law | Key Requirements | Effective |
|---|---|---|---|
| California | Bus. & Prof. Code § 17600 et seq. (amended AB 2863) | Annual reminder before yearly renewals; one-click online cancellation for online enrollees | July 1, 2025 |
| Colorado | Colorado ARL (amended SB 145) | "One-step online cancellation" for consumers who enrolled online; extended to B2B | Feb. 16, 2026 |
| Connecticut | SB 3 (amends existing ARL) | Annual renewal reminder regardless of subscription length; 1-business-day voicemail processing | July 1, 2026 |
| Maine | SP 650 | Separate consumer consent to auto-renewal provision; 3× refund for unauthorized charges | Jan. 1, 2026 |
| Maryland | Ch. 204 (first ARL statute) | Notice before trial ends; clear alternative cancellation for those unable to cancel online | June 1, 2026 |
| Massachusetts | 940 CMR 38.00 | Pre-renewal notice; same-medium cancellation (internet enrollment = internet cancellation) | Sept. 2, 2025 |
| Minnesota | Minn. Stat. § 325G.57 | No save offers unless the customer affirmatively consents to receive them | 2025 |
| New York | GBL § 527-a (amended 2025) | Affirmative consent to price increases OR 14-day cancel right with pro-rata refund; "cancel" button in mobile apps | Nov. 2025 |
For a deep dive on drafting a compliant auto-renewal clause, see auto-renewal clause explained. SaaS operators should also check the SaaS subscription agreement guide.
What a Compliant Subscription Enrollment Flow Looks Like: Screen by Screen
Most enforcement failures happen at the screen level, not the document level. Here is what a three-screen subscription enrollment looks like when it passes all four layers versus when it replicates the patterns regulators have penalized.
Screen 1 — Plan Selection
| Element | Non-Compliant Pattern | ROSCA-Compliant Pattern |
|---|---|---|
| Headline | "Start Free — No Commitment" | "Start Your 14-Day Free Trial" |
| Pricing shown | "$29/month" (promotional price only) | "$29/month for 14 days, then $49/month. Cancel anytime." |
| Renewal disclosure | None on this screen | "Your plan renews automatically on [date]. Cancel in your account settings." |
| Terms link | Gray text in page footer, 9px font | Bold, underlined link directly below the CTA button |
| Consent mechanism | Implicit: clicking "Continue" enrolls | Unchecked checkbox: "I agree to the Terms of Service and understand my subscription renews at $49/month unless cancelled." |
Screen 2 — Payment Collection
| Element | Non-Compliant Pattern | ROSCA-Compliant Pattern |
|---|---|---|
| Material terms shown | Payment form only; no reference to renewal terms | Summary box above payment form: "Trial ends [date]. Charge: $49/month." |
| Timing of disclosure | Terms referenced only after billing info entered | Full disclosure before any billing field is shown |
| Consent step | General ToS checkbox from Screen 1 only | Second, standalone checkbox: "I authorize recurring monthly charges of $49/month until I cancel." |
Screen 3 — Confirmation
| Element | Non-Compliant Pattern | ROSCA-Compliant Pattern |
|---|---|---|
| Confirmation email | "Welcome! Your account is ready." | "Your trial starts today. On [date], your card will be charged $49/month. Cancel at [direct URL] in ≤3 clicks." |
| Cancellation path | Not mentioned | Direct link to cancellation on confirmation page and in email |
| Evidence logged | Timestamp only | Timestamp UTC, IP, device/browser, ToS version hash, subscription consent checkbox state |
The Amazon ROSCA summary judgment confirmed that collecting billing information before disclosing material subscription terms is a per se violation — regardless of what appears in the terms document. Screen 2's disclosure timing is the highest-stakes moment in any enrollment flow.
The 20-Point ToS Self-Audit Scorecard
Score 1 point for each item fully satisfied. This tool lets you identify which of the four layers is your highest-risk area.
Layer 1 — Document Quality (5 points)
- All 10 core clauses are present and customized to your actual business model — not generic template language.
- Auto-renewal terms appear as a standalone section, disclosing price, billing frequency, promotion end date, post-promotional price, and trial conversion terms explicitly.
- Written in plain English throughout: no "whereas," "hereinafter," or "notwithstanding the foregoing."
- Jurisdiction-specific sections address the EU DSA (if you serve EU users), California ARL (California subscribers), New York GBL § 527-a (New York subscribers), and Colorado's one-step cancellation requirement (Colorado subscribers).
- Reviewed within the past 12 months, or within 30 days of any material change to your business model or applicable law.
Layer 2 — Consent Architecture (5 points)
- Clickwrap is used for account creation: a dedicated, unchecked checkbox adjacent to the submit button with language "I have read and agree to the Terms of Service."
- A second, separate clickwrap step is used for any subscription or recurring charge enrollment — not bundled into general signup acceptance.
- The terms link is displayed in body-size, visually distinct (contrasting color) type, not gray text below the fold.
- No pre-checked consent boxes anywhere in the flow. EU law under GDPR Article 7 explicitly prohibits them for data consent; US courts treat them as invalid consent evidence.
- The auto-renewal disclosure appears before you collect payment information (ROSCA § 8403 requirement confirmed in the Amazon summary judgment, September 2025).
Layer 3 — Cancellation UX (5 points)
- Online cancellation is available 24/7 without requiring users to contact support by phone or email.
- Cancellation completes in ≤3 screens from the account dashboard.
- The cancellation method matches the enrollment method: if a user enrolled online, online cancellation is available without exception. Massachusetts, Maryland, and New York all mandate this.
- No save-offer screen that obscures the cancel button or adds a mandatory delay. Minnesota specifically prohibits save offers without prior affirmative consent.
- Written confirmation of cancellation is delivered immediately, stating the effective date and any refund amount.
Layer 4 — Evidence Logging (5 points)
- Each consent event logs: timestamp in UTC, IP address, device and browser string, and the exact ToS version number or hash accepted.
- A versioned archive of every historical ToS is maintained and retrievable by version ID and effective date.
- The consent log is immutable: append-only, no updates or deletions; cancellation events are logged as new records.
- Consent records are retained for a minimum of five years; subscription businesses should target 10 years, consistent with retention periods in recent FTC consent orders.
- Cancellation requests are logged with date, time, method of request, and a confirmation ID that can be produced in response to a regulatory inquiry.
Scoring: 18–20 = low risk. 12–17 = moderate risk — address gaps before your next annual review. Below 12 = high risk — reassess before your next subscription renewal cycle.
Generate your Website Terms of Service with Pactlio's AI agents — Researcher, Drafter, Critic, Validator, and Adversary — debating and refining the language against your specific platform model before you review a word.
Jurisdiction Requirements: What Your ToS Must Address by Region
You don't need four separate documents — but you do need explicit, jurisdiction-specific provisions.
| Jurisdiction | Key Law | What Your ToS Must Address |
|---|---|---|
| United States (federal) | ROSCA (15 U.S.C. § 8403); COPPA; FTC Act § 5 | Auto-renewal disclosures before billing; parental consent for under-13 users; simple cancellation mechanism |
| California | Bus. & Prof. Code § 17600 et seq.; CCPA/CPRA | Annual renewal reminders; one-click online cancellation; data rights cross-reference |
| European Union | EU Unfair Contract Terms Directive 93/13/EEC; Consumer Rights Directive; Digital Services Act (Regulation 2022/2065); GDPR | Plain language; advance notice of material changes; content moderation appeals; GDPR Article 13 cross-reference |
| United Kingdom | Digital Markets, Competition and Consumers Act 2024 (DMCCA) | Unfair commercial practices provisions effective April 2025; CMA can fine up to 10% of global group turnover |
| All jurisdictions | General contract law | Governing law clause; dispute resolution; valid documented consent |
DSA specifics. The Digital Services Act has applied to all online platforms since February 17, 2024. DSA Article 17 requires any platform that restricts content or suspends accounts to explain the decision and provide an appeal mechanism. DSA Article 25 prohibits deceptive design practices — this is the provision under which the European Commission fined X €120 million on December 5, 2025. That fine covered three violations: €45 million for the deceptive blue-checkmark design (Article 25), €40 million for inadequate researcher data access (Article 40), and €35 million for an incomplete advertising repository (Article 26). Fines for very large online platforms (45M+ monthly EU users) can reach 6% of global annual turnover.
For the full GDPR impact on your ToS and privacy policy, see the GDPR compliance guide and how to create a privacy policy. E-commerce operators should also review the e-commerce contracts guide. For a comprehensive map of state-level privacy and auto-renewal laws, see the state privacy laws 2026 guide.
Common Mistakes to Avoid
- Relying on browsewrap for any transaction with legal consequences. Footer links alone achieve only about a 14% litigation success rate. The narrow B2B browsewrap exception (OCLC v. Anna's Archive, Jan. 2026) does not apply to consumer-facing platforms.
- Marketing a product as "no commitment" or "one-time" when it auto-renews. The Shutterstock $35M FTC settlement turned on exactly this gap between headline marketing and billing reality. Prominent claims cannot be contradicted by buried fine-print disclosures.
- Building more than three steps into your cancellation flow. The Chegg complaint described "multiple confusing pages." The Shutterstock complaint described an eight-screen flow. ROSCA requires a "simple mechanism" — regulators treat complexity itself as a violation.
- Bundling subscription consent into general signup acceptance. ROSCA requires disclosure of all material subscription terms before billing information is collected. A subscription checkbox bundled into general ToS acceptance fails the timing requirement, as the Amazon summary judgment confirmed.
- Ignoring mass arbitration exposure. An arbitration clause that eliminates class actions can generate thousands of individual demand filings simultaneously. Without a bellwether process or fee-shifting structure, that clause becomes your most expensive contractual liability, not your most protective one.
- Not logging consent events with version numbers. Without a backend record of who accepted which version of your ToS and when, you cannot prove consent in a dispute. Log IP address, timestamp, device, and document version at every acceptance event.
- Not reviewing terms after state law changes. California's ARL amended effective July 1, 2025. Colorado's one-step cancellation requirement took effect February 2026. Maryland enacted its first ARL effective June 2026. Connecticut's annual reminder requirement takes effect July 2026. Any ToS not reviewed since mid-2024 almost certainly has compliance gaps.
Sources
- Restore Online Shoppers' Confidence Act (ROSCA), 15 U.S.C. § 8403: https://www.law.cornell.edu/uscode/text/15/8403
- FTC v. Shutterstock, Inc., No. 26-03955, S.D.N.Y. (Stipulated Order May 14, 2026 — $35M settlement): https://www.ftc.gov/news-events/news/press-releases/2026/05/shutterstock-pay-35-million-settle-ftc-allegations-over-illegal-subscription-cancellation-practices
- Match Group Agrees to Pay $14 Million — FTC Press Release (Aug. 12, 2025): https://www.ftc.gov/news-events/news/press-releases/2025/08/match-group-agrees-pay-14-million-permanently-stop-deceptive-advertising-cancellation-billing
- FTC v. Amazon.com, Inc. Settlement ($2.5B, September 25, 2025): https://www.ftc.gov/news-events/news/press-releases/2025/09/ftc-secures-historic-multibillion-dollar-settlement-amazon-prime
- FTC v. Chegg, Inc. Settlement ($7.5M, September 15, 2025): https://www.ftc.gov/legal-library/browse/cases-proceedings/2323072-chegg-inc
- Instacart Settlement ($60M consumer refunds, December 18, 2025): https://www.ftc.gov/news-events/news/press-releases/2025/12/instacart-pay-60-million-consumer-refunds-settle-ftc-lawsuit-over-allegations-it-engaged-deceptive
- FTC v. JustAnswer LLC, No. 3:26-cv-00333 (N.D. Cal. Jan. 13, 2026): https://www.ftc.gov/legal-library/browse/cases-proceedings/2423217-justanswer-llc
- FTC v. Uber Technologies, Inc. (complaint filed April 21, 2025; amended December 15, 2025): https://www.ftc.gov/legal-library/browse/cases-proceedings/2423216-uber-technologies-inc
- Arnold & Porter — FTC and State AGs on Subscription Practices (February 2026): https://www.arnoldporter.com/en/perspectives/advisories/2026/02/ftc-and-state-ags-continue-to-scrutinize-subscription-practices
- Jones Day — FTC Revives Click-to-Cancel Rule (May 2026): https://www.jonesday.com/en/insights/2026/05/ftc-revives-clicktocancel-rule-new-risks-for-subscription-businesses
- Goodwin — FTC Click-to-Cancel Rule Gets New Life (February 2026): https://www.goodwinlaw.com/en/insights/publications/2026/02/alerts-practices-ba-ftcs-click-to-cancel-rule-gets-new-life
- ZwillGen — Automatic Renewal Mid-Year Update (2025–2026): https://www.zwillgen.com/auto-renewal/auto-renewal-update-legal-landscape-imposes-complex-obligations-subscription-businesses/
- ADventures in Law — Staying Ahead of Enforcement: State ARL Landscape (2025–2026): https://www.adventures-in-law.com/blogs/staying-ahead-of-enforcement-practical-compliance-with-automatic-renewal-laws/
- KO Firm — Colorado ARL Amendments (February 2026): https://kofirm.com/patchwork-of-state-automatic-renewal-requirements-expands-with-updated-colorado-law
- California Automatic Renewal Law Amendments, Assembly Bill No. 2863 (effective July 1, 2025): https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB2863
- New York General Business Law § 527-a (2025 amendments): https://www.nysenate.gov/legislation/laws/GBS/527-A
- Minnesota Statutes § 325G.57 (2025): https://www.revisor.mn.gov/statutes/cite/325G.57
- Chabolla v. ClassPass Inc., No. 22-16507 (9th Cir. Feb. 27, 2025): https://www.hunton.com/privacy-and-cybersecurity-law-blog/its-a-wrap-the-latest-from-the-ninth-circuit-on-sign-in-wrap-agreements
- Domer v. Menard, 7th Cir. (September 2024) — hybridwrap guidance: https://www.techcontracts.com/2025/04/21/judicial-guidance-on-enforceable-clickwraps-and-hybrid-wraps/
- Berman v. Freedom Financial Network LLC, 9th Cir. — "reasonably conspicuous" standard: https://www.maddinhauser.com/clickwrap-v-browsewrap-recent-9th-circuit-decision-illustrates-that-enforceability-of-website-terms-and-conditions-lies-in-the-details/
- Ironclad — Clickwrap and browsewrap litigation success rate data: https://ironcladapp.com/journal/contract-management/6-components-of-clickwrap-enforceability
- European Commission — First DSA Non-Compliance Decision: X Fined €120M (December 5, 2025): https://digital-strategy.ec.europa.eu/en/news/commission-fines-x-eu120-million-under-digital-services-act
- EU Digital Services Act, Regulation 2022/2065: https://digital-strategy.ec.europa.eu/en/policies/dsa-enforcement
- EU Unfair Contract Terms Directive 93/13/EEC: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A31993L0013
- UK Digital Markets, Competition and Consumers Act 2024: https://www.gov.uk/government/consultations/consultation-on-the-implementation-of-the-new-subscription-contracts-regime/outcome/government-response-to-consultation-on-the-implementation-of-the-new-subscription-contracts-regime-web-accessible-version
- DMCA Safe Harbor, 17 U.S.C. § 512: https://www.law.cornell.edu/uscode/text/17/512
- FTC Shutterstock Settlement — Proskauer Analysis (July 2026): https://newmedialaw.proskauer.com/2026/07/24/ftcs-shutterstock-settlement-signals-continued-scrutiny-of-auto-renewal-practices/
- Benesch Law — Automatic Renewal Enforcement Wave: https://www.beneschlaw.com/insight/a-dozen-new-lawsuits-and-two-7-5m-settlements-signal-a-new-era-for-automatic-renewal-compliance/
This article is general information, not legal advice. Laws vary by jurisdiction. Pactlio generates professional drafts for review — have a licensed attorney review anything important.
Frequently Asked Questions
Are terms of service legally required for a website?▾
Terms of service are not universally required by law, but e-commerce platforms, SaaS products, and any service charging recurring fees are effectively required to have them to comply with ROSCA and the EU Consumer Rights Directive. Without a ToS, you lose the contractual basis to terminate abusive accounts, cap liability, or enforce an arbitration clause.
What is the difference between clickwrap and browsewrap?▾
Clickwrap requires users to click 'I Agree' or check a dedicated box before proceeding — courts uphold these at roughly a 70% success rate. Browsewrap relies on a footer notice claiming continued use equals acceptance, with only about a 14% litigation success rate per Ironclad's analysis. For any transaction with legal consequences, clickwrap is the only defensible choice.
What is a sign-in wrap agreement, and is it enforceable?▾
A sign-in wrap places a notice like 'By signing up, you agree to our Terms' near a login button without a separate checkbox. Courts evaluate enforceability on font size and link prominence. In Chabolla v. ClassPass (9th Cir. Feb. 2025), the Ninth Circuit struck one down for insufficiently visible terms. Clickwrap remains the safest design.
How often should I update my terms of service?▾
Review your ToS every 6–12 months and immediately after any change to your business or applicable law. California's Automatic Renewal Law amended July 1, 2025. New York's law amended November 2025. Maryland enacted its first ARL effective June 2026. Colorado requires one-step online cancellation effective February 2026. Material changes require notifying users before new terms take effect.
Do I need separate terms of service for users in different countries?▾
You don't need separate documents, but you need jurisdiction-specific sections or addenda. EU users trigger the Digital Services Act, the Unfair Contract Terms Directive, and GDPR. California users trigger the state's Automatic Renewal Law. UK users trigger the Digital Markets, Competition and Consumers Act 2024. A single ToS can address multiple jurisdictions through clearly labeled addenda.
Can my terms of service limit my liability entirely?▾
No. Limitation of liability clauses have hard ceilings in every major jurisdiction. EU consumer law prohibits excluding liability for death or personal injury caused by negligence. US courts strike down clauses that are unconscionable or contrary to public policy. A clearly presented cap tied to amounts paid in the past 12 months is your strongest practical protection.
What did the Shutterstock FTC settlement reveal about auto-renewal disclosures?▾
The FTC's May 2026 $35 million settlement found that Shutterstock marketed products as 'no commitment' while burying auto-renewal terms and running an eight-screen cancellation flow. A written ToS existed. The violations were at the consent architecture and cancellation UX layers — not clause language — which is the pattern across every major FTC subscription settlement since 2025.
What happens if a user violates my terms of service?▾
With a valid ToS and documented consent, you can typically suspend or terminate the user's account, pursue breach-of-contract damages, or seek injunctive relief. Your right to act depends on having presented terms clearly and captured valid consent. A strong termination clause gives you a contractual basis to act without proving a separate legal wrong.