Store build, checkout, subscriptions and the growth work after. One piece or the lot, quoted and dated before it starts.
Supplements, drinks, wellness, skincare. Different products, one billing problem.
In July last year a federal court threw out the click-to-cancel rule, six days before it was due to bite. Plenty read the headline and stopped worrying.
California's version had taken effect the week before. Nothing happened to it.
So through 2026, if you sell on repeat here, the rule binding you is the state one, and it asks for more than the federal one that died.
In short
Ecomm Wizards is an ecommerce agency San Diego brands hire to build stores, checkouts and subscription flows. We work on Shopify and Shopify Plus. The cancel path, the consent record and the renewal notice get built in, not bolted on later.
Supplements, protein, pet food, skincare, coffee. The products this metro is built on get used up, which is why so many sell on subscription rather than a cart.
That model is a good one. It also changes what your store legally is. A one-off purchase is a sale. A recurring one is a contract that renews itself, with its own rules.
Most of that lands on the checkout and the account page, which means it lands on whoever built them. Nobody told them.
Happy Mammoth
Sneak Energy
VITHIT
The FTC's click-to-cancel rule was vacated in full on 8 July 2025, six days before its compliance date. The court never reached whether the rule was a good idea. It threw it out because the agency skipped a required cost analysis.
So the federal floor went back to what it was. As of September 2026 that means ROSCA: it covers every online seller running a renewal, carries civil penalties, and the FTC keeps bringing cases under it.
California's Automatic Renewal Law took effect on 1 July 2025 and was untouched by any of that. Eight days earlier, and it survived what killed the federal rule.
It's stricter, and today that means four things. Consent to renew has to be its own step, not part of your terms checkbox. Cancellation has to work in the medium they signed up in, so a web signup needs a web cancel. Free trials rolling into paid are covered. And you keep proof of consent three years, or a year past cancellation, whichever is longer.
Which puts your retention team and your obligations on opposite sides of one screen. Every save step sits between a Californian customer and a button they're entitled to reach. One has to give way, and it can't be the button.
That's a build problem before it's a legal one. The checklist below turns it into settings somebody can change.
What we do
Each is sold separately and each row is a store we shipped. That's what an ecommerce agency San Diego engagement should let you buy.
Subscriptions and recurring billing
Most subscription work stops once billing works. The parts that decide whether it holds up come after.
Checkout and conversion
Store design and build
Growth and lifecycle
The ecommerce marketing San Diego brands buy from us is the lifecycle half: email, retention, and reporting that shows which of it paid.
The federal floor and California's stricter requirement side by side, each translated into something you can change in a store. Current as of 11 September 2026, re-checked every 90 days.
| Requirement | Federal floor, Sept 2026 | California ARL | What to configure |
|---|---|---|---|
| Cancellation mechanism paritySubscribed on the web means cancel on the web. A support email address is not a cancellation mechanism, and it's the most common thing we find. | ROSCA: no dark patterns | Same medium as signup | Self-serve cancel in the account page |
| Pre-purchase disclosure placementCharge amount, frequency and how to get out, visible before they commit, not after. | Clear and conspicuous | Before the consent step | Terms rendered on the product page and in cart |
| Affirmative consent captureBundling renewal consent into your terms acceptance fails this. So does a pre-ticked box. It has to be deliberate. | ROSCA: express informed consent | Its own separate step | A dedicated unticked checkbox, not your terms box |
| Renewal reminder timingHas to name the product, the amount, the frequency and how to cancel. Your app can send it; almost none do by default. | Not mandated federally | Annual reminder required | Scheduled notification with the required fields |
| Save-offer rules before cancellationA save offer is allowed. Making it a required step on the way out is not. Beside the button, never before. | No obstruction | Cannot impede the cancel path | Offer alongside, never in front |
| Record retentionWhichever is longer. Nobody builds this row, and it's the one you need the day somebody asks. | Keep proof of consent | 3 years, or 1 year past termination | Consent event stored with a timestamp |
Read down the third column and almost none of this is a legal question by the time it reaches you. It's a checkbox that shouldn't be pre-ticked, a cancel link that should exist, and a record written when consent happens. Every one is a default somebody accepted when the app went in. A legal review will tell you they're wrong. It won't tell your developer which of four places the cancel path is defined in.
The last row catches people. Consent you can't produce is consent you didn't get, as far as anyone reviewing it goes. No app we've seen stores it in a form you'd want to hand over. Anyone on your ecommerce agency San Diego shortlist should tell you where that record lives.
Cancellation behind a support email. Common on older builds, reads as helpful, fails the medium test.
Consent bundled into the terms checkbox. One box covering terms, privacy and renewal. California asks for the last on its own.
Renewal notices on a schedule nobody set. The app sends something nobody configured against a requirement, and the copy omits the way out.
Self-serve cancels are native. Shopify Subscriptions lets a customer pause, skip, reschedule or cancel from their account, covering the mechanism half of row one.
Renewal notices are configurable with editable templates. What isn't native is any check that the wording carries the fields California asks for.
A separate consent step is not native. It needs checkout customization on Plus, or an app rendering its own.
Durable consent records are the real gap. Nothing stores the event as evidence you'd hand counsel, so we build that record ourselves.
Nobody here is in the city, and for this work that changes nothing. What matters is who answers and what you keep.
Same for the repository, the theme and the design files. All of it sits in your accounts from day one, so there's nothing to hand back.
They decide where the line sits. We move the configuration and hand back a note of what changed.
Cutovers go out on Pacific hours, not ours, so someone your side is awake when it flips.
Your scope, your number, your date, agreed up front. Change one and it goes back through a quote before a developer.
The federal one did, on 8 July 2025. The FTC opened a replacement rulemaking in March 2026, so check the date on anything you read about this, this page included.
Two things survived. ROSCA, which covers online renewals and carries penalties, and California's own law, which took effect a week earlier, untouched.
So the headline was true and the conclusion most people drew wasn't.
Some are, for the rows they control. None controls all six.
An app gives a customer a cancel button. It can't stop your theme burying the account page, separate your consent checkbox from your terms box, or keep a record you'd hand a regulator.
Ask which rows your vendor will put in writing.
Some, and it's fair to weigh rather than dismiss, and no ecommerce agency San Diego brands hire should tell you otherwise.
The people a hard cancel path retains are mostly the ones who churn angry later, and a save offer beside the button still works. It just can't be a toll gate.
The law made that trade for you. Your room is in what you offer, not in how hard you make leaving.
Week one is an audit against the six rows above, on your store, not a questionnaire. You keep the findings.
Then a number and a date, in writing.
The work is the cancellation path, the consent step, the renewal notification, the record proving all three, and whatever else the store needs while we're in it.
Builds run $5,000 to $50,000 depending on how much is custom, and a compliance-only pass costs a fraction of that. Any ecommerce agency San Diego quote should separate the two, because they're different jobs.
In California, canceling in the same medium they signed up in. Web signup means web cancellation, no phone call or email to support. You can ask why they're leaving and make an offer. Neither can be a condition of getting out.
Yes, if it sits beside the cancel option rather than in front of it. The line is obstruction. An offer they can ignore in one click is fine. A screen they have to get past is what gets named in enforcement actions.
Proof they agreed to the renewal terms. Keep it three years, or one year past the end of the contract if that runs longer. In practice: store the consent event with a timestamp. A subscription record alone doesn't show what they saw.
For most of it, no. Self-serve cancels and renewal notices work on standard Shopify. The row that needs Plus is the separate consent step, because that's a checkout change. The alternative is an app rendering its own.
We build on Shopify and Shopify Plus, and most of what we're asked for is a move onto one. If you're on something else, we'd look at what it's costing you first. The six obligations apply whatever you run.
A build runs $5,000 to $50,000, fixed before anyone starts, and where it lands depends on how much is custom. A compliance-only pass on a working store is priced separately and costs far less.
No, and there isn't one to visit. We work remotely with brands across the country. The checklist above is the part of local that changes what your store does.
No, and we aren't lawyers. It's a configuration checklist with its sources named, so your counsel has something to review and your developer something to change. We work alongside your lawyer, never in place of one.
Next step
You already know whether somebody can cancel without emailing you.
Send the link they'd use. We'll audit it against all six rows and hand you the findings:
It stops at the findings, and it's a configuration review, not a legal opinion. Take it to your counsel.
No charge, and the write-up stays yours whatever you decide.
The reply comes from whoever would do the work, inside a working day.
