Store build, checkout, subscriptions and the growth work after. One piece or the lot, quoted and dated before it starts.
Supplements, drinks, wellness, skincare. Different products, one billing problem.
In July last year a federal court threw out the click-to-cancel rule, six days before it was due to bite. Plenty of people read the headline and stopped worrying.
California's version had taken effect the week before. Nothing happened to it.
So through 2026, if you sell on repeat here, the rule binding you has been the state one. It asks for more than the federal one that died.
In short
Ecomm Wizards is an ecommerce agency San Diego brands hire to build stores, checkouts and subscription flows. We work on Shopify and Shopify Plus. The cancel path, the consent record and the renewal notice get built in, not bolted on later.
Supplements, protein, pet food, skincare, coffee. The products this metro is built on get used up, which is why so many sell on subscription rather than a cart.
That model is a good one. It also changes what your store legally is. A one-off purchase is a sale. A recurring one is a contract that renews itself, and those have their own rules.
Most of that lands on the checkout and the account page, which means it lands on whoever built them. Usually nobody told them.
Happy Mammoth
Sneak Energy
VITHIT
The FTC's click-to-cancel rule was vacated in full on 8 July 2025, six days before its compliance date. The court never reached whether the rule was a good idea. It threw it out because the agency skipped a required cost analysis.
So the federal floor went back to what it was. As of September 2026 that means ROSCA, which covers every online seller running a renewal, carries civil penalties, and which the FTC keeps bringing cases under.
California's Automatic Renewal Law took effect on 1 July 2025 and was untouched by any of that. Eight days earlier, and it survived what killed the federal rule.
It's also stricter, and today that means four things. Consent to renew has to be its own step, not part of your terms checkbox. Cancellation has to work in the medium they signed up in, so a web signup needs a web cancel. Free trials that roll into paid are covered. And you keep proof of consent three years, or a year past cancellation, whichever is longer.
Which puts your retention team and your obligations on opposite sides of one screen. Every save step in a cancellation flow sits between a Californian customer and a button they're entitled to reach. One of those has to give way, and it can't be the button.
That's a build problem before it's a legal one. The checklist below turns it into settings somebody can change.
What we do
Each is sold separately, and each row is a store we shipped. That's what an ecommerce agency San Diego engagement should let you buy.
Subscriptions and recurring billing
Most subscription work stops once billing works. The parts deciding whether it holds up all come after that.
Checkout and conversion
Store design and build
Growth and lifecycle
Ecommerce marketing San Diego brands buy from us is the lifecycle half: email, retention, and reporting that shows which of it paid.
The federal floor and California's stricter requirement side by side, each translated into something you can change in a store. Current as of 11 September 2026, re-checked every 90 days.
| Requirement | Federal floor, Sept 2026 | California ARL | What to configure |
|---|---|---|---|
| Cancellation mechanism paritySubscribed on the web means cancel on the web. A support email address is not a cancellation mechanism, and it's the most common thing we find. | ROSCA: no dark patterns | Same medium as signup | Self-serve cancel in the account page |
| Pre-purchase disclosure placementCharge amount, frequency and how to get out, visible before they commit rather than after. | Clear and conspicuous | Before the consent step | Terms rendered on the product page and in cart |
| Affirmative consent captureBundling renewal consent into your terms acceptance fails this. So does a pre-ticked box. It has to be deliberate. | ROSCA: express informed consent | Its own separate step | A dedicated unticked checkbox, not your terms box |
| Renewal reminder timingHas to name the product, the amount, the frequency and how to cancel. Your app can send it, but almost none do by default. | Not mandated federally | Annual reminder required | Scheduled notification with the required fields |
| Save-offer rules before cancellationA save offer is allowed. Making it a required step on the way out is not. Beside the button, never before. | No obstruction | Cannot impede the cancel path | Offer alongside, never in front |
| Record retentionWhichever is longer. Nobody builds this row, and it's the one you need the day somebody asks. | Keep proof of consent | 3 years, or 1 year past termination | Consent event stored with a timestamp |
Read down the third column and almost none of this is a legal question by the time it reaches you. It's a checkbox that shouldn't be pre-ticked, a cancel link that should exist, and a record written when consent happens.
The last row catches people. Consent you can't produce is consent you didn't get, as far as anyone reviewing it goes. No app we've seen stores it in a form you'd want to hand over. Anyone on your ecommerce agency San Diego shortlist should be able to tell you where that record lives.
Cancellation behind a support email. Common on older builds, reads as helpful, fails the medium test.
Consent bundled into the terms checkbox. One box covering terms, privacy and renewal. California asks for the last on its own.
Renewal notices on a schedule nobody set. The app sends something, never configured against a requirement, and the copy omits the way out.
Save offers that add a step. An interstitial between the button and the cancellation is the pattern regulators name most.
Self-serve cancels are native. Shopify Subscriptions lets a customer pause, skip, reschedule or cancel from their account. That covers the mechanism half of row one.
Renewal notices are configurable with editable templates. What isn't native is any check that the wording carries the fields California asks for.
A separate consent step is not native. It needs checkout customization on Plus, or an app that renders its own.
Durable consent records are the real gap. Nothing stores the event as evidence you'd hand to counsel, which is why we build that record ourselves.
Every row above is a decision somebody already made, usually by accident, when the app was installed and its defaults accepted.
A legal review will tell you the defaults are wrong. It won't change them, or tell your developer which of four places the cancel path is defined in.
So we work alongside your counsel. They say where the line is. We move the store to the right side of it and leave you the record showing when.
Nobody here is in the city, and for this work that changes nothing. What matters is who answers, and what you keep.
Same for the repository, the theme and the design files. All of it sits in your accounts from day one, so there is nothing to hand back.
They decide where the line sits. We move the configuration and hand back a note of what changed.
Cutovers go out on Pacific hours, not ours, so someone your side is awake when it flips.
Scope, number and date up front. Change any of them and it goes back through a quote before it goes back through a developer.
The federal one did, on 8 July 2025. The FTC opened a replacement rulemaking in March 2026, so check the date on anything you read about this, this page included.
Two things survived the ruling. ROSCA, which covers online renewals and carries penalties, and California's own law, which took effect a week earlier and was untouched.
So the headline was true and the conclusion most people drew wasn't.
Some are, for the rows they control. None controls all six.
An app gives a customer a cancel button. It can't stop your theme burying the account page, separate your consent checkbox from your terms box, or keep a record you'd hand a regulator.
Ask which of the six rows your vendor will put in writing.
Some, and it's fair to weigh rather than dismiss.
The people a hard cancel path retains are mostly the ones who churn angry later, and a save offer beside the button still works. It just can't be a toll gate in front of it.
The law made that trade for you here. Your room is in what you offer, not in how hard you make leaving.
You can't tell from a page we wrote about ourselves, and no ecommerce agency San Diego shortlist proves it in a paragraph. Us included.
So the first audit costs nothing and you keep it. Every legal claim here names its source, its section and its date, and one says the FTC's own page is currently misleading.
If you've been burned before, hand somebody a small piece first.
Week one is an audit against the six rows above, on your store rather than a questionnaire. You keep the findings.
Then a number and a date, in writing.
The work is the cancellation path, the consent step, the renewal notification, the record proving all three, and whatever else the store needs while we're in it.
Builds run $5,000 to $50,000 depending on how much is custom, and a compliance-only pass costs a fraction of that. Any ecommerce agency San Diego quote should separate the two, because they're different jobs.
In California, canceling in the same medium they signed up in. Web signup means web cancellation, no phone call or email to support. You can ask why they're leaving and you can make an offer. Neither can be a condition of getting out.
Yes, if it sits beside the cancel option rather than in front of it. The line is obstruction. An offer they can ignore in one click is fine. A screen they have to get past is what gets named in enforcement actions.
Proof they agreed to the renewal terms. Keep it three years, or one year past the end of the contract if that runs longer. In practice: store the consent event with a timestamp. A subscription record on its own doesn't show what they saw.
For most of it, no. Self-serve cancels and renewal notices work on standard Shopify. The row that often needs Plus is the separate consent step, because that's a checkout change. The alternative is an app that renders its own.
We build on Shopify and Shopify Plus, and most of what we're asked for is a move onto one. If you're on something else, we'd look at what it's costing you first. The six obligations apply whatever you run.
A build runs $5,000 to $50,000 with the number fixed before anyone starts, and where it lands depends on how much is custom. A compliance-only pass on a working store is priced separately and costs far less.
About six weeks once scope is agreed. Subscription work adds time at the end, because the cancel and consent paths get tested as a customer, not an admin.
No, and there isn't one to visit. We work remotely with brands across the country. The checklist above is the part of local that actually changes what your store does.
No, and we aren't lawyers. It's a configuration checklist with its sources named, so your counsel has something to review and your developer something to change. We work alongside your lawyer, never in place of one.
Next step
You already know whether somebody can cancel without emailing you.
Send the link they'd use. We'll audit it against all six rows and hand you the findings:
It stops at the findings, and it's a configuration review, not a legal opinion. Take it to your counsel.
No charge, and the write-up stays yours whatever you decide next.
The reply comes from whoever would do the work, inside a working day.
