Is your nonprofit organization engaged in ecommerce? Receivingmonthly payments online for automatically renewing memberships or subscriptions?Are you selling merchandise or books online, or tickets to your annual gala orother member event?

In recent years, two state legislative trends have hadsignificant impact on ecommerce payment acceptance practices. First, so-called“auto-renewal” laws target any “business” that sells goods and services online fora fee that is charged on an automatically renewing basis[1] Note that these laws generally apply toany organization that engages in certain ecommerce practices, regardless ofwhether the entity is a for-profit business or a nonprofit organization. Sowhile this article may refer to requirements for “businesses,” this termgenerally includes nonprofits engaged in covered ecommerce practices.

Auto-renewal laws may require businesses to provide sufficientnotice of, and obtain affirmative consent to, auto-renewal prior to initiating recurringpayments upon that auto-renewal process. Such laws also may require businessesto provide an easy online cancellation method. Similar requirements haveexisted in payment network rules for many years, but the new state laws makethe requirements more robust and give state regulators and private plaintiffsthe right to enforce the rules.

Second, many states are cracking down on so-called “junkfees,” including fees that are added on at online checkout without sufficientprior notice.  The purpose of these lawsis to require the total price, including all mandatory fees,[2]to be posted at the outset of any transaction and to prohibit adding fees,potentially including payment processing fees, later in the checkout process.

Importantly, typically there are no general exemptionsfrom such laws for nonprofit organizations. There may be, however, otherlimitations on the application of these laws. For example, such state laws mayapply to consumer transactions only and not to business-to-businesstransactions. In addition, the scope of such laws may be limited to sales ofgoods and services, thereby excluding automatically renewing payments for transactionssuch as donations. At the federal level, the FTC’s recent rule regardingauto-renewals was vacated,[3]its recent junk fee rule is limited to live-event tickets and hoteltransactions,[4]and its enforcement and informal guidance in recent years regarding checkoutfees[5]has ramped down during the current presidential administration. Because federallaw lacks broad-based general rules regarding such matters, compliance withrespect to auto-renewals and checkout fees requires a 50-state review and understandingof payment network rules.  

This article addresses state legislative trends inauto-renewal laws and junk fees within the broader legal and compliance landscapeof recurring payments and fee practices.

State Auto-Renewal Laws and Payment Network Rules

Many states have passed laws governing auto-renewals. Suchlaws typically require the business that is charging a monthly fee for itsservices to obtain the consumer’s affirmative consent to the fact that themembership or subscription for such services will automatically renew and thepurchaser’s payment method will be automatically charged on a recurring basisto pay for the membership or subscription. In order for the purchaser’s consentto the auto-renewal terms to be effective, the disclosure of such terms must bemade in close proximity to the point on the screen at which the consumer willagree to making the purchase of the membership or subscription. The affirmativeaction that a purchaser must take to effectively agree to such terms typicallyneeds to be the click of a button that says “I agree,” or a checkbox next tosimilar language of assent, that the customer will click to agree to purchasethe automatically renewing membership or subscription.  

As part of the terms and conditions of such purchase, theseller must make various additional disclosures, per state law and paymentnetwork rules.  For example, the sellermust disclose the time by which the consumer must cancel the subscription inorder to avoid the next periodic charge, the subscription price, and theconsumer’s obligations after any free-trial period ends. The merchant also mustprovide an easy cancellation method, including an online method if the purchaseis made online, and give additional notice regarding free trials, renewal periods,fee increases, and any material change to the subscription. Often, the easycancellation method must also be provided with such additional notices. Inaddition, the terms and conditions of payment must include a description of therecurring charges (e.g., monthly on the same date each month), a description ofthe merchant’s services, merchant cancellation and refund policies, merchantcontact information, and how the consumer will be notified of changes to theagreement.

The terms of the payment plan generally must be clear andconspicuous, or agreement to them by the payor must be by means of expressinformed consent.  That generally meansthe business accepting recurring payments for its services needs to provide clearlyvisible payment-related terms in the user interface, separate from its generalterms and conditions.  The extent towhich such terms must literally be disclosed on the same screen on which theconsumer provides consent by clicking “I agree” is a decision for each merchant.  While federal and state statutes andregulations applicable to a particular type of transaction may require veryspecific positioning of certain disclosures, the question of enforceability hasdeveloped in recent decades by caselaw addressing how terms and conditions arepresented to customers on digital platforms. In order to enforce such terms, a merchant generally is not required toforce the customer to click on the link to the full terms and conditions and scrollthrough them before agreeing to them, or even open the linked terms andconditions.  Provided there is asufficient description in the user interface of key terms and legally requiredterms, merchants generally are allowed to provide a link to the full terms andconditions in close proximity to the button or box to be clicked when agreeingto such terms.  Such terms and noticesalso may be required to be delivered to the customer in a retainable form.

Finally, the merchant may be required to authenticate the customer’sidentity and payment method prior to storing the customer’s payment method for recurringpayments.  This generally can be done byrequiring the consumer to log into the digital platform with a username andpassword, with a multifactor authentication element, such as a code or otherdata point sent to a separate device.  Itis also important to retain the data points for each customer’s authenticationand acceptance of the terms.

How to Avoid the Pitfall of Accidentally Offering RegulatedCredit

When seeking to comply with the new auto-renewal laws, itremains important for merchants also to keep compliance with longstandingconsumer credit laws in mind.  Merchantsdeveloping subscription payment plans should include in their checklist duringthe payment product development stage whether the payment plan has any of thecharacteristics of credit. Federal and state consumer credit laws generallyapply to credit sales, which is a sale in which the seller acts as a creditorby allowing the consumer to pay an obligation over time.  It is important to structure any subscriptionplan or similar payment plan to not be credit.  The main consequence of offering credit is thatthe creditor must give the customers various disclosures of the cost of credit,there are state-by-state pricing limitations, operational compliancerequirements apply to the creditor, and the creditor may even need to obtainlicenses or registration in various states.

One of the key facts in the determination of whether apayment plan actually constitutes credit is whether the consumer is obligatedto pay for the goods or services over time. Consumer credit generally means the right to defer payment of debt.[6]When a customer receives goods or services from a merchant right away but isallowed to pay for them over time, the arrangement may constitute credit.

When payment for a monthly subscription payment plan isdue at the beginning of the month, renewal is required before the next monthbegins in order to continue receiving services, and termination is allowedbefore the next payment period without penalty, the payment plan generally isnot credit because the payment plan does not create a right to defer paymentfor the goods and services received.  

However, a payment plan that requires a consumer to makemonthly payments for 12 months or allows cancellation before the end of the12-month term but charges a significant termination fee for such earlycancellation may constitute credit.  

As a general rule, if there is no contractual obligationto continue making payments after the initial payment, there should be nocredit. Termination fees, minimum multi-month commitments, and differentialpricing for payment over time as compared to payment in full upfront have beenthe subject of frequent litigation and inconsistent decisions across jurisdictionsregarding the issue of whether a payment plan constitutes credit.

Recurring Payment Authorizations Involving BankAccounts

Federal law also requires a signed, written authorizationfor recurring payments by electronic fund transfer from a consumer’s bankaccount, and a copy of such authorization must be provided to the consumer.[7]  Further, if there is a change in the amountor date of the scheduled payments, an additional notice is required before thepayment is initiated.  Regarding a changein amount, the parties can agree to a range of amounts, with notice requiredonly if the amount of the payment falls outside that range.  

Further regarding Automated Clearing House (“ACH”) debitauthorizations (using bank account number and routing number) with consumers obtainedover the internet, payment network rules require businesses to conduct annualinformation security audits regarding the financial information they obtainfrom consumers and to implement a commercially reasonable fraudulenttransaction detection system.  Recurring ACH debit authorizations obtainedfrom consumers over the phone are allowed only if there is a preexistingbusiness relationship or the consumer initiates the call. In such cases, thebusiness must validate the routing number and identity of the consumer, thecall must be recorded, and a copy of the authorization must be provided to theconsumer.

Junk Fees

In addition to the new state auto-renewal laws adding anew layer to compliance regarding recurring payment authorizations, anotherrecent state legislative trend is to require businesses offering goods orservices to include all mandatory fees or charges in the posted or displayedprice.  Many of these laws are generallyapplicable to commerce with consumers, though some are limited in scope tospecific types of transactions, such as landlords, event tickets, or hotels.The intent of such laws is to prohibit merchants from adding unexpected fees atcheckout that are unavoidable in order to complete the transaction and thatwere not included in the posted price for the goods or services.

These so-called “junk fee” laws further complicate digitalsales and payment processes. The card network rules already generallycontemplate two distinct types of fees that may be imposed on paymenttransactions – surcharges or convenience fees. There are different requirementsand limitations for each type of fee. A merchant may assess a percentagesurcharge on a credit card transaction, subject to applicable laws orregulations.  The amount of a surchargeis limited to the lesser of the merchant’s cost to process the payment and amaximum cap set by the card network. Surcharges are prohibited on debit card transactions. Alternatively, amerchant generally may charge a convenience fee to cover its cost of providing analternative payment channel outside the merchant's customary payment channels. Inother words, the intent of the convenience fee is for merchants that typicallyaccept payment in person to be allowed to charge a fee to cover the actualcosts of offering a remote digital payment method. Various disclosures arerequired at checkout before charging a surcharge or convenience fee.  The new junk fee laws, however, complicatethe ability to charge such a fee if it is considered mandatory and unavoidable.

State law also may otherwise prohibit or further limitsurcharges and convenience fees.  Thereare statutes (separate from junk fee laws) in a number of states that prohibitsurcharges, limit the amount of the surcharge to the actual processing cost tothe merchant or a lesser amount, or require disclosures. States may also haveindustry-specific laws that limit surcharges and convenience fees. The subjectmatter of surcharges is also an active area of state legislation, and manystates currently have proposed legislation that would regulate surcharges in asimilar manner as the existing surcharge statutes discussed above.

Which State’s Law Applies?

In ecommerce transactions, where the company is located inone state and the consumer or payor is located in a different state  a natural question arises: which state’s lawapplies?

State auto-renewal, consumer credit, junk fee, andsurcharge laws in a consumer’s home state of residence likely apply to atransaction even if the terms and conditions applicable to the customer purportto apply the company’s home-state law to the transaction. Courts often holdthat certain statutes intended to protect consumers apply regardless ofcontractual choice-of-law provisions if the laws in question reflect thefundamental public policy of the consumer’s home state to protect its residentsfrom the practices addressed by the statute.

Following the Restatement of the Law (a treatise seriesthat synthesizes case law across all jurisdictions for common topics, such aschoice of law), courts often first analyze whether the chosen state in theagreement has a substantial relationship to the parties or their transaction.If the chosen state has a substantial relationship, a court then determineswhether the chosen state’s law is contrary to a fundamental policy of thecustomer’s home state. If there is such a fundamental policy, the court thenweighs whether the customer’s state has a materially greater interest than thechosen state in the determination of a particular issue. So even if the partieshave agreed to abide by the laws of a certain state, beware that courts may nothonor that decision and sometimes apply the laws of the state in which thecustomer is located.

Payments Compliance Plan

For nonprofit organizations engaged in ecommerce—whetherthrough automatically renewing memberships, online sales, or other recurringtransactions—compliance with auto-renewal, junk fee, and other onlinetransaction and payment laws needs to be part of your plan. The absence of ageneral nonprofit exemption means that organizations must proactively evaluatetheir online payment acceptance practices against a patchwork of staterequirements.  Without talking about theparticular state laws that may affect ecommerce that your organization engagesin, here are a few helpful starting points to improve your compliance:

-         Ensure proper disclosure and consent mechanismsfor recurring charges,

-         provide accessible cancellation options,

-         avoid periodic payment options (like monthlypayments for an annual subscription) that could be considered a consumer creditissue, and

-         present all mandatory fees transparently at theoutset of a transaction.  

Nonprofit organizationsshould conduct a comprehensive review of applicable state laws and paymentnetwork rules, identify gaps in their current ecommerce practices, andimplement compliant checkout flows and renewal processes.

[1] See, e.g., Cal. Bus. &Prof. Code § 17600 et seq.

[2] See, e.g., Cal. Civ. Code §1770(a)(29).

[3] The rule was vacated by a federalcourt of appeals due to procedural flaws in the rulemaking process.  Custom Commc’ns, Inc. v. Fed. Trade Comm’n,142 F.4th 1060 (8th Cir. 2025).

[4] See “Trade Regulation Rule on Unfairor Deceptive Fees,” 90 Fed. Reg. 2,066 (Jan. 10, 2025).

[5] See, e.g., https://www.ftc.gov/news-events/news/press-releases/2026/08/ftc-sends-more-238-million-drivers-diners-harmed-grubhubs-deceptive-advertising-claims-other and https://www.ftc.gov/system/files/ftc_gov/pdf/P214800+Dark+Patterns+Report+9.14.2022+-+FINAL.pdf

[6] See., e.g., 12 C.F.R. §1026.2(a)(14) and related Official Staff Comments.

[7] 12 C.F.R. § 1005.10(b).

‍