How to Comply with California's Automatic Renewal Law (AB 2863) in 2026

If your business sells anything that renews automatically to customers in California — software, a subscription box, a membership, a service plan — you're already subject to one of the strictest automatic-renewal laws in the country. And since July 1, 2025, the rules got noticeably stricter.

This is a plain-English walkthrough of what California's Automatic Renewal Law (ARL) requires, what changed with the AB 2863 amendments, and — because this is a law built almost entirely around dates and notices — how to stop it from becoming another thing someone has to remember by hand.

This isn't legal advice. The ARL carries real litigation exposure (California has seen a steady stream of class actions built on ARL violations), and the exact wording, timing and disclosure requirements matter. Treat this as an orientation, and confirm the specifics that apply to your offer with counsel before you rely on them.

What the ARL Actually Covers

California's Automatic Renewal Law (Business & Professions Code §§ 17600–17606) applies to any business making an "automatic renewal" or "continuous service" offer to a California consumer — meaning any plan that renews for a further term unless the customer cancels, or converts from a free or discounted trial into a paid subscription automatically. It covers straightforward monthly SaaS billing just as much as it covers annual memberships and free-to-paid trials.

The law has been in force since 2010, but AB 2863 — signed by Governor Newsom on September 24, 2024 — tightened it considerably. The new requirements apply to contracts entered into, amended, or extended on or after July 1, 2025.

What AB 2863 Changed

The core structure of the ARL is unchanged — clear disclosure, consent, and easy cancellation. What AB 2863 added:

Express affirmative consent. Consent to the automatic-renewal or continuous-service term now has to be its own clear, separate step. It can no longer be bundled into general terms-of-service acceptance or buried behind a pre-checked box — the kind of sign-up "dark patterns" the amendment was specifically written to close off.

Consent recordkeeping. Businesses must be able to show that consent was given, and retain that record for at least three years, or one year after the contract terminates, whichever is longer.

Click-to-cancel, with teeth. Cancellation must be available through the same medium used to sign up — if a customer enrolled online, they must be able to cancel online, without obstruction, delay, or extra steps. If they enrolled by phone, they must be able to cancel by calling the same number, during defined "normal business hours" (the law sets a floor of at least 12 hours between 6 a.m. and 10 p.m. Pacific, Monday to Friday). A voicemail requesting cancellation has to be acted on or returned within one business day.

Free trials and "free-to-pay" conversions are explicitly in scope. A free trial that silently converts to a paid plan is treated the same as any other automatic renewal — same disclosure and consent standards apply.

Fee-change notices. If you change the price on an existing automatic-renewal or continuous-service offer, you must give clear and conspicuous notice 7 to 30 days before the change takes effect, in a format the consumer can actually retain — an in-app banner alone doesn't satisfy this; it needs to reach them somewhere they can keep it, like email.

A broader ban on misrepresenting material terms of the transaction, closing off some of the grey areas that had previously been argued around.

Alongside these, the underlying law still requires clear and conspicuous disclosure of the automatic-renewal terms before the customer consents, an acknowledgment of those terms after sign-up (including how to cancel), and — for offers with a term of a year or longer — a reminder notice before the contract renews.

Does the California ARL Protect Your Business from Vendor Contracts?

Here's the asymmetry worth sitting with: AB 2863 gives your customers real, statutory protection against being trapped in an auto-renewal — pre-checked boxes banned, click-to-cancel mandated, fee changes flagged in advance. Your vendors don't have to give you any of that.

The ARL is written to protect consumers. A standard B2B vendor contract — your SaaS stack, your office lease, your insurance, your supplier agreements — is governed by ordinary contract law, not the ARL, regardless of how aggressively it auto-renews or how deep its notice period is buried in the termination clause. (The line blurs somewhat for sole proprietors and very small businesses treated as consumers under some state rules — worth checking with counsel if that's your position — but the typical vendor-to-business relationship sits outside the ARL entirely.)

In practice, that means the auto-renewal protections you're busy building into your own customer-facing product are exactly the protections you don't automatically get from the vendors billing you. Nobody is statutorily required to remind you before your own contracts renew. That's a gap you have to close yourself — with a named owner and a system that tracks the notice period, not a hope that the vendor mentions it.

Where Businesses Get Caught Out

Almost none of the ARL litigation businesses actually face comes from a business deliberately hiding the renewal term. It comes from the operational side falling over:

The cancellation flow was easy at launch, then a redesign quietly added a phone-call requirement, breaking click-to-cancel.
Consent records exist somewhere, but nobody could actually produce them three years later when it mattered.
The annual reminder for a multi-year contract was never automated, so it just didn't go out.
A fee change went out through an in-app banner only, missing the retainable-format requirement — or went out with less than 7 days' notice.
A cancellation voicemail sat unanswered past the one-business-day window.

Notice a pattern: these aren't legal drafting failures, they're missed dates and undocumented processes — exactly the kind of thing that quietly slips when it depends on someone remembering to act on a specific day, rather than a system that surfaces it automatically.

Turning This Into a Repeatable Process

Whether you're the one selling the subscription or the one buying a vendor contract that auto-renews, the discipline that keeps you out of trouble is the same one we write about across this blog: know your key dates, know your notice period, and don't rely on memory to surface them.

Concretely, for ARL compliance, that means keeping track of:

The consent date and method for each customer, and how long you're required to retain that record.
Any contract or offer with a term of a year or more, so the required renewal reminder actually goes out on time.
Planned fee changes, so the 7–30 day retainable-format notice doesn't get missed in a launch rush.
Cancellation requests by phone or voicemail, so the one-business-day response window is never in question.
The cancellation flow itself, reviewed periodically rather than assumed to still work after the last redesign.

Timemy is built for the vendor-contract side of this — tracking the notice periods and renewal dates on the contracts your business signs with suppliers, not the consent records or cancellation logs for your own customer subscriptions. But if you're already the kind of operator who wants renewal and compliance dates surfaced automatically instead of chased down manually, it's worth applying the same standard to both sides of your business: track the date, get reminded ahead of the deadline, and don't let "someone will remember" be the plan.

FAQ

What is AB 2863? AB 2863 is the 2024 California bill that amended the state's existing Automatic Renewal Law. Signed into law on September 24, 2024, its expanded requirements — affirmative consent, click-to-cancel, fee-change notices, and consent recordkeeping — took effect July 1, 2025.

Does the California ARL apply to B2B contracts? Generally no — it's aimed at offers made to consumers. Standard vendor-to-vendor B2B contracts are governed by ordinary contract law rather than the ARL, though the line can blur with sole-proprietor and very small business customers. Worth confirming with counsel for your specific customer base.

Does this apply to businesses outside California? Yes, if you have customers located in California. The ARL applies based on where the consumer is, not where your business is registered.

What's the penalty for non-compliance? Violations can expose a business to enforcement action and private lawsuits, including class actions, with remedies that can include restitution and treating the goods or services as an unconditional gift to affected customers in some circumstances. This is part of why the law has attracted a steady volume of litigation.

Do I need a lawyer to fix this? For the disclosure language, consent flow and record-retention specifics, yes — get counsel to review the actual customer journey. What you don't need a lawyer for is building the operational habit of tracking the dates this law revolves around.

Timemy tracks the renewal dates and notice periods on the vendor and supplier contracts your business signs — so the same discipline this law expects of you as a seller also protects you as a buyer. Try it free for up to 10 contracts.