SaaS and software: the numbers, the rules, the AI picture.

• ROSCA and FTC Act Section 5 (online subscriptions)

  The Restore Online Shoppers’ Confidence Act, 15 U.S.C. 8403, requires sellers to clearly disclose all material terms before collecting billing information, get express informed consent before charging, and provide simple mechanisms to stop recurring charges. The FTC enforces it alongside Section 5 of the FTC Act, and it applies to any negative option, including a free trial that converts to paid.

  What it means: Show the price, billing frequency, renewal and cancellation terms next to the button that starts the trial or subscription. Do not pre-check consent boxes. Cancel must work through the same channel as sign-up, with no maze, no forced call and no chat-only exit. The FTC secured a $2.5 billion settlement from Amazon in September 2025 over Prime enrollment and cancellation under these laws.

  [8] law.cornell.edu

• FTC Negative Option Rule and the vacated click-to-cancel amendments

  The FTC's 2024 amendments, known as click-to-cancel, were vacated by the Eighth Circuit on procedural grounds in July 2025. The existing Negative Option Rule covers only prenotification plans, and the FTC opened a new rulemaking with an advance notice published March 13, 2026, with comments due April 13, 2026.

  What it means: There is no federal click-to-cancel rule in force as of the sources, but ROSCA and Section 5 still apply, and the FTC has said it is reconsidering the rule. Build to the stricter standard now: cancel online as easily as you sign up, show save offers only if cancellation stays immediate, and keep a record of consent. Check the FTC page before you ship billing changes.

  [9] ftc.gov

• California Automatic Renewal Law (as amended by AB 2863)

  Law firm summaries of AB 2863 report that, from July 1, 2025, California requires express affirmative consent to renewal terms, treats a free-to-paid conversion as an automatic renewal, requires pre-billing disclosures and requires that consumers can cancel as easily as they signed up. Other states have their own automatic renewal laws.

  What it means: If you sell to California consumers, add a separate renewal consent step, disclose the renewal length and charge amount before billing details, keep proof of consent and offer online cancellation. Because states differ, the safest design follows the strictest state you sell into. Have counsel review the flow, especially for consumer plans and small-business self-serve plans.

  [10] dwt.com

• FTC rule on consumer reviews and testimonials (16 CFR Part 465)

  The rule, effective October 21, 2024, bans fake or false reviews and testimonials, including AI-generated ones, paying for reviews conditioned on sentiment, undisclosed insider reviews, company-controlled sites posing as independent review sites, review suppression through unfounded legal threats or intimidation, and buying fake social media indicators. Courts can impose civil penalties for knowing violations.

  What it means: Ask every customer for a review, never only the happy ones, and never offer a reward for a five-star rating. Disclose employee and relative reviews clearly. Do not run a "best software" site you control without saying so. If you host reviews on your own site, do not hide the negative ones by threatening reviewers. G2 and Capterra incentives must not depend on a positive rating.

  [11] ftc.gov

• FTC Endorsement Guides (16 CFR Part 255)

  An endorsement must reflect the honest opinion of the endorser, and a material connection, such as payment, free product or an affiliate commission, must be disclosed clearly and conspicuously. The advertiser is responsible for what its affiliates, influencers and agencies say on its behalf. The Guides are guidance, but conflicts with them can lead to FTC action under Section 5.

  What it means: Software affiliates, "best of" bloggers, YouTube reviewers and customer advocates who earn commission or credits must disclose it, and you must monitor them. Customer quotes must be real and reflect typical results, or say what is typical. Do not publish a result such as "saves 10 hours a week" unless you can substantiate it.

  [12] ftc.gov

• Comparative advertising: FTC policy and the Lanham Act

  The FTC encourages naming competitors but requires clarity and, where necessary, disclosure, and says truthful comparative advertising helps consumers. Disparaging advertising is permissible only if it is truthful and not deceptive. Separately, Section 43(a) of the Lanham Act lets a competitor sue over false advertising that harms its sales or reputation, as the Supreme Court explained in Lexmark.

  What it means: Comparison and alternatives pages are standard in SaaS and legal when accurate. Compare on facts you can verify, date the page, state how you tested, link to the rival’s public pricing and update when it changes. Do not claim "faster" or "cheaper" without proof, and do not use a rival’s trademark in a way that suggests affiliation. A competitor, not just a regulator, can challenge a false comparison.

  [13] law.cornell.edu

• Privacy: CCPA in the US, GDPR for EU users

  The California Consumer Privacy Act applies to for-profit businesses doing business in California that have over $25 million in gross revenue, handle the personal information of 100,000 or more California residents or households, or earn 50% or more of revenue from selling personal information. The GDPR applies to organizations outside the EU that offer goods or services, paid or free, to individuals in the EU or monitor their behavior.

  What it means: A US SaaS company that sells to EU users or tracks them on its site is inside the GDPR, which means a lawful basis for each use of data, a clear privacy notice and a way to honor access and deletion requests. Under the CCPA, honor opt-outs including browser global privacy control signals. Your cookie banner, analytics, ad pixels, session recorders and chat widgets all collect personal data and should match what your policy says.

  [14] oag.ca.gov

• Accessibility: ADA and WCAG in the US

  The Justice Department issued a rule in April 2024 requiring state and local government websites and apps to meet WCAG 2.1 Level AA, and extended its compliance dates by one year in April 2026. That rule does not cover private businesses, but plaintiffs sue private software companies over inaccessible sites under Title III of the ADA. Seyfarth counted 3,117 federal website accessibility suits in 2025.

  What it means: Treat WCAG 2.2 Level AA as your build standard for the marketing site, sign-up and the app itself. Selling to governments, schools or hospitals makes this a procurement requirement, since customers need your product to meet the standard they must meet. Publish an accessibility statement, test with a keyboard and a screen reader, and fix sign-up and checkout first. W3C published WCAG 2.2 in December 2024, and it is backwards compatible with 2.1.

  [15] ada.gov

• European Accessibility Act (Directive 2019/882)

  The European Accessibility Act applied from June 28, 2025. It sets accessibility requirements for key products and services, including e-commerce, banking services, e-books and consumer computers and operating systems. Enforcement is by each member state, and the Commission describes an exemption for some microenterprises that provide services.

  What it means: If your product or checkout is sold to consumers in the EU, check whether your offer counts as a covered service in the member state you target and what your country’s law requires. B2B-only software is treated differently from a consumer app with in-app purchase, so the answer depends on who buys. Where you are in scope, accessible sign-up, payment and support flows are the first thing a regulator or complainant will test.

  [16] digital-strategy.ec.europa.eu

• SOC 2 and security claims

  A SOC 2 report is issued by a licensed, independent CPA after an examination. The AICPA says organizations that have received a SOC 1, SOC 2 or SOC 3 report may use its logo and must read its guidelines before putting the logo on a website. It is an examination report, not a certificate, and Type 1 and Type 2 are different reports.

  What it means: Write "we hold a SOC 2 Type 2 report, period ending [date]" and link a request form, not "SOC 2 compliant" or "SOC 2 certified" unless you can back the words. If the audit is in progress, say "in progress". The same rule applies to ISO 27001: name the certificate, the scope and the certifying body. A false security claim is a deceptive-practice risk and a deal-killer when the buyer asks for the report.

  [17] aicpa-cima.com

• App store policies for subscription apps

  Apple's App Review Guidelines require in-app purchase for paid features, require subscriptions to provide ongoing value for at least seven days and require a clear description of what the price buys. Apple's US storefront currently allows buttons and links to other purchase methods without an entitlement. In the US, Google says from October 29, 2025 developers may tell users about outside offers and link to them, with fee reporting rules that start later.

  What it means: If your SaaS has an iOS or Android app, your pricing and trial wording must match what the store shows, and your steering to web checkout must follow the store rules for each country. US rules differ from EU and other markets, and Google has changed its fee schedule in 2026. Re-check both policies before each release.

  [18] developer.apple.com

This is general information, not legal advice. Subscription, privacy, accessibility and app-store rules change often and differ by state and country. Have a lawyer who knows your market review your billing flow, claims and policies before launch.