Subscription Business Legal Considerations: UK and US

Running a subscription business on Shopify is one of the most effective ways to generate predictable revenue, reduce customer acquisition costs, and build a loyal base of repeat buyers. Whether you're selling coffee, software, wellness products, or curated boxes, the subscription model offers compelling advantages over one-off transactions. But alongside those advantages come real legal obligations that many merchants overlook until they receive a chargeback, a regulatory warning, or an angry email from a customer who didn't realise they'd signed up for an ongoing commitment.

The problem is that subscription law is genuinely complex, and it differs meaningfully between the UK and the US. A cancellation policy that satisfies UK consumer protection rules may fall short of California's automatic renewal law requirements. Billing disclosures that work for your American customers might need to be restructured entirely for shoppers in England or Scotland. Most generic Shopify advice skips over these distinctions entirely, leaving merchants to piece together compliance from scattered government websites and legal forums.

This guide gives you a practical, structured overview of the key legal considerations for running a Shopify subscription business in both jurisdictions. You'll learn what disclosures you must make before charging customers, how cancellation rights differ across borders, what your payment processing obligations look like, and how to structure your terms of service to protect both your business and your buyers.

---

Pre-Sale Disclosure Requirements

Pre-sale disclosures are the cornerstone of subscription compliance in both the UK and the US, and getting them wrong is one of the fastest routes to chargebacks and regulatory scrutiny. In the UK, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 require you to clearly communicate the full terms of any recurring arrangement before the customer completes their purchase. This means stating the billing frequency, the exact amount charged, and the minimum commitment period — all in plain, legible language before the checkout confirmation screen. Burying this information in a footer or a dense terms-of-service document does not satisfy the requirement.

In the US, the Federal Trade Commission's Negative Option Rule, updated in 2023, sets out similar requirements at a federal level, mandating that you disclose subscription terms clearly and conspicuously before obtaining billing information. Several states layer additional requirements on top: California's Automatic Renewal Law (ARL) requires that renewal terms be presented in a larger font or contrasting colour, and that customers receive a separate acknowledgement of the subscription terms before charges begin. New York enacted comparable legislation in 2023 that applies to most consumer subscriptions sold to New York residents.

For Shopify merchants, this means your product pages, checkout, and order confirmation emails all need to be reviewed against these standards. A reasonable implementation would show a bold notice near the "Add to Cart" button stating the billing frequency and amount — for example, "£19.99 billed every 30 days, cancel anytime" — and then repeat that information at checkout before payment is processed. Screenshot and log these disclosures, because if a customer disputes a charge, evidence that they were informed before purchase is your most important defence.

---

Cancellation Rights and Cooling-Off Periods

One of the most significant legal differences between the UK and US concerns the right to cancel after a subscription begins. In the UK, online subscription contracts are subject to a 14-day cooling-off period under the Consumer Contracts Regulations, during which customers can cancel and receive a full refund without providing any reason. This right applies from the moment the contract is concluded — which for digital subscriptions or services that begin immediately can be shortened only if the customer explicitly waives it and acknowledges that doing so forfeits their refund right. Practically speaking, this means your checkout flow should include a clear mechanism for customers to waive the cooling-off period if you want to begin providing a digital service right away.

In the US, there is no single federal cooling-off period for online subscriptions, though the FTC's negative option rules require that cancellation must be as easy as the sign-up process — a principle sometimes called "click-to-cancel." If a customer signed up with a single checkbox, they must be able to cancel with a comparable level of effort, meaning you cannot require a phone call to cancel a subscription started online. Several states, including California and New York, enforce this at the state level and have pursued enforcement actions against brands that made cancellation unnecessarily difficult.

For Shopify merchants, the practical implication is that your customer portal must offer self-service cancellation without friction. SaltAI Subscriptions includes a built-in customer portal that allows subscribers to pause, modify, or cancel their subscription without contacting support — which satisfies both the UK's straightforward cancellation requirement and the FTC's click-to-cancel standard. Removing barriers to cancellation may feel counterintuitive, but it dramatically reduces chargebacks and builds the kind of trust that turns cancelled subscribers into returning customers.

---

Payment Terms, Failed Charges, and Dunning

Failed payments are an inevitable part of running a subscription business, and how you handle them carries its own set of legal and reputational implications. In the UK, the Direct Debit Guarantee and the Financial Conduct Authority's guidance on continuous payment authorities (CPAs) — which govern card-based recurring charges — require that customers are notified before a charge is made, particularly if the amount is variable. For fixed-price subscriptions, this is less burdensome, but if you ever change pricing, UK rules require advance notice before the new amount is collected.

In the US, Visa and Mastercard network rules require that merchants notify customers at least seven days before a recurring charge if the subscription was initiated with a free trial, and that any change in billing amount is communicated in advance. These are network-level rules, not just best practices, which means your payment processor can suspend your merchant account if you are found to be in consistent violation. For subscription businesses with high chargeback rates — typically above 0.9% for Visa — the consequences can include additional monitoring programmes and ultimately account termination.

Dunning — the process of retrying failed payments and communicating with customers about payment issues — should be handled transparently and promptly. A well-designed dunning sequence sends the customer a notification immediately after a payment fails, follows up within 48 hours with a link to update their payment method, and retries the charge at sensible intervals (typically day one, day three, and day seven). Avoid retrying charges without any customer notification, as this can appear deceptive and may violate both UK and US billing transparency standards.

---

Terms of Service and Privacy Obligations

Your terms of service (ToS) and privacy policy are not optional formalities — they are legally operative documents that define the rights and obligations of both parties in a subscription relationship. For UK merchants, your ToS must comply with the Consumer Rights Act 2015, which voids any clause that creates a significant imbalance in the parties' rights and obligations to the detriment of the consumer. Clauses that prevent refunds for services not yet delivered, or that allow you to change pricing without notice, are unlikely to be enforceable under UK consumer law.

In the US, privacy obligations depend heavily on your customer base. If you have customers in California, the California Consumer Privacy Act (CCPA) requires that you disclose what personal data you collect, why you collect it, and how customers can request deletion or opt out of data sales. If you collect health-related data — relevant for supplement, wellness, or fitness subscription brands — additional state-level protections may apply. Stripe and other payment processors also require that your ToS clearly describe your billing practices and that your privacy policy references how payment data is stored and protected.

For Shopify merchants, the most practical step is to have your ToS and privacy policy reviewed by a solicitor (UK) or attorney (US) who specialises in e-commerce and consumer law. Template policies downloaded from the internet frequently miss jurisdiction-specific requirements and are unlikely to hold up under scrutiny. Budget approximately £500–£1,500 in the UK or $800–$2,000 in the US for a bespoke review — an investment that is modest compared to the cost of a single regulatory investigation or class-action notice.

---

Tax Compliance for Recurring Revenue

VAT and sales tax treatment of subscription revenue has nuances that catch many Shopify merchants off-guard, particularly when selling across borders. In the UK, VAT applies to most subscription products and services at the standard 20% rate, though certain goods — such as children's clothing, books, and some food items — attract zero or reduced rates. If your subscription box includes a mix of standard-rated and zero-rated goods, you may need to apportion VAT across the individual components rather than applying a single rate to the bundle. HMRC publishes specific guidance on mixed supplies, and getting this wrong can result in underpayment penalties.

In the US, sales tax on subscription products varies dramatically by state, and the 2018 Supreme Court decision in South Dakota v. Wayfair means that economic nexus thresholds — typically $100,000 in sales or 200 transactions in a state — can trigger collection and remittance obligations even without a physical presence. Software-as-a-service (SaaS) subscriptions are taxable in some states and exempt in others; physical subscription boxes are almost universally taxable but the applicable rate depends on the contents. Shopify Tax or a third-party integration like TaxJar or Avalara can automate much of this calculation, but you remain responsible for registering in states where you have nexus.

For merchants selling to both UK and US customers, the simplest operational approach is to display prices inclusive of local taxes where required — which is the legal standard in the UK — while using Shopify's geolocation tools to present tax-exclusive pricing to US customers, where this is customary. Review your tax settings at least once per year, as state legislatures frequently adjust sales tax rules affecting digital and physical subscription products.

---

Data Retention, Consent, and GDPR Considerations

Data protection is tightly intertwined with subscription commerce because, by its nature, a subscription relationship involves ongoing data collection — payment details, purchase history, communication preferences, and behavioural data from your Shopify storefront. In the UK, the UK GDPR (which mirrors the EU version post-Brexit) requires that you have a lawful basis for processing each category of personal data. For subscription customers, the most common bases are contractual necessity (processing payment and fulfilling orders) and legitimate interests (sending transactional emails and account notifications). Marketing communications to subscribers require explicit consent and a straightforward opt-out mechanism in every message.

In the US, while there is no single federal privacy law equivalent to GDPR, the patchwork of state laws is growing rapidly. Virginia's Consumer Data Protection Act, Colorado's Privacy Act, and Connecticut's Data Privacy Act all came into force in 2023, and more states are expected to follow. These laws grant consumers rights over their personal data including access, correction, and deletion — rights that your subscription management infrastructure needs to be able to honour operationally, not just in policy. If a subscriber in Virginia requests deletion of their data, you must be able to act on that request within 45 days.

For Shopify merchants, practical compliance starts with a clear data map: document what personal data you collect at signup, what third-party apps process that data (including your subscription platform, email provider, and analytics tools), and how long you retain it. Subscription data should not be kept indefinitely after a customer cancels — establish a retention schedule, typically 12–36 months for transactional records, and purge personal data beyond what is required for tax or legal obligations. This approach reduces your compliance burden and demonstrates accountability to regulators who increasingly look for evidence of systematic data governance.

---

Conclusion

Running a compliant subscription business on Shopify is absolutely achievable, but it requires deliberate attention to the legal frameworks governing your key markets. UK merchants need to address Consumer Contracts Regulations, the Consumer Rights Act, UK GDPR, and VAT apportionment. US merchants face the FTC's updated negative option rules, state-level automatic renewal laws, click-to-cancel requirements, and an expanding state privacy landscape. The good news is that most compliance requirements point in the same direction: be transparent, make cancellation easy, keep customers informed, and document everything.

Start by auditing your checkout flow for pre-sale disclosure compliance, then review your cancellation process, your dunning logic, and your ToS. Treat compliance not as a constraint but as a competitive advantage — merchants who make subscription terms clear and cancellation simple earn more trust, experience fewer chargebacks, and build more durable customer relationships.

Try SaltAI Subscriptions free at saltai.app — no credit card required.