Pre-authorization consent before recurring charges

The FTC Click-to-Cancel rule and ROSCA (Restore Online Shoppers' Confidence Act) both require affirmative explicit consent before a consumer is enrolled in a recurring charge. GDPR Art. 7 adds the requirement that consent be freely given, specific, informed, and unambiguous — a pre-checked checkbox satisfies none of these criteria. A checkout form where the billing consent checkbox is pre-checked (defaultChecked={true}) or where consent is inferred from accepting generic Terms is not compliant under any of these three frameworks. The business impact is concrete: Visa and Mastercard both treat pre-authorization failures as chargeback-eligible events under their dispute guidelines.

Replace any generic terms checkbox with a dedicated, unchecked-by-default billing consent element in app/checkout/page.tsx:

// app/checkout/page.tsx
<div className="billing-consent">
  <label className="consent-label">
    <input
      type="checkbox"
      name="billing_consent"
      required
      defaultChecked={false}
    />
    <span>
      I authorize monthly charges of $9.99 USD. I can cancel anytime at
      Account Settings → Billing with no penalty.
    </span>
  </label>
</div>

The consent text must explicitly state the amount and frequency. Do not combine this with a generic "I agree to the Terms" checkbox — the billing authorization must be a separate, standalone element.