Written confirmation sent after enrollment with all terms
Why it matters
FTC Negative Option Rule (2025) and California ARL both require written confirmation of subscription enrollment including material terms — price, billing period, next billing date, and cancellation instructions. Stripe's default payment receipt satisfies the payment acknowledgment but does not include a cancellation path, which is the regulatory requirement most commonly cited in enforcement guidance. The confirmation email also serves as the user's primary reference if they want to cancel before the next billing date; without it, support tickets and chargebacks increase measurably.
Severity rationale
Medium because the absence of a compliant confirmation email violates written-notice requirements under FTC rules and state ARL statutes, though the enrollment itself may have been validly consented to.
Remediation
Handle the checkout.session.completed Stripe webhook and send a custom confirmation email that includes all material terms. In app/api/webhooks/stripe/route.ts:
if (event.type === 'checkout.session.completed') {
const subscription = await stripe.subscriptions.retrieve(
session.subscription as string
)
await sendEmail({
to: session.customer_email!,
subject: 'Your subscription is confirmed',
template: 'subscription-confirmation',
data: {
planName: subscription.items.data[0]?.plan.nickname ?? 'Pro Plan',
price: (subscription.items.data[0]?.plan.amount ?? 0) / 100,
period: subscription.items.data[0]?.plan.interval ?? 'month',
nextBillingDate: formatDate(subscription.current_period_end),
cancelUrl: `${process.env.NEXT_PUBLIC_APP_URL}/settings/billing`,
},
})
}
The email template must include plan name, amount, billing frequency, next charge date, and a sentence: 'To cancel, visit [link] before [next billing date].'
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Subscription & Auto-Renewal Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · ftc-negative-option-rule-2025 — FTC Negative Option Marketing Rule (2025) § 425.5 — post-enrollment confirmation requirements
- external · california-arl — California Automatic Renewal Law (Bus. & Prof. Code §17602(b)) — acknowledgment with cancellation instructions
- external · eu-consumer-rights-directive-2011-83-eu — EU Consumer Rights Directive 2011/83/EU Art. 8(7) — order confirmation on durable medium
Taxons
History
- 2026-04-18·v1.0.0·Initial import from subscription-compliance·automated