The month California called $284,610 of my revenue a gift, at $53K MRR

The letter arrived on a Tuesday, from a firm I had never heard of, on behalf of a customer who had cancelled eleven months earlier and whom I did not remember. We were at $53,000 MRR. The number in the second paragraph was $284,610, which is what my California customers had paid us over four years, and which is 5.4 months of total company revenue. I spent the first evening reading the letter. I spent the second evening reading the statute, and the statute did not say what the letter said it said.

Quick answer (2026): This is a composite diary, not one real company, though every statute, date and calculation in it is real and checkable. The short version: California's Automatic Renewal Law binds software subscriptions whatever happened to the federal rule, and the 2024 amendments in AB 2863 apply to any contract "entered into, amended, or extended" on or after July 1, 2025, which for a monthly plan means your entire existing book, not just new signups. But the "unconditional gift" clause every demand letter leads with is section 17603, it speaks only of goods a business sends, and AB 2863 did not touch it. Fix the cancel flow. Do not price the settlement off the scary number.

What I believed, and why it was wrong

I had been comfortable for about a year, and my comfort came from headlines.

The Federal Trade Commission announced a final "Click-to-Cancel" rule on October 16, 2024. Then it was challenged, and it did not survive to enforcement, and the founder channels I read treated that as the end of the story. It was not the end of the story. On the same FTC page, dated March 11, 2026, there is an advance notice of proposed rulemaking seeking public comment on negative option marketing practices, which is the agency going back to the beginning of the process rather than walking away from it. So the federal position in 2026 is unsettled and moving, not absent.

None of which mattered to me, because the thing that actually applied to my company was a California statute passed in 2009 and amended in 2024, and I had never read it.

The obligations really do reach software

Here is the part I cannot argue with, and neither can you.

Section 17602(a) of the Business and Professions Code opens: "It is unlawful for any business that makes an automatic renewal offer or continuous service offer to a consumer in this state to do any of the following." Continuous service offer. That is a monthly SaaS subscription, described in the statute's own words. There is no software carve-out anywhere in the article.

And section 17602(d)(1) is California's own click-to-cancel, which has been sitting there regardless of what the FTC did:

Section 17602(d)(1), verbatim: "a business that allows a consumer to accept an automatic renewal or continuous service offer online shall allow a consumer to terminate the automatic renewal or continuous service exclusively online, at will, and without engaging any further steps that obstruct or delay the consumer's ability to terminate the automatic renewal or continuous service immediately."

It then names the two acceptable mechanisms: "a prominently located direct link or button" inside an account, profile or settings screen, or "an immediately accessible termination email formatted and provided by the business that a consumer can send to the business without additional information."

Our cancel flow was: email support, wait for a reply, answer one question about why you were leaving, then get cancelled. Every step of that is an obstruction under 17602(d)(1). I was not in a grey area. I was straightforwardly non-compliant, and I had been for over a year.

There is more that I also was not doing. Section 17602(h) requires an annual reminder to consumers on annual plans, in the same medium they signed up in, disclosing the product, the frequency and amount of charges, and how to cancel. Section 17602(g) requires clear and conspicuous notice before a material change in terms or in the fee, retained in a form the consumer can keep.

The date is not the escape hatch you think it is

My first instinct was to find the grandfather clause, and there is one, and it is the most expensive misreading available.

AB 2863 was chaptered on September 24, 2024. Its own text, at the end of both amended sections, says the amendments "shall only apply to a contract entered into, amended, or extended under this article on or after July 1, 2025."

I read that as: only customers who signed up after July 1, 2025 are in scope. On our numbers that was 61 of our 214 California subscribers, about $2,739 a month, and it felt survivable.

Read the verb list again. Entered into, amended, or extended.

A monthly subscription is extended every month. That is the entire mechanism of a continuous service offer, and it is the thing the statute is about. A customer who signed up in 2023 and renewed on August 1, 2025 had their contract extended on August 1, 2025, which is after July 1, 2025. On a monthly plan, the whole book came into scope within thirty-one days of the operative date.

So the real figure was not 61 subscribers. It was all 214, and $9,610 a month rather than $2,739. The comfortable reading understated the in-scope book by 3.5 times, and it was the reading I would have taken to a lawyer as my opening position if I had not sat down with the bill text.

If you run annual plans the answer is different and slower, because an annual contract is extended once a year rather than twelve times. That is worth knowing before you assume your situation matches mine.

Where the demand letter overreached

Now the other direction, because the letter was wrong too, and it was wrong in the place that generated its headline number.

Every advisory page I read leads with section 17603, and so did the letter. Here it is in full, and the words that matter are in the first line:

Section 17603, verbatim: "In any case in which a business sends any goods, wares, merchandise, or products to a consumer, under a continuous service agreement or automatic renewal of a purchase, without first obtaining the consumer's affirmative consent as described in Section 17602, the goods, wares, merchandise, or products shall for all purposes be deemed an unconditional gift to the consumer, who may use or dispose of the same in any manner he or she sees fit without any obligation whatsoever on the consumer's part to the business, including, but not limited to, bearing the cost of, or responsibility for, shipping any goods, wares, merchandise, or products to the business."

Goods, wares, merchandise, or products. That the business sends. Concluding with who pays to ship them back.

Section 17602 says "continuous service offer" and reaches my company. Section 17603 says "goods, wares, merchandise, or products" and describes return shipping. It is a mail-order clause. My company sends nobody anything.

And then I checked when each section was last touched, which is the check that made the whole thing click. The statute prints its own provenance under every section. Sections 17601 and 17602 read "Amended by Stats. 2024, Ch. 515, Sec. 1" and "Sec. 2. (AB 2863)". Sections 17603, 17604, 17605 and 17606 all still read "Added by Stats. 2009, Ch. 350, Sec. 1. (SB 340)".

I confirmed it a second way rather than trusting the notes: the AB 2863 bill text contains the string "17602" three times, "17601" three times, and "17603" zero times.

So in 2024 the legislature reopened this article specifically to modernise it for digital subscriptions, rewrote the definitions and the obligations, and left the remedy clause exactly as it was written in 2009 for a world of shipped goods. The clause that produces the terrifying number is the one clause in the article nobody updated for software.

What the exposure actually is

This is not a "you are fine" conclusion, and I want to be careful, because I am not a lawyer and the fact that 17603 does not obviously fit does not make a violation free.

Section 17604(a) says a violation "shall not be a crime. However, all available civil remedies that apply to a violation of this article may be employed." In practice that routes through California's unfair competition law, and restitution is a live remedy. The four-year figure in the letter comes from section 17208, which gives that chapter a four-year limitations period.

But the exposure has to be built out of a duty that existed. The 17602(d) online-termination duty I actually breached became applicable to my contracts on July 1, 2025. Collections from California customers since that date were $113,748. The letter's $284,610 reached back four years, across a period in which most of the conduct it describes was not yet governed by the amendments it cited.

And section 17604(b), which I have never once seen quoted in an advisory post, says: "If a business complies with the provisions of this article in good faith, it shall not be subject to civil remedies."

That is a statutory good-faith safe harbour, and it is prospective. It is worth much more to a company that fixes its cancel flow this quarter than any argument about 2022.

The trap I only found because I read the whole thing

One more subsection, because it caught us on a detail nobody would guess.

Section 17602(f) says the ability to cancel "shall be available to the consumer in the same medium that the consumer used in the transaction that resulted in the activation of the automatic renewal or continuous service, or the same medium in which the consumer is accustomed to interacting with the business."

Same medium. We had a meaningful number of customers who had been signed up by our sales team over a call and had never once logged into the application. Shipping a beautiful in-app cancel button does nothing for them, because the app is not the medium they transacted in. Section 17602(e) then makes clear that you may present a retention offer or explain the effect of cancelling, provided the customer can still complete the cancellation, and that for telephone requests you have to say so up front.

So the fix was not one button. It was a button for the self-serve base, and a documented cancel-by-reply path for the assisted base, and those are two pieces of work.

I want to be honest about the limits of what I worked out here. I am a founder who read a statute carefully, not a lawyer, and the reading of section 17603 that saved me most of the number is a textual argument, not a decided case that I can point you to. It is a good argument, and it is the kind of argument you want your lawyer making from a fixed cancel flow rather than a broken one. It is not a licence to ignore the letter.

What actually happened

We shipped a cancel button in the account settings screen. One click, no retention question before the cancellation is effective, confirmation on screen and by email. We added the annual reminder for annual plans and a notice before any price change. Six days of work, most of it spent on the emails rather than the button.

The matter resolved for a number I am not going to publish, well under the letter's figure and, as far as I can tell, well under what it would have cost to argue about 2022 for a year.

The one thing I would tell you

Read the remedy clause, not the summary of it.

I nearly negotiated against $284,610 because nine advisory pages and one demand letter all quoted the same sentence about unconditional gifts, and not one of them mentioned that the sentence is about shipping physical products back to a warehouse. The statute is four screens long. Reading it end to end cost me an evening and changed the number I was arguing about by a factor of two and a half, in one direction, while changing my in-scope monthly book by a factor of three and a half in the other.

Both corrections mattered. Only one of them was comfortable. If you take a single operational thing from this: if a customer can start a subscription with a click, you owe them a button, and you owed it to them before whatever happened in Washington.