Most auto-renewal laws are consumer laws. They do not touch your enterprise deals. A few do, and two of them are old New York laws that nobody talks about.
After 1,000’s of these deals for SaaS vendors, here is the version I wish somebody had handed me. One chart for the landscape, one chart for who can come after you, and eight things to do.
Where the Rules Can Reach a Business Deal.
| Place | What the rule requires | Does it reach your business customers? | Does it cover SaaS or on-prem software? |
|---|---|---|---|
| Virginia | In effect since July 2026. Disclose renewal terms up front, get consent, give notice 30 to 60 days before the cancel deadline, and offer cancellation through every channel you let customers sign up through, at least as easy as the way that customer signed up | Yes. | Both, and Virginia is the clearest state on this. It is one of only two states that adopted UCITA, so its consumer law defines goods to include “computer information” and services to include an “access contract,” meaning a contract to get at someone else’s system electronically. That is a 2004 definition of SaaS. On-prem is covered as intangible goods. No case yet, but the text does the work. Va. Code 59.1-198 |
| Colorado | Disclose the renewal terms before signing, get written consent if a renewal runs longer than a year, provide a cancellation route that is genuinely easy to use, and notice 25 to 40 days before every renewal | Yes. The personal-use limit was deleted | Almost certainly both, but on general language rather than anything software-specific. The trigger is a “paid subscription” for “a good or service,” and the carve-outs are utilities, insurance, banks and air carriers. There is no software exemption and no definition narrowing “service.” No court has applied it to software yet, so this rests on the plain terms. C.R.S. 6-1-732 |
| New York | Written notice 15 to 30 days before the cancel deadline, hand delivered or by certified mail. Two neighboring sections carry it, one for servicing property and one for leases of personal property | Yes. “Person” includes companies, and there is no personal-use limit | The split one, and it runs backwards from what you would guess: on-prem is more exposed than SaaS. Three things make it dangerous. Courts read the statute broadly because it is remedial, they have held “personal property” includes intellectual property, and your customer does not have to own the property being serviced. In Healthcare I.Q. v. Chao a software license bundled with handling the customer’s records was covered. In Vitac v. Thomson Reuters a service delivered over the internet was not, and elsewhere merely incidental access to data has not been enough. An installed copy with maintenance looks like the first case, pure hosted SaaS like the second. No court has held that software itself is personal property, or decided a pure SaaS license. N.Y. Gen. Oblig. Law 5-903 |
| North Dakota | Each renewal increment is capped at twelve months. The deal itself can run as long as you like. Notice 30 to 60 days out where a renewal runs more than six months | Maybe. The statute never says | Both, on its terms. It covers “merchandise or a service,” and defines “agreement” to include merchandise, personal property, real property or services. The only exceptions are insurance, utilities and banks. New enough that there is no case law, but there is nothing here for a software vendor to stand behind. N.D. Cent. Code ch. 51-37 |
| New York City | Disclosure, cancellation through every signup channel, renewal and price-change notices. Starts October 1, 2026 | Probably not, but untested, and penalties are counted per customer | Both, on its terms. Same generic “paid subscription” and “continuous service” language, with no software carve-out. It does not take effect until October 1, 2026, so there is nothing to read yet. 6 RCNY 5-110.1 |
| California | The most detailed set of rules in the country, and consumer-only | No | Yes, and this is the most heavily litigated of the group. Courts have been applying it to online and app subscriptions for years, so nobody seriously argues software is outside it. Which is academic for your enterprise deals, because it only protects individuals. It is your self-serve signup page that has to care. Cal. Bus. & Prof. Code 17601 |
| Illinois | Disclosure and notice rules, but they stop at the door | No, and it says so | Software yes, businesses no. A federal court applied the Illinois rules to an online research subscription, so the delivery model was never the obstacle here. Section 20 is: business-to-business contracts are excluded outright. 815 ILCS 601/20 |
| Everywhere else | Florida, Maryland, Kentucky, Maine, Oregon, Hawaii, Connecticut, Utah, D.C., Minnesota, Massachusetts, and New York State’s own newer law | No. All limited to individuals buying for personal or household use | Usually yes on the software question, and it does not matter. Maine goes furthest and expressly lists online software as a covered category. Florida is the outlier and probably excludes SaaS, because it reaches only service, maintenance or repair contracts. All of these are consumer-only, so they land on your signup page, not your negotiated deals. e.g. N.Y. Gen. Bus. Law 527 |
One thing to watch. If you also sell a self-serve plan where somebody types in a credit card, that channel is a consumer sale. Every law in that last row comes back. The business analysis protects your negotiated paper, not your signup page. Same idea we cover in click-to-cancel rules and your SaaS subscription agreement.
And it does not matter where you are. These rules follow the customer, not the seller.
Who Can Come After You.
Who gets to raise a violation matters more than the rule itself. An Attorney General has to decide you are worth the trouble. Your customer does not.
| Law | Who can assert it | What it costs you |
|---|---|---|
| Virginia | The Attorney General and any private party | Actual damages or $500, whichever is greater. Triple damages or $1,000 if it was willful. Plus your customer’s legal fees. And Virginia counts small businesses as protected customers |
| Colorado | The Attorney General and district attorneys only. The statute says their authority is exclusive. The law is new, so some risk of a private claim cannot be ruled out | An enforcement action. No customer suit and no class action |
| New York, both laws | Your customer. No agency involved | You lose the renewal, and you find out about it when you invoice |
| North Dakota | Your customer. No agency involved | You lose the renewal, and you may not be able to collect for service you already delivered |
| New York City | The city agency only | $525 to $3,500 per violation, counted per customer, plus refunds |
That chart flips what you would expect. Colorado looks like the strictest law here, and it is the safest, because only prosecutors can act on it.
The two quiet ones are the dangerous ones. In New York and North Dakota there is no agency in the picture. Your customer holds the remedy, and they reach for it when you send the renewal invoice.
Virginia is where you actually get sued. It covers small businesses, it guarantees them a minimum recovery, and it makes you pay their lawyer. Nothing else on the list does all three.
What You Have to Do.
Eight things. Do all eight and you are covered everywhere on that chart.
- Say it up front. Before they sign, in plain view: this renews by itself, the renewal term is this long, the price is this, here is the deadline to cancel, and here is how.
- Get a yes you can prove. A signature on the order form does it. Online, a checkbox tied to the renewal terms. Keep the record.
- Confirm it after they sign. Send something they can keep that repeats the renewal terms and says how to cancel. Email is fine here.
- Be deliberate about renewals longer than a year. You can still write a two or three year auto-renewal. Colorado does not ban it. Colorado wants the renewal term disclosed clearly before signing, and written consent to a renewal longer than a year. A negotiated order form that spells out the term very likely does that already. North Dakota is stricter but narrower: each renewal increment caps at twelve months, though the deal itself can run as long as you want. More on term length in short-term versus long-term commitments in your SaaS agreement.
- Send a reminder 30 days before the cancel deadline. Before every renewal, not just the first. That means it lives in your billing system, not on somebody’s calendar.
- For New York customers, mail it (if it applies). Hand delivered or certified mail. Email does not count. This is the most common miss I see, and it has the worst result.
- Give them a real way out, and build the online one. Neither Colorado nor Virginia lets a paper signature buy you a paper-only exit. Colorado’s safe options are a one-step online link or an in-person desk at a location where the customer regularly uses the service, which for a SaaS vendor means the link. Virginia is broader: cancellation through every channel you let customers sign up through, at least as easy as the way that customer signed up. Watch the divergence. Virginia accepts a phone line, Colorado’s safe list does not, so the online link is the one build that satisfies both. It can live in the renewal reminder email rather than behind a portal. Then two traps. Making cancellation a request rather than an action never works, so “reply and we will process it” does not count. And Virginia only lets you route cancellation through a salesperson if a salesperson is the only way anyone signs up, so adding a self-serve plan means you owe self-serve cancellation to everyone.
- Warn before a price increase. Advance notice of any real change to the renewal, with cancellation information next to it.
Why 30 Days.
Because the windows do not line up. Colorado wants 25 to 40 days. Virginia and North Dakota want 30 to 60. New York wants 15 to 30. And note these windows have ceilings, not just floors. Sending notice 90 days out does not comply anywhere, even though it sounds more generous.
Thirty is the only number that satisfies all of them.
Can You Just Pick a Friendly State’s Law?
No, and it fails both ways. Pick a friendlier state and courts usually apply your customer’s state anyway, because these laws protect people where they live. Pick a stricter one and your customer still gets their own state’s rules, not the stricter set. A governing law clause is not a compliance plan.
The New York Trap.
This is the one that costs real money, and it has nothing to do with picking a friendly state.
New York’s rule has no geography in it. It does not mention New York residents, New York transactions, or doing business in New York. It reads like a plain contract rule. So it travels wherever New York law travels.
Courts outside New York have applied it. A Texas appeals court killed a renewal because the contract picked New York law. A federal court in Texas applied the same rule to an out-of-state company that had no New York clause at all, simply because the contract recited that it was made in New York.
So if your master agreement says New York law governs, and plenty of software agreements do, you may owe that certified mail notice to every customer in every state. This is the step almost everyone misses, so it is worth checking before your next cycle runs.
It gets worse. In that Texas case the vendor lost the renewal, then sued to get paid for the year of service it had already delivered. It lost that too. A year of work, nothing collected.
The Bottom Line.
Most of this is settings and workflow, not negotiation. Disclosed renewal terms, a 30-day reminder, a self-serve cancel button, and certified mail for New York gets you most of the way there. Trust me on this one, it is cheaper than arguing about it later.
The renewal clause is one of those provisions where the drafting and the day-to-day operation have to match, which is the theme running through 3 nuggets every SaaS company needs to remember and the federal side in the FTC’s negative option rule. For the bigger picture, start with our overview of SaaS contracts and agreements.
I hope this helps. If you want a second set of eyes on your order form or your renewal reminders before your next cycle runs, that is a short conversation. And remember this area is in flux, so it changes fast.
What Other Lawyers Are Saying.
I am not the only one reading these this way. If you want a second opinion, start here.
- On software and SaaS specifically. The one piece of writing I have found that takes this question head on is Akiva Miller’s “Can Software and SaaS License Agreements be Renewed Automatically in New York?” He lands about where I do. The cases turn on whether something of the customer’s is being serviced, a pure SaaS license is defensible, and you should not be confident about it, especially once hardware or professional services are bundled with the license.
- Virginia. Thompson Hine titled its alert “B2C and B2B Auto-Renewal Contracts” and says the law reaches suppliers doing deals with small businesses. Greenberg Traurig walks through the 2026 changes.
- Colorado. Ogletree Deakins says the law “now applies to businesses and individuals, rather than just individuals.” KO Law agrees it extends to business-to-business subscriptions. ZwillGen is more cautious and says it “arguably” reaches B2B.
- New York. Barclay Damon notes the statute “specifically states that individuals, firms, companies, partnerships, and corporations are included.” QWCooper works through whether it reaches SaaS specifically, and concludes it probably does for many offerings.
- North Dakota. Olshan and Manatt both flag the twelve-month renewal cap as unique among these laws.
Disclaimer:
This post is for informational and educational purposes only, and is not legal advice. You should hire an attorney if you need legal advice, which should be provided only after review of all relevant facts and applicable law.
Discover more from Aber Law Firm
Subscribe to get the latest posts sent to your email.