The strictest state is not always California.
If you sell a subscription nationally, the cancel flow was almost certainly built to California's automatic renewal law, on the reasonable theory that clearing the strictest state clears the rest. Usually it does.
It does not hold in Georgia. Georgia's rule is close enough to California's to look satisfied, and it differs in two places that live in the code rather than the copy. One of them asks for a path a California build is specifically encouraged not to need.
What is the Georgia Online Automatic Renewal Transparency Act?
HB 528, enacted in 2023, effective January 1, 2024, codified at O.C.G.A. 10-1-439.5 through 10-1-439.13. The statute names itself: "This part shall be known and may be cited as the 'Georgia Online Automatic Renewal Transparency Act.'"
It reaches any business that lets a consumer accept an automatic renewal or continuous service offer online: a subscribe and save brand, a monthly telehealth program, a med spa membership.
Nothing about it is new. The reason to read it now is that the compliance writing on subscriptions concentrates on California and New York, so a flow can be well built and never have met this text.
Does Georgia require online cancellation?
Yes, and this part will feel familiar. Section 439.8(a) requires a business that accepts an online signup to "allow a consumer to cancel the automatic renewal or continuous service online", through either:
- "A clear and conspicuous link to a website or other online cancellation service"
- "A cancellation email formatted and provided by the business that a consumer can send to the business without additional information"
California names the same two mechanisms: a prominently located direct link or button, or an immediately accessible termination email the business writes. If you built one of those, Georgia's subsection (a) is already done.
So where does the California build fail?
Subsections (b) and (c), and the failure is structural.
Subsection (b) lets you require authentication, then adds the part that matters: a consumer "who is unwilling or unable to enter account information or otherwise authenticate online before online cancellation of the automatic renewal or continuous service shall not be precluded from cancelling the automatic renewal or continuous service offline using an alternate method pursuant to subsection (c)".
Subsection (c) does not leave "an alternate method" to your judgment. It names them. The business must provide "a toll-free telephone number, email address, postal address if the seller directly bills the consumer, or another cost-effective, timely, and easy-to-use mechanism for cancellation", and that mechanism "shall be described in an acknowledgment that includes the automatic renewal offer terms or continuous service offer terms, cancellation policy, and information regarding how to cancel".
That is three build requirements where a California cancel flow has one:
- An online cancel path.
- An offline fallback, from that list, for the customer who cannot or will not authenticate.
- That offline route written into the acknowledgment the customer receives, next to the renewal terms and the cancellation policy.
California's language runs the other way. Termination has to be available "exclusively online, at will, and without engaging any further steps that obstruct or delay". Nothing in it stops you publishing a phone number, and nothing asks you to, so a flow tuned to California almost always has exactly one door. Log in, click cancel. A Georgia customer who cannot get past the login has no route at all, and the statute says they must have one.
Georgia's notice clock runs the other way too
This is the second break, and it is not a disclosure tweak: a different message on a different schedule.
Section 439.9(b) requires a business that accepts an online signup to "provide the consumer with a notice" prior to or within three days after charging the consumer's credit or debit card or payment account, provided the consumer has not opted out of receiving it. Four things have to be in it, in the statute's words:
- "That the automatic renewal or continuous service shall automatically renew unless it is canceled by the consumer"
- "The length and any additional terms of the renewal period"
- If sent electronically, "either a link or another reasonably accessible electronic method that directs the consumer to the cancellation process"
- "Contact information for the business"
Read the trigger carefully, because it decides the build. It is a charge, not a trial conversion, so this is a recurring notice on every renewal, not a one-time warning before the first.
Set it beside California, where a free trial or promotional price lasting more than 31 days earns a notice "at least 3 days before and at most 21 days before" it expires. One message, before one conversion.
A California-tuned build has neither the per-charge send nor the cancellation link inside the message. It has a pre-conversion warning, which in Georgia is the wrong message at the wrong time.
The opt-out is real, so the obligation is not unconditional. But the default is on, and the send has to exist before anyone can decline it.
Can the acknowledgment and the notice come after the order?
Section 439.11 says the requirements "shall apply only prior to the completion of the initial order", with an exception: the acknowledgment carrying the renewal terms, cancellation policy and how to cancel, and the notice required by 439.9(b), "may be fulfilled after the completion of the initial order".
In plain terms, the disclosure work belongs before the order completes, and two specific items may land afterwards. That is the statutory basis for a post-purchase receipt and renewal notice. It is not permission to move the offer terms there.
Do not build from the Attorney General's summary
Georgia's Consumer Protection Division publishes a page on the Act. It is a fine orientation for a consumer and a paraphrase that drops the part that most changes the build. It describes the duty as informing the consumer of the terms "prior to, or within three days of, the consumer being charged", which reads like a single disclosure attached to the first charge. It does note that an electronic notice should offer "a reasonable cancellation method, such as a link", but it does not mention the opt-out, and it stops at account authentication without ever reaching the offline fallback that a consumer who cannot authenticate is still owed under 439.8(b) and (c).
Build from 439.8 and 439.9. The AG page is where a consumer starts a complaint. It is not where an engineer starts a ticket.
Who is exempt?
Section 439.12 names five classes: franchises issued by a political subdivision of Georgia; businesses regulated by the Georgia Public Service Commission, the Georgia Department of Agriculture, the FCC or FERC; entities regulated by the Office of Insurance and Safety Fire Commissioner; financial institutions and bank holding companies under Code Sections 7-1-4 and 7-1-605, with their subsidiaries and affiliates; and foreign banks with a licensed branch or agency.
A wellness brand, a supplement company, a med spa or a telehealth program is in none of them.
What happens if you get it wrong?
Section 439.13 gives enforcement to the Attorney General, who may seek an injunction and restitution, and it shields a business that complied in good faith from civil penalties and damages. It also provides that the Act creates no private right of action and that a violation cannot support one under any other provision of law, so the exposure is a state enforcement action, not a private suit over the violation.
What to change if you already comply with California and New York
Four things, and none is a rewrite.
- Add an offline cancellation route from the 439.8(c) list, staffed to action it the same day. A toll-free number nobody answers is worse than no number, because now it is in writing.
- Put that route in the acknowledgment, beside the renewal terms and the cancellation policy.
- Make the renewal notice a per-charge send, triggered by the charge rather than by a trial ending.
- Put a cancellation link in that notice.
Then test it the way a customer would: subscribe with a real card, then try to get out without logging in.
Point three is where this usually breaks, and it breaks in the plumbing. The renewal notice lives in an email or SMS platform, the charge happens in the subscription app, and if the platform is not reading real billing events the message never sends. That is the same seam as in what a subscription flow still needs after click-to-cancel was vacated, which scopes itself to California and New York. Georgia turns that post's one line about the customer who will not log in into a statute with a named list of mechanisms.
If the product page wording is your open question rather than the cancel path, start with why your subscription checkout went back to Shopify's default wording. Repairing the handoff between storefront, subscription app, email platform and support is the work in CPG and ecommerce website development, and in Shopify and WordPress development when the platform itself is the question.
This is operational guidance, not legal advice. Automatic renewal law varies by state and keeps moving, so have qualified counsel review your offer, disclosures and cancellation flow before you launch or change them.
Common questions
Does Georgia require a subscription to be cancellable online?
Yes. O.C.G.A. 10-1-439.8(a) requires any business that lets a consumer accept an automatic renewal or continuous service offer online to allow cancellation online, through either a clear and conspicuous link to a website or other online cancellation service, or a cancellation email formatted and provided by the business that the consumer can send without additional information. Those are the same two mechanisms California names, so a flow built for California usually satisfies this subsection already.
Does California's exclusively online cancellation satisfy Georgia?
No, not on its own. Georgia permits you to require account authentication, but 10-1-439.8(b) provides that a consumer unwilling or unable to authenticate online may not be precluded from cancelling offline using an alternate method. Subsection (c) names what counts: a toll-free telephone number, an email address, a postal address if the seller directly bills the consumer, or another cost-effective, timely and easy-to-use mechanism. California requires that a customer be able to terminate exclusively online and does not require any offline route, so a build tuned to California often has only one door: log in and click cancel.
When does Georgia require a renewal notice, and what has to be in it?
O.C.G.A. 10-1-439.9(b) requires notice prior to or within three days after charging the consumer's credit or debit card or payment account, unless the consumer has opted out of receiving it. The trigger is a charge, not a trial conversion, which makes it a recurring notice on every renewal rather than a one-time warning. It must state that the service renews automatically unless cancelled, the length and any additional terms of the renewal period, contact information for the business, and, if sent electronically, a link or other reasonably accessible electronic method directing the consumer to the cancellation process.
How is Georgia's notice timing different from California's?
They run in opposite directions from different events. California requires notice at least 3 days before and at most 21 days before a free trial or promotional price lasting more than 31 days expires: one message, before one conversion. Georgia requires notice up to three days after each charge, with a cancellation path inside the notice if it is sent electronically. A build that satisfies California has a pre-conversion warning and usually has neither the per-charge send nor the in-notice cancellation link.
Which businesses are exempt from the Georgia Online Automatic Renewal Transparency Act?
O.C.G.A. 10-1-439.12 exempts five classes: a business or affiliate operating as a franchise issued by a political subdivision of Georgia; a business or affiliate regulated by the Georgia Public Service Commission, the Georgia Department of Agriculture, the Federal Communications Commission or the Federal Energy Regulatory Commission; any entity regulated by the Office of Insurance and Safety Fire Commissioner; any financial institution as defined in Code Section 7-1-4, its subsidiaries and affiliates, and any bank holding company as defined in Code Section 7-1-605; and any foreign bank maintaining a federally or state licensed branch or agency. A supplement brand, a med spa or a telehealth program is in none of them.
Is this a new law I need to react to?
No. HB 528 was enacted in 2023 and the Act took effect January 1, 2024. There is no deadline approaching. The reason to look now is that most national subscription flows were built to California and New York, which are the two states the compliance writing concentrates on, and have never been read against Georgia's text.
Sources
- O.C.G.A. 10-1-439.5, short title of the Georgia Online Automatic Renewal Transparency Act checked 2026-10-12
- O.C.G.A. 10-1-439.8, online cancellation, authentication and the offline alternate methods checked 2026-10-12
- O.C.G.A. 10-1-439.9, unlawful practices and the notice owed prior to or within three days after a charge checked 2026-10-12
- O.C.G.A. 10-1-439.11, which requirements apply before the initial order completes checked 2026-10-12
- O.C.G.A. 10-1-439.12, the five exempt classes of entity checked 2026-10-12
- O.C.G.A. 10-1-439.13, enforcement by the Attorney General, the good faith shield and no private right of action checked 2026-10-15
- Georgia Attorney General, Consumer Protection Division, Online Automatic Renewal Transparency Act checked 2026-10-12
- California Business and Professions Code 17602, termination exclusively online and the 3 to 21 day trial notice checked 2026-10-12
Want this costed for your build?
Tell us what you already have and what is not working, and we will come back with the shape of the work and what drives the number.