The SaaS Subscription Trap: How "Forgot to Cancel" Became a Business Model
Most people blame themselves when they forget to cancel a free trial. I did too, until I started looking at the numbers behind why this keeps happening to everyone.
This is not about forgetfulness. It is a designed system.
The data nobody talks about
A Stanford and NBER study published in the American Economic Review (2025) tracked roughly 30% of U.S. subscribers across 10 subscription services using real card-network data. Their finding: consumer inattention increases firm revenue by 14% to over 200%, depending on the service. One service's revenue nearly tripled because of it.
The probability that a subscriber makes an active renewal decision ranges from just 4.4% to 50% across services. Most renewals happen passively, no decision made, money gone.
Here is the tell: when a credit card has to be replaced, forcing an active choice, the monthly cancellation rate spikes 4x higher than average. People who are forced to actively re-commit cancel at four times the normal rate. That single data point is the whole argument.
The researchers also found the trap is regressive. Less financially sophisticated consumers show roughly double the revenue impact from inattention. The people least able to absorb the loss are absorbing the most of it.
The industry built a playbook around this
First Page Sage tracked 86 SaaS companies across three years. Opt-out trials, the kind that require a credit card upfront and charge automatically at the end, convert at roughly 3x the rate of opt-in (no-card) trials per visitor.
Only about 12% of SaaS companies use the opt-out model. But those 12% generate disproportionately more unintended revenue per visitor, not because their product is better, but because the mechanism does the work.
The industry knows this. These numbers are published by marketing firms selling conversion advice to SaaS founders. "Require a card upfront" is a growth tactic, openly discussed at every SaaS conference. The fact that it works primarily by trapping people who forget is not a side effect. It is the mechanism.
Amazon named their cancellation flow the "Iliad"
The clearest internal admission I found was not from a startup. Amazon had an internal name for their Prime cancellation flow: the "Iliad", after Homer's epic, chosen specifically because it was long and arduous.
Internal documents, later cited in FTC litigation, showed that a 2017 redesign of that flow caused a 14% drop in completed Prime cancellations. The redesign made it harder to leave. They measured it. They kept it.
In September 2025, Amazon settled with the FTC for $2.5 billion, $1 billion in civil penalties and $1.5 billion in refunds to roughly 35 million customers. The FTC's case rested on exactly this: dark enrollment patterns and a deliberately engineered cancellation flow.
The Vonage case from 2022 produced another internal admission. An internal Vonage email, quoted in the FTC's own complaint, described customers being "sent in a circle when they want to downgrade or remove the service." That settled for $100 million.
The regulator tried to fix it. Then lost.
The FTC finalized a "Click to Cancel" rule in 2024, scheduled to take effect July 14, 2025. The Eighth Circuit vacated it on July 8, six days before it was due to start. The rule never went into effect.
The FTC has said it will keep pursuing cases under existing law. But the rule that would have required companies to make cancellation as easy as signup is gone.
In the same period, Cerebral, the mental health platform, settled for charges that included billing users who had already tried to cancel. The FTC director's quote from that case: "They didn't just make it hard to cancel, they charged people after they tried to leave."
That sentence describes at least eight of the thirty SaaS tools I audited recently. Not as exceptions. As patterns.
What this means if you're building something
A Stanford economist's policy simulation found that forcing an active opt-in every six months would cut inattention-driven revenue by roughly 50%. That is the size of the incentive on the other side.
I am not saying every SaaS founder who uses opt-out trials is consciously running a trap. Some are just following the playbook without thinking about where the conversion comes from. But the data is not ambiguous about what is happening.
70% of people admit to forgetting to cancel a free trial and getting billed, per a 2026 survey of 1,272 US adults. The average person carries 2.6 unused paid subscriptions. 100% of respondents in a separate West Monroe survey underestimated their own subscription spend, and 66% were off by more than $200 a year.
This is not a niche problem. It is structural.
What I built because of it
I built BillSensor after getting hit with a $209 charge from a tool I thought I had cancelled months earlier. It monitors your billing emails as you use Gmail, alerts you 7 days before any renewal hits, and flags tools that charge after you have already cancelled.
The post-cancellation monitoring feature exists specifically because eight of the thirty tools I audited have documented patterns of billing continuing after a confirmed cancellation. Two of them, Zoom and Intercom, publish their own official help articles about it.
No Gmail OAuth. No bank connection. Nothing leaves your browser.
If you have been building with opt-out trials and you have not thought carefully about where your conversion is coming from, I am not here to tell you what to do. But the FTC's $2.5 billion Amazon case and the academic research now sitting on the FTC's own website suggest the regulatory and reputational risk is real, and accelerating.
Sources
Einav, Klopack & Mahoney — Consumer Inattention and Subscription Renewals, AER 2025 / NBER Working Paper 31547 https://web.stanford.edu/~leinav/pubs/AER2025.pdf
NBER Digest — Plain-language summary of the inattention study https://www.nber.org/digest/202310/consumer-inattention-and-subscription-renewals
First Page Sage SaaS free trial conversion benchmarks via SHNO.co https://www.shno.co/marketing-statistics/free-trial-conversion-statistics
Amazon "Iliad Flow" — Fast Company https://www.fastcompany.com/91409096/amazon-iliad-flow-prime-lawsuit
FTC v. Amazon settlement — Time https://time.com/7320708/amazon-prime-ftc-lawsuit-settlement-membership-subscription-cancel-dark-patterns/
FTC v. Vonage — $100M settlement press release https://www.ftc.gov/news-events/news/press-releases/2022/11/ftc-action-against-vonage-results-100-million-customers-trapped-illegal-dark-patterns-junk-fees-when-trying-cancel-service
FTC Click to Cancel rule vacated — Cooley https://www.cooley.com/news/insight/2025/2025-07-11-click-to-cancel-just-got-cancelled-eighth-circuit-vacates-entirety-of-ftcs-negative-option-rule
FTC / Cerebral settlement https://www.lawyer-monthly.com/2025/05/ftc-cerebral-refund-subscription-scandal/
Self.inc — Cost of Unused Paid Subscriptions 2026 https://www.self.inc/info/cost-of-unused-paid-subscriptions/
West Monroe — Americans Spending More on Subscriptions survey https://www.westmonroe.com/press-releases/americans-are-spending-more-on-subscriptions-and-are-less-aware-of-spending
FTC "Bringing Dark Patterns to Light" staff report, Sept 2022 https://www.ftc.gov/system/files/ftc_gov/pdf/P214800+Dark+Patterns+Report+9.14.2022+-+FINAL.pdf
Einav/Klopack/Mahoney paper hosted on FTC.gov https://www.ftc.gov/system/files/ftc_gov/pdf/klopackeinavmahoney.pdf
Pratap H, solo founder. IIT Grad. Building BillSensor.
The 4x cancellation spike on card replacement is the number every founder should run against their own book, because it tells you what share of MRR is a decision versus a default. I look at exactly this when I evaluate deals: two companies at identical ARR are not worth the same if one survives forced re-consent and the other does not, and the second one usually finds that out during diligence rather than before it. Inattention revenue spends fine, it just disappears the month a processor changes something you do not control.
Inattention revenue spends fine, it just disappears the month a processor changes something you do not control." That's the cleanest version of the risk I've seen articulated.
The diligence timing is what makes it brutal. A founder optimizing for that MRR isn't necessarily aware the floor is conditional until someone runs exactly the analysis you're describing. The card replacement spike is observable in their own data — most just aren't looking for it because the aggregate churn number looks fine.
What's interesting is that the Stanford paper found the effect varies enormously across services, 4x on average but up to 10x outliers. That variance matters for diligence too. A business where inattention revenue is 20% of MRR is a different risk profile than one where it's 80%, and the aggregate churn number won't tell you which you're looking at.
Strong post, and the card-replacement result is the right anchor. One correction on the regulatory timeline, because it changes the risk read for founders: the Eighth Circuit vacated the FTC's Click to Cancel rule on July 8, 2025, six days before its scheduled July 14 effective date. The rule never went into effect. It wasn't killed weeks after launch, it was killed before it started. Your own cited source, the Cooley writeup, is dated July 11 and covers exactly this.
What is actually live right now: (1) the FTC never needed the rule; Amazon at $2.5B, Vonage at $100M and Cerebral were all brought under ROSCA and Section 5; (2) California AB 2863 has required click-to-cancel and same-medium cancellation for auto-renewing contracts entered on or after July 1, 2025, so for California subscribers much of what the federal rule would have done is already state law; (3) the FTC restarted rulemaking with an ANPRM published March 2026, so a replacement federal rule is realistically a 2027 event at the earliest.
The honest headline for founders building with opt-out trials is not "rule gone, risk accelerating." It's "federal rule stalled, state law already here, and enforcement never depended on the rule." The risk isn't coming. It's distributed.
That correction stands and I appreciate the precision. You're right on the timeline — the rule was vacated before it took effect, not after, and I misread the Cooley piece. The post has that wrong and it matters because the risk framing changes with the accurate sequence.
The distributed enforcement point is the more important headline for founders. ROSCA and Section 5 were always the teeth — the rule would have codified what the FTC was already winning on. California AB 2863 filling the federal gap for a significant slice of any US subscriber base is the more immediate operational fact.
The 2027 federal replacement timeline is useful context too. Anyone building with opt-out trials and assuming the regulatory window is wide open because the rule failed is reading the situation wrong in both directions — underestimating state-level exposure and overestimating how much the federal stall actually changes enforcement risk.
I'll correct the post. Thanks for the specifics.
Appreciate you taking the correction in good faith, and for fixing the post. The accurate sequence is the whole difference: the window was never open, the risk just relocated to state law and card-network rules. If the ANPRM timeline shifts before 2027, the map is one question away.
Noted, and appreciated. The ANPRM timeline is the one variable worth watching — if that moves earlier, the risk profile for founders who haven't adjusted shifts fast. I'll keep an eye on it.
The distinction between retention because a product keeps delivering value and retention because cancellation requires inattention is important. It also makes me think there’s a product-design opportunity here beyond subscription monitoring: what would SaaS metrics look like if founders treated intentional renewal as the real retention signal? A smaller base of customers actively choosing to stay may tell you far more about product-market fit than a larger base that includes people who simply haven’t cancelled yet. The incentive structure makes that difficult, but it seems like a much healthier metric to build around long term.
That intentional renewal metric is something I keep coming back to. "Customers who actively chose to stay" versus "customers who haven't left yet" are genuinely different numbers, and most SaaS dashboards make no distinction between them.
The incentive problem is real though. Churn rate is what investors look at, and a founder who optimizes for intentional renewals will show higher short-term churn even if their retained base is healthier. That's a hard pitch in a fundraising context.
What I find interesting is that the data already exists to build this metric. Card replacement events, the moment Einav et al. used to identify inattentive subscribers, are observable. A founder who wanted to know their "intentional retention rate" could approximate it. Nobody is building dashboards around it because the number would be uncomfortable.
The problem is clearly real, but the harder product question seems to be frequency: do people keep using BillSensor because it changes how they manage subscriptions, or does it mainly become valuable when it catches a renewal they would otherwise have missed?
Honest answer: right now it's mainly the second. Someone installs it after getting burned, it catches a renewal they would have missed, and that's the moment they feel the value.
The "change how you manage subscriptions" habit is harder to build because most people don't think about subscriptions until they're already charged. The alert 7 days out is the first time the product enters their mental model for that cycle.
What I'm watching is whether the post-cancellation monitoring changes that. That's the feature where someone has already taken an action, marked something as cancelled, and BillSensor is now actively watching. That creates a different kind of engagement — not passive detection but an ongoing task the user assigned to it. Early signals on that are more interesting than the passive detection usage.
The honest version of your question is probably: is this a tool people use or a tool people have installed. I don't have a clean answer yet. That's what the next 90 days are for.
That distinction is useful — especially the shift from passive detection to a task the user actively assigns to BillSensor. I’d be interested in digging into whether that monitoring behavior becomes the recurring value. Happy to continue privately — what’s the best email to reach you on?
Appreciate it. Easiest to reach me at x.com/BillSensor or through billsensor.com/page/contact — happy to continue there.
Thanks! I’ve just sent it over.
Looking forward to hearing your thoughts whenever you have a chance.
We haven't received any, please clarify where you sent.
I sent it to the contact form listed on your site.