The FTC Is Done Warning Subscription Marketers and Shutterstock's $35 Million Bill Is the Proof.
On May 13, 2026, the FTC filed and (simultaneously) settled a lawsuit against Shutterstock for $35 million, making it one of the largest subscription-related enforcement actions in the agency's history.
The allegations: Shutterstock used deceptive "negative option" subscription practices in violation of Section 5 of the FTC Act and the Restore Online Shoppers' Confidence Act (ROSCA). The company made it easy to sign up and hard to leave; burying renewal terms, making cancellation deliberately difficult, and continuing to charge consumers who had attempted to cancel.
The settlement came three months after the FTC, in March 2026, announced its intent to revive its Click-to-Cancel Rule, which had been vacated on procedural grounds in July 2025. The formal rule may be gone (for now), but the enforcement is not. FTC Bureau of Consumer Protection Director Christopher Mufarrige made the agency's position explicit in a March 2026 speech stating that the FTC remains committed to "combating deceptive negative option subscriptions". Shutterstock is what that commitment looks like in practice and no subscription brand is exempt and no marketing team is exempt.
What the Data Shows
Shutterstock is not the first, nor will they be the last: FTC dark pattern cases have produced more than $2.9 billion in combined penalties and consumer refunds since the agency's 2022 enforcement push began.
The issue is widespread: A joint review by the FTC and the International Consumer Protection and Enforcement Network, examining 642 subscription websites and apps, found that nearly 76% employed at least one dark pattern. Nearly 67% used multiple dark patterns.
The FTC is not the only enforcement agency you need to worry about: Approximately 30 states now have their own automatic renewal or negative option statutes, several of which match or exceed the requirements of the vacated federal rule. California's Automatic Renewal Law already imposes clear disclosure, express informed consent, and simple cancellation requirements on any subscription marketed to California residents.
What Most Brands are Getting Wrong
This is not a problem for my marketing team: The instinct in most performance marketing organizations is to hand off subscription practices to product, legal, and UX. The media team drives acquisition; what happens after the click is someone else's problem.
That's the wrong read; marketing is where the exposure actually begins.
Enforcement starts earlier in the funnel than most performance teams realize. The FTC's "clear and conspicuous disclosure" requirement kicks in at the ad, the offer, and the landing page (not at checkout, not buried in terms and conditions). A Google search ad promoting a "free trial" without disclosing automatic renewal is not a product problem. It's a media problem. The performance team wrote the copy, set the offer, and drove the traffic.
We just need to prepare for FTC enforcement: California, Colorado, New York, Virginia, and roughly 26 other states have active compliance obligations for subscription marketers right now. With 30 states running their own playbooks, building to the most stringent standard isn't overcompliance, it's the only version of compliance that actually scales.
LQ's Take: What to Do About It
Audit current ad units: If the offer in the creative doesn't disclose that it converts to a paid subscription, and on what terms, that's where the review needs to start. Pull the copy, pull the landing pages, and read them as a regulator would.
Coordinate with legal before the next subscription campaign goes live: This isn't a simple ask for legal sign-off on the creative. It's a request for a clear brief on what disclosure language is required, in what format, and where in the funnel. Performance teams that have that brief before creative is built avoid having to retrofit and potentially miss the mark.
Drop dark patterns from landing pages; fully, not partially: The FTC deems dark patterns as any design that makes cancellation harder than sign-up. Pre-checked renewal boxes, hidden cancellation links, multi-screen exit pop flows, all of the old retention tricks. Removing them from the post-click experience is both a compliance requirement and, increasingly, a performance lever: consumers who feel trapped do not become loyal customers and are more likely to file complaints.
Best practice is to build toward the California standard, and apply it nationally. California's Automatic Renewal Law is the most demanding state regime in the country. Compliance with California means compliance with the majority of active state laws. Build one disclosure framework that meets that bar and apply it across all markets.
Keep an eye on FTC and state level regulation changes: A revived Click-to-Cancel Rule, with full statutory authority behind it, would give the agency civil penalty power without having to prove deception case by case. If the FTC follows through on bringing the rule back, the enforcement ceiling goes up significantly. Build compliance infrastructure now, not in response to the next $35 million settlement.
