The legal requirements that govern a customer relationship kick in the moment both sides agree to exchange something of value, and they reach well past the invoice. Federal law sets floors on fees, privacy notices, credit reporting, and cancellation rights. State law adds sales tax collection, consumer privacy rights, and breach notification deadlines. Your written agreement fills in the rest. Knowing which duties come from the contract and which come from statute matters, because statutory duties cannot be waived by clicking “I Agree.”
When a Legal Relationship Actually Begins
Two things have to be present: mutual agreement to the terms, and an exchange of value. The value can be money, a subscription commitment, or access to a platform in exchange for data. Without both, there’s nothing to enforce.
Most relationships now form through clickwrap: you check a box or tap “I Agree” before completing a purchase or opening an account. Courts generally enforce these because the click shows acceptance. Enforceability turns on two questions. Did you have reasonable notice of the terms? Did your action clearly show agreement? A checkbox next to a visible summary holds up. A buried link with no affirmative action required often doesn’t.
For sales of physical goods, Article 2 of the Uniform Commercial Code applies in every state and standardizes rules on delivery, risk of loss, warranties, and nonconforming products.1Legal Information Institute. UCC 2-102 Scope; Certain Security and Other Transactions Excluded From This Article Services, software licenses, and digital products sit outside Article 2 and are governed by the contract itself plus applicable state law.
Both sides also need legal capacity. Minors generally cannot be bound to a contract and can walk away from most deals while still underage, with the main exception being contracts for necessities like food, clothing, and shelter. The same capacity defense is available to someone who lacked the mental ability to understand what they agreed to. If a minor turns 18 without taking steps to void the contract, that window typically closes.
A well-formed agreement spells out what the business will deliver, what the customer pays, when payment is due, and how disputes get resolved. Courts can refuse to enforce agreements with essential terms left undefined, and ambiguity is almost always read against the party that drafted the contract.
Payment Duties on Both Sides
The customer’s core duty is to pay the agreed amount on the agreed schedule. In business-to-business settings, net-30 or net-60 terms are standard. Consumer transactions typically require payment at the point of sale or on a recurring cycle.
Late payments cost money, and consumer credit card fees are federally capped. A card issuer can charge up to $27 for a first late payment and up to $38 for another late payment within the next six billing cycles.2Consumer Financial Protection Bureau. 12 CFR 1026.52 Limitations on Fees The fee can never exceed the minimum payment due, so a $15 minimum caps the late fee at $15. These safe harbor amounts are adjusted annually for inflation.
The business owes duties in the other direction. Invoices should break down what was provided, the cost of each line item, applicable taxes, and any additional fees. Vague or inaccurate billing is one of the fastest routes to a dispute, and once a customer starts questioning charges, the relationship rarely recovers.
Sales Tax and Payment Reporting
Businesses selling goods or taxable services owe duties not just to the customer but to state tax authorities. Combined state and local sales tax rates range from zero in the five states with no state-level sales tax to over 10% in some jurisdictions, with a common combined rate around 7.5%.
Physical presence is no longer the trigger. Since the Supreme Court’s 2018 decision in South Dakota v. Wayfair, states can require out-of-state sellers to collect and remit sales tax based on economic activity alone. Most states set the threshold at $100,000 in annual sales into the state. An online retailer with no warehouse, office, or employee in a state still must register, collect, and remit once it crosses that line.
Businesses that accept payments through third-party platforms also face Form 1099-K reporting. The threshold applies when a seller receives more than $20,000 and conducts more than 200 transactions in a calendar year.3Internal Revenue Service. IRS Issues FAQs on Form 1099-K Threshold Under the One Big Beautiful Bill A 2021 law briefly dropped that threshold much lower, but federal legislation in 2025 retroactively restored the original limits.
Data Privacy Duties
Businesses start collecting personal information the moment a relationship begins, and both federal and state law regulate what happens with it.
Gramm-Leach-Bliley for Financial Institutions
Financial institutions must explain their information-sharing practices, describe how they protect customer data, and give customers the right to opt out of having their information shared with certain third parties.4Federal Trade Commission. Gramm-Leach-Bliley Act Privacy notices go out when the relationship starts and at least once every 12 months afterward.5Office of the Law Revision Counsel. 15 USC 6803 – Disclosure of Institution Privacy Policy An exception exists for institutions that haven’t changed their practices and only share data in limited ways the statute permits. Notices must be clear and conspicuous.
State Privacy Laws
Nearly every state has now enacted a comprehensive consumer data privacy law. Specifics vary, but most give you the right to find out what personal information a company has collected, request deletion, and opt out of sales to third parties. Businesses covered by these laws must provide a clear way to exercise those rights. Penalties apply per incident and vary by state. Some states also let individuals sue directly when a data breach results from a company’s failure to maintain reasonable security.
Breach Notification
Under SEC regulations effective since August 2024, covered financial institutions must notify affected customers within 30 days of discovering a breach. Service providers must alert the institution within 72 hours.6U.S. Securities and Exchange Commission. Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information A narrow exception allows the Attorney General to delay notification for up to 30 days if it would risk national security or public safety. Most states layer on their own breach notification deadlines, so businesses typically face overlapping obligations after a single incident.
Baseline Federal Consumer Protections
These rights apply regardless of what your contract says and cannot be waived.
FTC Act
The FTC Act makes it illegal for businesses to engage in unfair or deceptive practices in commerce.7Office of the Law Revision Counsel. 15 USC 45 – Unfair Methods of Competition Unlawful; Prevention by Commission That covers misleading advertising, bait-and-switch tactics, hidden fees, and conduct that would deceive a reasonable person about a product’s price, quality, or nature. Companies that receive a formal notice of penalty offenses and continue the prohibited conduct face civil penalties of up to $50,120 per violation, adjusted annually for inflation.8Federal Trade Commission. Notices of Penalty Offenses
Fair Credit Reporting Act
When the relationship involves a credit check or background screening, the Fair Credit Reporting Act controls how that information is gathered and used. Consumer reporting agencies must follow reasonable procedures to ensure accuracy.9Office of the Law Revision Counsel. 15 USC 1681e – Compliance Procedures If inaccurate data appears on your credit report because a business reported it incorrectly, you have the right to dispute it and the agency must investigate. Businesses that use credit reports to deny you a service must tell you and identify which reporting agency supplied the data.10Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act These protections apply whether the relationship involves a credit card, a lease, an insurance policy, or employment.
Cancellation Windows
Some transactions come with a built-in escape hatch, and the windows are short.
FTC Cooling-Off Rule
The FTC’s Cooling-Off Rule covers door-to-door sales and purchases at temporary locations like trade shows, hotel presentations, and convention centers. For a sale at your home of $25 or more, you have until midnight of the third business day to cancel.11eCFR. 16 CFR Part 429 – Rule Concerning Cooling-Off Period for Sales Made at Homes or at Certain Other Locations At other temporary locations, the threshold is $130. The seller must disclose this right at the time of sale and provide two copies of a cancellation form. If you cancel, the seller has 10 business days to return any payments or trade-ins.
Purchases made entirely online, by mail, or by phone do not qualify. Insurance, securities, and automobile sales at temporary auto shows are also excluded.
Truth in Lending Act Rescission
For certain credit transactions secured by your home, typically home equity loans and refinances rather than purchase mortgages, the Truth in Lending Act gives you three business days to rescind. The lender must disclose the right and provide the forms.12Office of the Law Revision Counsel. 15 USC 1635 – Right of Rescission as to Certain Transactions If the lender fails to make the required disclosures, your right to rescind can extend up to three years from the date of the transaction or until the property is sold, whichever comes first.
Arbitration Clauses
Most customer agreements now include a mandatory arbitration clause, and people are often surprised by how enforceable these are. Under the Federal Arbitration Act, a written agreement to resolve disputes through arbitration is binding, subject only to the same defenses that would invalidate any other contract.13Office of the Law Revision Counsel. 9 USC 2 – Validity, Irrevocability, and Enforcement of Agreements to Arbitrate
If you signed or clicked through an agreement with an arbitration clause and later have a dispute, you will likely resolve it through a private arbitrator rather than in court. Many clauses also include class action waivers that prevent you from joining a collective lawsuit, and courts have consistently upheld those waivers when the underlying arbitration agreement is valid. Enforceability still turns on presentation: a clickwrap with visible terms and an affirmative “I Agree” is strong, while a notice stating “by using this site you accept our terms” with no affirmative action is weaker. Arbitration decisions are typically final with very limited appeal grounds, so knowing the clause is there before a dispute arises matters more than finding it after.
Ending the Relationship
Walking away cleanly takes more than canceling payment.
Most services require written cancellation through a specific channel, whether an online portal, an email, or a formal letter. Using the wrong method can mean the cancellation doesn’t take effect when you think it does. Auto-renewal clauses are the common trap: many subscriptions roll over automatically unless you cancel before a deadline that falls days or weeks ahead of the renewal date. Missing it by a day locks you into another billing cycle.
Outstanding balances don’t vanish when the relationship ends. Unpaid amounts can be sent to collections, reported to credit bureaus, or both. If you dispute the final bill, raise it in writing before the account closes. Contesting charges after the relationship is severed is harder and usually means dealing with a collector rather than the original business.
Post-termination duties may include returning company-owned equipment like modems, security devices, or leased hardware within a stated deadline. Failure to return triggers additional charges that often appear weeks later. Once balances are settled and equipment is back, the legal relationship is effectively over, though certain provisions like confidentiality or non-disparagement clauses can survive termination and remain enforceable.