Home › How to automate

Automating Customer Onboarding: Where the Order Is Fixed

Welcome sequences are the easy half. Inside the same flow a contract gets formed and a recurring charge gets authorised, and two federal provisions constrain the order those screens appear in: ROSCA puts the disclosure before the billing field, and E-SIGN says what the consent step has to prove.

The Bot Desk staff · September 25, 2026 · 10 min read

Customer onboarding is the stretch between "they said yes" and "they are actually using the thing", and almost every automation built for it is built as a sequence of messages: welcome email, scheduling link, a nudge on day three, a check-in at day fourteen. That part is easy, and it is not where the project succeeds or fails. Somewhere inside the same flow, three things happen that are not messages. A contract gets formed. A payment method gets stored. A record gets created that you will be judged on later, by someone who was not in the room.

Two of those three have federal provisions attached, and what those provisions constrain is the order of the screens, not the choice of tool. Zapier, Make, n8n and a hand-written webhook are all equally capable of putting the billing form before the disclosure. This article is about where the order is fixed and where it is yours to choose.

Five stages hide inside the word "onboarding"

Pull them apart before you automate any of them, because they fail in different ways:

Stage	What actually happens	Automates cleanly?
Capture	The signed-up customer becomes a record with fields, usually from the same form that fed lead routing	Half. Writing the record does; deciding whose record it is does not
Agree	Terms are presented and accepted. This is contract formation, whatever the button says	No. Rules apply here
Collect	Billing details are captured and, if the deal recurs, a mandate to charge again is created	No. Rules apply here too
Provision	Accounts, licences, permissions, welcome kit. The part that feels like the work	Yes, and this is where the hours are
Activate	Training, first use, the check-in sequence, the point at which the customer is self-sufficient	Yes, if you measure the outcome and not the sequence

Provision and activate automate cleanly and are where the time savings are. Capture automates halfway. Agree and collect are where the rules live, and in a funnel built as a message sequence they look like one more screen.

Nobody builds a bad onboarding flow on purpose. They build a funnel, and a funnel is optimized for the fewest screens before the card number.

The parts that automate cleanly

Provisioning is the best-behaved stage in the whole workflow, because it is deterministic: a record with a plan field maps to a set of accounts, groups and permissions. Build it from the record rather than from the conversation, make every step idempotent so a retry does not create a second account, and log what it did. The same discipline covers welcome sequences, scheduling, internal notifications and the hand-off to whoever owns the relationship.

Activation is next, and the trap there is measuring the sequence instead of the outcome. Emails sent is not a number. Customers who completed first use by day fourteen is. If you are trying to work out whether the build pays for itself, the arithmetic is in how to calculate automation ROI, and the honest input is the hours the old process took, not the hours you imagine it took.

Capture is the one that looks like it belongs here and only half does. Writing the record is trivial. Deciding that this record is the same customer as one you already have, or that the person filling the form has authority to bind the company they typed into the box, is not trivial, and it is not a job for a confidence score.

The signature step has a rulebook, and it is narrower than it looks

Start with what the E-SIGN Act actually gives you, because it is generous. Under 15 U.S.C. § 7001(a), a signature, contract or record "may not be denied legal effect, validity, or enforceability solely because it is in electronic form", and a contract may not be denied effect "solely because an electronic signature or electronic record was used in its formation". The definition in § 7006(5) is broad in the same direction: an electronic signature is "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record". A checkbox can be a signature. The intent is what carries it.

The extra rulebook is in § 7001(c)(1), and two conditions have to be true at once before it reaches you. First, the other side has to be a consumer, which § 7006(1) defines as "an individual who obtains, through a transaction, products or services which are used primarily for personal, family, or household purposes, and also means the legal representative of such an individual". Second — and this is the condition that gets dropped — some other "statute, regulation, or other rule of law" has to require that the information be "provided or made available to a consumer in writing". No writing requirement, no § 7001(c)(1). Selling to businesses, or to consumers with nothing that the law says must be in writing, and the checklist below is good practice rather than a condition.

When it does reach you, four things have to be true at the moment of consent, and a fifth obligation arrives later.

What § 7001(c)(1) asks for	What that means on the screen
(A) Affirmative consent, not withdrawn	A deliberate act, stored with a timestamp. Not a pre-ticked box, not silence
(B) A "clear and conspicuous statement" before consenting	Right to paper, right to withdraw and what withdrawing costs, what the consent covers, how to get a paper copy and whether you charge for it
(C)(i) "a statement of the hardware and software requirements for access to and retention of the electronic records"	A plain list of what the customer needs to open and keep the file, shown before the consent, not in the footer
(C)(ii) Consent given or confirmed electronically "in a manner that reasonably demonstrates that the consumer can access information in the electronic form that will be used to provide the information that is the subject of the consent"	The consent has to happen through the format you will actually send. Clicking a web button to agree to receive PDFs demonstrates nothing about PDFs
(D) If a change in requirements later "creates a material risk that the consumer will not be able to access or retain a subsequent electronic record"	Tell them the revised requirements and the right to withdraw without fees, and run subparagraph (C) again. A migration is a compliance event, not just a ticket

Now the part where the statute does less than it appears to. Paragraph (c)(3) says the enforceability of a contract executed by a consumer "shall not be denied solely because of the failure to obtain electronic consent or confirmation of consent by that consumer in accordance with paragraph (1)(C)(ii)". Read the scope twice. It is about the failure of (1)(C)(ii) specifically, it protects the contract, and it says nothing equivalent about the other conditions in (c)(1). What no part of it does is turn an electronic delivery into a legal writing. The contract and the notice are two different questions with two different answers, and a build that treats them as one fixes whichever is easier.

If the buyer is a consumer and the sale is online, the order is fixed

Read the scope before the requirements, because this one is narrower than its reputation. 15 U.S.C. § 8403, the section of the Restore Online Shoppers' Confidence Act that covers negative option marketing on the internet, is written about a "consumer" and about goods or services "sold in a transaction effected on the Internet". "Negative option feature" is not defined in the statute either: § 8403 points at the FTC's Telemarketing Sales Rule in 16 CFR part 310. Whether your subscription flow is one is the first thing to establish, not the last.

Where it does apply, it makes it unlawful for any person to charge or attempt to charge a consumer unless that person does three things, and the first contains the phrase that decides your flowchart:

"(1) provides text that clearly and conspicuously discloses all material terms of the transaction before obtaining the consumer's billing information; (2) obtains a consumer's express informed consent before charging the consumer's credit card, debit card, bank account, or other financial account for products or services through such transaction; and (3) provides simple mechanisms for a consumer to stop recurring charges from being placed on the consumer's credit card, debit card, bank account, or other financial account."

Before obtaining the billing information, not before charging it. A flow that collects the card on screen two and explains the renewal terms on screen four has the order wrong even if nobody is charged until screen five. That is a sequencing constraint an automation builder can actually enforce, and one an optimizer chasing conversion will remove without noticing what it was for.

What happened to "click to cancel", and what still applies

If your compliance notes say you have to comply with the FTC's amended Negative Option Rule, they are out of date, and the correction runs in an unusual direction. Describing the litigation in its own final rule of February 12, 2026, the Commission writes that "The Eighth Circuit found that the Commission's failure to issue a preliminary regulatory analysis was 'procedurally insufficient' and vacated the 2024 Rule", citing Custom Commc'ns, Inc. v. FTC, 142 F.4th 1060 (8th Cir. 2025). That same rule, effective February 12, 2026, restores the Negative Option Rule "in the form it existed before the 2024 Rule became effective". On March 13, 2026 the Commission published an advance notice of proposed rulemaking on the Rule Concerning the Use of Prenotification Negative Option Plans, with comments due by April 13, 2026. Checked on September 25, 2026, no replacement rule had been issued.

None of that reaches § 8403. The Eighth Circuit vacated an FTC rule; the statute is an act of Congress and is not something the Commission can restore or withdraw, and its three requirements are the ones quoted above. The practical reading for a build: design to the statute, keep the cancellation path simple, since cancelling "without unwarranted obstacles" is the declared subject of the March 2026 notice, and do not rebuild your flow around a rule that does not exist yet.

What the automation must not decide, and a first month

Three decisions do not belong to the flow. Whether the person signing can bind the organization, because a title typed into a form is a claim, not a fact. Whether two records are the same customer, when merging them would move money or access — propose the merge, let a person confirm it. And any exception to the terms, because an exception a rule can grant is a term, not an exception. If you want the general version of that argument, it is in who is liable when the bot fails.

A first month that produces evidence rather than a demo:

Week	Do this	What it tells you
1	Do not build. Walk your own flow as a customer and screenshot every screen in order	The order, which is the thing you are auditing
2	Fix the sequence before touching the automation: disclosures before billing fields, consent delivered in the format you will actually use	Whether the problem was the tooling or the funnel
3	Automate provisioning only — idempotent, logged — and leave agree and collect alone	Where the hours really were
4	Run it in parallel for real customers with a person watching	How many records arrive complete, and how often a human had to decide something you assumed the flow would decide

One caveat, stated plainly. This describes what the cited statutes and Federal Register notices say, read in September 2026. It is not legal advice, the provisions have exceptions and definitions this article does not cover, state law adds requirements of its own, and the person who should sign off on your onboarding flow is your attorney, not your automation vendor.