This insight was initially published in 2022 and updated in August 2024.

The Federal Trade Commission (FTC) has continued to ramp up its investigation and enforcement efforts to address unfair or deceptive acts or practices in the privacy, cybersecurity and consumer protection space. With FTC Chair Lina Khan at the helm of the agency, all indications are that this trend will continue in earnest unless there is an administration change. The FTC has also increased its use of tolling agreements to pause the statute of limitations on relevant claims.

How the FTC Uses CIDs

The FTC has many investigative tools in its arsenal but its most widely used compulsory investigative tool is the Civil Investigative Demand (CID). A CID is a type of administrative subpoena that allows the FTC to demand the production of documents, written reports, responses to interrogatory questions and even oral testimony.

Typically, the FTC first conducts an initial investigation into the company or industry to gather facts and data from existing sources, voluntary investigative processes and/or internal review by FTC staff. The FTC may then issue a CID to a company it believes may have engaged in “unfair or deceptive” business practices in violation of Section 5 of the FTC Act.

There is no evidentiary threshold the FTC needs to meet before issuing a CID, however, so the FTC may issue a CID merely to aid FTC investigators in determining whether evidence of a violation exists. The FTC may also issue a CID to a company to obtain information about other companies or an industry it is investigating.

CIDs and Beyond

The CID is often the first formal step of an investigation into a company’s privacy, cybersecurity or consumer protection practices. In addition to the initial CID, the FTC may issue follow-up questions to the company’s responses and additional CIDs to compel investigational hearings or the production of additional records.

If the FTC determines that the investigation does not reveal a violation of law or regulation sufficient to justify an enforcement action, the FTC may close the investigation with no further action. If FTC staff determines a violation has likely occurred, it may recommend administrative or judicial enforcement proceedings. It also may offer the company the opportunity to resolve the matter through a negotiated consent decree.

Steps to Take If You Receive a CID

1. Do Not Panic, but Do Not Ignore a CID

Receiving a CID should not trigger panic so long as a company does not let the response languish. A CID marks only the first formal step in an investigation; it does not mean that the FTC has decided to file a complaint or impose civil penalties (yet).

A CID must be taken seriously, however, and should not be ignored. If a company fails to comply with a CID, the FTC can petition a court to order compliance. That would make the existence of the investigation public.

2. Read and Understand the CID

Before doing anything else, it is important to read the CID carefully and understand the nature of the FTC’s inquiry and the information sought. Doing so can help a company prepare a response tailored to the FTC’s investigation. Critical information within the CID will include:

• Nature and Scope of Investigation – The CID will state the nature of the conduct the FTC is investigating, and the law or rule the FTC believes may have been violated.

  • For example, the CID could explain that the FTC is investigating whether the company has engaged in “unfair or deceptive” practices in violation of Section 5 of the FTC Act.
  • The CID also could say whether the FTC is investigating any other possible violations of law or agency rules, such as the Children’s Online Privacy Protection Act (COPPA), Restore Online Shoppers’ Confidence Act (ROSCA) or the Health Breach Notification Rule.
• Applicable Time Period – The CID will set forth the applicable time period for the information sought. For example, the CID may seek documents from “January 1, 2019, to the present,” or, the CID may specify different time frames for different requests.
• Definitions and Language – The definitions section of the CID also provides clarity on the FTC’s investigation, as certain terms may be defined to address specific business activities. A company should pay particular attention to the phrasing of each CID request.For example, some CIDs may be worded broadly to require production of “all” responsive documents; others may only require the production of documents “sufficient” to answer the question.

Deadlines:

• Return Date (timing may vary) – This is the date by which the documents or written responses must be provided to the FTC. The Return Date is often 30 days from service, but this time can often be extended through negotiations with the FTC at the “meet and confer.”
• Meet and Confer (14 days from service) – This is the timeframe within which a company may meet and confer with the FTC to discuss questions or concerns regarding the CID, such as the burden or scope of the requests or the timing of a response. This session can often clarify or narrow the scope of the requests or agree to a rolling production timeline.
• Petition to Limit or Quash (20 days from service) – A company can petition to limit or quash the CID within 20 days of service. Through this process, a company may seek to narrow the CID or even withdraw it in full. While this may seem like an appealing strategy, a company should think carefully before petitioning to limit or quash. The petition and the FTC’s decision on it become part of the public record and make the existence of the investigation and its scope public.

  It's critical for a company, at the outset, to analyze the CID, understand the nature of the business practices and allegations involved and geta handle on the response timeline.

3. Meet and Confer With the FTC

A company should take advantage of the opportunity to meet with the FTC regarding its CID response. A company may wish to be open with the FTC about challenges facing the company as a result of the economy, such as staffing reductions or financial hardship, that may impact the company’s ability to respond in a timely manner.

Engagement with FTC staff early in the process helps demonstrate a company’s good-faith effort to comply and cooperate. It also provides a company the chance to ask the FTC to provide additional background on the investigation and negotiate regarding the scope of the CID’s requests and timing for the company’s response. The meet and confer can be used to prioritize certain responses and craft a response schedule that alleviates additional stress on the company.

4. Preserve Documents

Once a company receives a CID, it must preserve all relevant documents in its possession, custody or control. This obligation applies to documents that third parties or company agents may hold. It applies even if privilege may protect the documents from discovery. A company should promptly distribute a document preservation notice to relevant employees, vendors and other agents that maintain documents potentially relevant to the FTC’s investigation. The notice should inform them of their duty to preserve those documents and cease any scheduled destruction. A company can use this as an opportunity to identify employees who may be able to assist with its response and relevant document repositories.

5. Conduct a Privileged, Internal Investigation

A company should quickly retain counsel to direct a privileged, internal investigation into the business practices relevant to the scope of the FTC’s investigation. Counsel can help a company identify potential defenses and liabilities early and identify CID requests that may be particularly burdensome or require additional time to respond to. Retaining counsel to conduct the internal investigation helps protect the investigation’s findings and related legal analysis from discovery under attorney-client privilege and work-product doctrine protections.

It is imperative to act quickly as this initial internal investigation and strategic planning can lead to a more productive “meet and confer” session with the FTC and set the tone for the company’s longer-term CID response strategy.

6. Anticipate a Tolling Agreement

Companies should expect the FTC to propose a tolling agreement, a formal contract agreeing to suspend the running of the statute of limitations during a specified period. These agreements pause the clock on the deadline for the FTC to bring a complaint. The FTC said in a recent blog post that a tolling agreement can give a company time to produce documents, draft written interrogatories and negotiate with the FTC.

Companies should understand that tolling agreements are not mandatory, and the terms are negotiable. Counsel should consider the strategic implications of such an agreement, including the length of the tolling period and the scope of claims involved.

Companies should consider negotiating with the FTC to tailor a tolling agreement to better align with the company's interests. They also should ensure that any agreement serves the company's long-term objectives, recognizing that a balanced approach to negotiations can often yield a more favorable outcome.

7. Respond, Advocate, and Resolve

Once a response schedule has been agreed to with the FTC and CID requests have been narrowed where necessary, it is time to respond to the substance of the CID.

From extensive document collection and review to meticulous drafting of responses, responding to a CID often requires significant time, energy and financial resources. That can distract from other business needs and stretch employees thin. Working with experienced counsel can streamline the response and production process and reduce disruption on daily business operations.

In addition, working with experienced counsel can help a company advocate for itself. While it is incumbent on the company to respond to each request with accuracy and candor, experienced counsel recognize where it is appropriate and beneficial to present the company’s responses within the broader context of the company’s good-faith actions, industry norms and reasonableness. The most effective submissions reply to the FTC’s questions and recognize there is room for advocacy. The ultimate goal is to persuade the FTC to terminate its investigation without seeking any remedy or relief.