FTC Investigations on the Rise: What You Need to Know About FTC CIDs

The Federal Trade Commission (FTC) has continued to ramp up its investigation and enforcement efforts in 2022 to address unfair or deceptive acts or practices in the privacy, cybersecurity and consumer protection space. With FTC Chair Lina M. Khan at the helm of the agency, all indications are that this trend will continue in 2023.

How the FTC Uses CIDs

The FTC has many investigative tools in its arsenal but its most widely used compulsory investigative tool is the Civil Investigative Demand (CID). A CID is a type of administrative subpoena that allows the FTC to demand the production of documents, written reports, responses to interrogatory questions, and even oral testimony. Typically, the FTC first conducts an initial investigation into the company or industry to gather facts and data from existing sources, voluntary investigative processes and/or internal review by FTC staff. The FTC may then issue a CID to a company it believes may have engaged in “unfair or deceptive” business practices in violation of Section 5 of the FTC Act. There is no evidentiary threshold the FTC needs to meet before issuing a CID, however, so the FTC may issue a CID merely to aid FTC investigators in determining whether evidence of a violation exists. The FTC may also issue a CID to a company to obtain information about other companies or an industry it is investigating.

CIDs and Beyond

The CID is often the first formal step of an investigation into a company’s privacy, cybersecurity or consumer protection practices. In addition to the initial CID, the FTC may issue follow-up questions to the company’s responses and issue additional CIDs to compel investigational hearings or the production of additional records. If the FTC determines that the investigation does not reveal a violation of law or regulation sufficient to justify an enforcement action, the FTC may close the investigation with no further action. If FTC staff determines that a violation has likely occurred, it may recommend the matter for further administrative or judicial enforcement proceedings, and/or may offer the company the opportunity to resolve the matter through a negotiated consent decree.

Steps To Take If You Receive a CID

1. Do Not Panic, but Do Not Ignore a CID

Receiving a CID should not trigger panic so long as a company does not let the CID response languish. A CID marks only the first formal step in an investigation; it does not mean that the FTC has decided to file a complaint or impose civil penalties (yet).

A CID must be taken seriously, however, and should not be ignored. A CID is a form of compulsory process. If a company fails to comply with a CID, the FTC can petition a court to order compliance with the CID. In short, a company must respond to a CID, and that response should be thoughtful and strategic.

2. Read and Understand the CID

Before doing anything else, it is important to read the CID carefully and understand the nature of the FTC’s inquiry and the information sought. Doing so can help a company prepare a response that is appropriately tailored to the FTC’s investigation. Critical information within the CID will include:

The Nature and Scope of the FTC’s Investigation:

• Nature and Scope of Investigation – The CID will state (1) the nature of the conduct the FTC is investigating, and (2) the law or rule that the FTC believes may have been violated. For example, the CID could explain that the FTC is investigating whether the company has engaged in “unfair or deceptive” practices in violation of Section 5 of the FTC Act and if the FTC is investigating any other possible violations of law or agency rules, such as the Children’s Online Privacy Protection Act (COPPA) or the Restore Online Shoppers’ Confidence Act (ROSCA).
• Applicable Time Period – The CID will set forth the applicable time period for the information sought. For example, the CID may seek documents from “January 1, 2018, to the present,” or, the CID may specify different time frames for different requests.
• Definitions and Language – The definitions section of the CID also provides clarity on the FTC’s investigation, as certain terms may be defined to address specific business activities. A company should also pay particular attention to the phrasing of each CID request—for example, some may be worded broadly to require the production of “all” responsive documents, while others may only require the production of documents “sufficient” to answer the question.

Deadlines:

• Return Date (timing may vary) – This is the date by which the documents or written responses must be provided to the FTC. The Return Date is often 30 days from service, but this time frame can often be extended through negotiations with the FTC at the “meet and confer.”
• Meet and Confer (14 days from service) – This is the time frame within which a company may meet and confer with the FTC to discuss questions or concerns regarding the CID, such as the burden or scope of the CID requests, or the timing of the CID response. This session can often be used to clarify or narrow the scope of the requests or agree to a rolling production timeline.
• Petition to Limit or Quash (20 days from service) – A company has the opportunity to petition to limit or quash the CID within 20 days of service. Through this process, a company may seek to narrow the CID or even withdraw it in full. While this may seem like an appealing strategy, a company should think very carefully before petitioning to limit or quash, as the petition and the FTC’s decision on the petition become part of the FTC’s public record and make the existence of the investigation and its scope public.

Analyzing the CID, understanding the nature of the business practices and allegations involved, and getting a handle on the overall response timeline at the outset is critical.

3. Preserve Documents

Once a company receives a CID, it is obligated to preserve all relevant documents in its possession, custody or control. This obligation applies to documents that may be held by third parties or company agents, and applies even if the documents may be protected from discovery by privilege. A company should promptly distribute a document preservation notice to relevant employees, vendors and other agents that maintain documents potentially relevant to the FTC’s investigation and inform them of their duty to preserve those documents and cease any scheduled destruction practices. A company can use this as an opportunity to identify employees who may be able to assist with its response and relevant document repositories.

4. Conduct a Privileged, Internal Investigation

A company should quickly retain counsel to direct a privileged, internal investigation into the business practices relevant to the scope of the FTC’s investigation. Counsel can help a company identify potential defenses and liabilities early on, as well as identify CID requests that may be particularly burdensome or require additional time to respond to. Furthermore, retaining counsel to conduct the internal investigation helps protect the investigation’s findings and related legal analysis from discovery under attorney-client privilege and work-product doctrine protections.

It is imperative to act quickly as this initial internal investigation and strategic planning can lead to a more productive “meet-and-confer” session with the FTC and will set the tone for the company’s longer-term CID response strategy.

5. Meet and Confer With the FTC

A company should take full advantage of the opportunity to meet and confer with the FTC regarding its CID response. A company may wish to be open with the FTC about challenges facing the company as a result of the pandemic, such as staffing reductions or financial hardship, that may impact the company’s ability to respond in a timely manner. Engagement with FTC staff attorneys early on in the process helps demonstrate a company’s good-faith effort to comply and cooperate, and also provides a company the chance to ask the FTC to provide additional background on the investigation and negotiate with the FTC regarding the scope of the CID’s requests and timing for the company’s response. The meet and confer can be used to prioritize certain responses and craft a response schedule that alleviates additional stress on the company.

6. Respond, Advocate and Resolve

Once a response schedule has been agreed to with the FTC and CID requests have been narrowed where necessary, it is time to respond to the substance of the CID. From extensive document collection and review to meticulous drafting of responses, responding to a CID often requires significant time, energy and financial resources from a company, which can distract from other pressing business needs and stretch employees thin. Working with experienced counsel, however, can help streamline the response and production process and reduce disruption on daily business operations.  

In addition, working with experienced counsel can help a company advocate for itself. While it is incumbent upon the company to respond to each request with accuracy and candor, experienced counsel recognize where it is appropriate and beneficial to present the company’s responses within the broader context of the company’s good-faith actions, industry norms and abject reasonableness. The most effective submissions not only reply to the FTC’s questions but also recognize there is room for advocacy. The ultimate goal is to persuade the FTC to terminate its investigation without seeking any remedy or relief.

Orrick’s team of experienced FTC advisors, litigators and advocates have defended clients in dozens of FTC investigations and enforcement matters, many of which have been successfully (and nonpublicly) resolved without further action. Combining deep substantive knowledge of FTC regulations, jurisprudence and operations with practical experience, we stand ready to advise companies through the entire CID response process from receipt to resolution, to proactively engage with the FTC, and to relentlessly advocate for our clients to reduce their burden and legal risk. Please contact the authors with any questions about FTC investigations, or other privacy, security or consumer protection matters.