9 minute read | August.21.2024
This insight was initially published in 2022 and updated in August 2024.
The Federal Trade Commission (FTC) has continued to ramp up its investigation and enforcement efforts to address unfair or deceptive acts or practices in the privacy, cybersecurity and consumer protection space. With FTC Chair Lina Khan at the helm of the agency, all indications are that this trend will continue in earnest unless there is an administration change. The FTC has also increased its use of tolling agreements to pause the statute of limitations on relevant claims.
The FTC has many investigative tools in its arsenal but its most widely used compulsory investigative tool is the Civil Investigative Demand (CID). A CID is a type of administrative subpoena that allows the FTC to demand the production of documents, written reports, responses to interrogatory questions and even oral testimony.
Typically, the FTC first conducts an initial investigation into the company or industry to gather facts and data from existing sources, voluntary investigative processes and/or internal review by FTC staff. The FTC may then issue a CID to a company it believes may have engaged in “unfair or deceptive” business practices in violation of Section 5 of the FTC Act.
There is no evidentiary threshold the FTC needs to meet before issuing a CID, however, so the FTC may issue a CID merely to aid FTC investigators in determining whether evidence of a violation exists. The FTC may also issue a CID to a company to obtain information about other companies or an industry it is investigating.
The CID is often the first formal step of an investigation into a company’s privacy, cybersecurity or consumer protection practices. In addition to the initial CID, the FTC may issue follow-up questions to the company’s responses and additional CIDs to compel investigational hearings or the production of additional records.
If the FTC determines that the investigation does not reveal a violation of law or regulation sufficient to justify an enforcement action, the FTC may close the investigation with no further action. If FTC staff determines a violation has likely occurred, it may recommend administrative or judicial enforcement proceedings. It also may offer the company the opportunity to resolve the matter through a negotiated consent decree.
Receiving a CID should not trigger panic so long as a company does not let the response languish. A CID marks only the first formal step in an investigation; it does not mean that the FTC has decided to file a complaint or impose civil penalties (yet).
A CID must be taken seriously, however, and should not be ignored. If a company fails to comply with a CID, the FTC can petition a court to order compliance. That would make the existence of the investigation public.
Before doing anything else, it is important to read the CID carefully and understand the nature of the FTC’s inquiry and the information sought. Doing so can help a company prepare a response tailored to the FTC’s investigation. Critical information within the CID will include:
Nature and Scope of Investigation – The CID will state the nature of the conduct the FTC is investigating, and the law or rule the FTC believes may have been violated.
Deadlines:
It's critical for a company, at the outset, to analyze the CID, understand the nature of the business practices and allegations involved and geta handle on the response timeline.
A company should take advantage of the opportunity to meet with the FTC regarding its CID response. A company may wish to be open with the FTC about challenges facing the company as a result of the economy, such as staffing reductions or financial hardship, that may impact the company’s ability to respond in a timely manner.
Engagement with FTC staff early in the process helps demonstrate a company’s good-faith effort to comply and cooperate. It also provides a company the chance to ask the FTC to provide additional background on the investigation and negotiate regarding the scope of the CID’s requests and timing for the company’s response. The meet and confer can be used to prioritize certain responses and craft a response schedule that alleviates additional stress on the company.
Once a company receives a CID, it must preserve all relevant documents in its possession, custody or control. This obligation applies to documents that third parties or company agents may hold. It applies even if privilege may protect the documents from discovery. A company should promptly distribute a document preservation notice to relevant employees, vendors and other agents that maintain documents potentially relevant to the FTC’s investigation. The notice should inform them of their duty to preserve those documents and cease any scheduled destruction. A company can use this as an opportunity to identify employees who may be able to assist with its response and relevant document repositories.
A company should quickly retain counsel to direct a privileged, internal investigation into the business practices relevant to the scope of the FTC’s investigation. Counsel can help a company identify potential defenses and liabilities early and identify CID requests that may be particularly burdensome or require additional time to respond to. Retaining counsel to conduct the internal investigation helps protect the investigation’s findings and related legal analysis from discovery under attorney-client privilege and work-product doctrine protections.
It is imperative to act quickly as this initial internal investigation and strategic planning can lead to a more productive “meet and confer” session with the FTC and set the tone for the company’s longer-term CID response strategy.
Companies should expect the FTC to propose a tolling agreement, a formal contract agreeing to suspend the running of the statute of limitations during a specified period. These agreements pause the clock on the deadline for the FTC to bring a complaint. The FTC said in a recent blog post that a tolling agreement can give a company time to produce documents, draft written interrogatories and negotiate with the FTC.
Companies should understand that tolling agreements are not mandatory, and the terms are negotiable. Counsel should consider the strategic implications of such an agreement, including the length of the tolling period and the scope of claims involved.
Companies should consider negotiating with the FTC to tailor a tolling agreement to better align with the company's interests. They also should ensure that any agreement serves the company's long-term objectives, recognizing that a balanced approach to negotiations can often yield a more favorable outcome.
Once a response schedule has been agreed to with the FTC and CID requests have been narrowed where necessary, it is time to respond to the substance of the CID.
From extensive document collection and review to meticulous drafting of responses, responding to a CID often requires significant time, energy and financial resources. That can distract from other business needs and stretch employees thin. Working with experienced counsel can streamline the response and production process and reduce disruption on daily business operations.
In addition, working with experienced counsel can help a company advocate for itself. While it is incumbent on the company to respond to each request with accuracy and candor, experienced counsel recognize where it is appropriate and beneficial to present the company’s responses within the broader context of the company’s good-faith actions, industry norms and reasonableness. The most effective submissions reply to the FTC’s questions and recognize there is room for advocacy. The ultimate goal is to persuade the FTC to terminate its investigation without seeking any remedy or relief.
Orrick’s team of experienced FTC advisors, litigators, and advocates have defended clients in dozens of FTC investigations and enforcement matters, many of which have been successfully (and non-publicly) resolved without further action. Combining deep substantive knowledge of FTC regulations, jurisprudence and operations with practical experience, we stand ready to advise companies through the entire CID response process from receipt to resolution, to proactively engage with the FTC, and to relentlessly advocate for our clients to reduce their burden and legal risk. Please contact the authors with any questions about FTC investigations, or other privacy, security, or consumer protection matters.