So You Received a CID: FAQs for Small Businesses

So you’ve received a Civil Investigative Demand (CID) from the Federal Trade Commission related to a consumer protection matter. Now what? We appreciate that it can be daunting for any company – especially a small business – and we want to be as transparent as possible about the process.

Here are questions we’ve heard from businesses that have received CIDs and answers we hope shed some light on our procedures. (By the way, these FAQs apply to CIDs about FTC consumer protection investigations. The process may be different for FTC competition matters, which relate to antitrust laws.)

What is the Federal Trade Commission?  The FTC is the nation’s consumer protection agency. Our mission is to promote competition and protect consumers from deceptive or unfair practices, to educate consumers and provide guidance for businesses, and to accomplish those goals in an efficient, effective way. FTC headquarters is in Washington, D.C., and we have seven regional offices across the country.

What is the Bureau of Consumer Protection?  The Bureau of Consumer Protection (BCP) is the office within the FTC responsible for consumer protection matters.

What a Civil Investigative Demand? A CID is a kind of subpoena – a legal document enforceable in court that seeks documents or other information related to an FTC investigation. The FTC sends CIDs to get information from companies it thinks may have violated the law. The FTC also sometimes sends CIDs to obtain information from others who are not the subjects of investigation, but who may have information related to the subjects of ongoing investigations.

What’s the first thing we should do if we get a CID?  It’s up to you whether to consult an attorney. You or your attorney should immediately call or email the FTC attorney identified in the CID to arrange what we call a “meet and confer” – an initial meeting to set the schedule for responding to the CID and to address preliminary issues. The “meet and confer” must take place no more than 14 days after you receive the CID. We can meet in person or by phone, whichever you prefer.

Since we’ve received a CID, does this mean the FTC is suing us?  No. First, as discussed above, some who receive CIDs are not the subjects of FTC investigation, but instead are third parties who have documents or other information that relate to others who are subjects of FTC investigations. Second, even if you are the subject of an FTC investigation, a CID is the first step in an investigation. In some instances, once FTC staff has reviewed the documents a company provides in response to a CID, the agency will close the investigation without further action. In other instances, staff will approach the company about negotiating a possible legal settlement. If a company doesn’t reach a settlement agreement, the Commission may decide to file a lawsuit. If you have any questions about the nature of the CID you received, you can ask FTC staff about it at the “meet and confer.”

What law does the FTC think my company has violated?  The CID identifies the subject matter of the investigation and describes the nature of the conduct the FTC staff is investigating. In addition, the CID cites the Federal Trade Commission Act or other laws or rules that may have been violated. (The FTC Act prohibits “unfair or deceptive acts or practices in or affecting commerce.”)

What happens at the “meet and confer”?  It’s your opportunity to ask any questions you have about the CID or the FTC’s procedures. We’ll also discuss how to provide documents, including producing electronically stored information. (You must have someone at the “meet and confer” knowledgeable about your recordkeeping or your information management system.) The “meet and confer” is also the time to talk over any possible changes in how to comply with the CID that would reduce the cost or burden on your company while still providing us with the information we need. In addition, we can discuss the process for asserting a claim of legal protection – for example, if you believe that a document we’ve asked for is covered by the attorney-client privilege.

How can we learn more about the nature of the FTC’s investigation?  The first paragraph of the CID cover letter includes a description of the investigation. The nature of the investigation also is something we can talk about at the “meet and confer.” At any point in the process, if you have questions, just ask the FTC attorney “Can you tell me more about what this is about?”

We don’t understand some of the CID provisions and we’re not sure why the FTC wants certain documents. What should we do?  Again, just pick up the phone and ask “What is it you’re looking for?” Once we’ve had that conversation, it may be easier for FTC staff to tailor the document request to your circumstances. That also highlights why it’s important to schedule the “meet and confer” as soon as possible. If we need to clarify something in the CID, it’s best to do so early in the process.

What if we need more time? CIDs have deadlines that companies are expected to meet, so it’s unwise to wait until the last minute to raise scheduling issues. Set up the “meet and confer” immediately and we can discuss deadlines then.

What will the FTC do with the documents we send? We’ll use them to conduct our investigation and, if appropriate, in an FTC law enforcement action. We won’t disclose them under the Freedom of Information Act. We won’t tell consumers, competitors, private attorneys, or members of the press about our investigation, although we may share documents where necessary with our experts and potential witnesses. And unless we use the documents in an FTC action, we won’t publicly disclose the documents – or even the existence of an investigation – without your consent, except in response to a request from Congress or a Congressional committee or subcommittee; a request from a law enforcement agency for official law enforcement purposes; or as required by law. If we do intend to use your documents in an FTC action, we’ll let you know in advance in case you decide to seek an order from a court to protect the documents from public disclosure.

Once we send documents in response to the CID, what happens next?  FTC staff will review the documents and get back to you as soon as possible. Please be aware that it takes time to evaluate thoroughly the documents you sent and other information related to the investigation. We owe it to you – and to the public – to study the matter carefully and thoughtfully. At any point, you’re welcome to contact FTC staff for a status update. In addition, it’s our practice to reach out to you no later than six months after you have completed your response to give you a status update and to get back to you periodically after that.

Our practice is to periodically get rid of documents, including emails. How does getting a CID affect that? After you receive a CID, you must stop any routine procedures that would destroy documents that could reasonably relate to the investigation and you must take steps to maintain documents that are relevant to this investigation, regardless of whether you believe the documents are protected from discovery by legal privilege or some other reason. After you’ve completed your response, you can discuss with the FTC attorney your document retention practices going forward.

Is there any significance to the fact that a CID tells me to contact someone in an FTC regional office?  No. The staff at FTC regional offices does the same kind of work as the staff at FTC headquarters.

The CID refers to the FTC’s Rules of Practice. Where can we find them? The FTC’s Rules of Practice are published in the Code of Federal Regulations. Part 2 of the Rules, which deal with investigations and CIDs, is available online.

We would prefer not to respond to the CID.  The FTC can go to court to ask a judge to require that you turn over documents or information, but that’s not our preferred way of doing business. Going to court to enforce a CID increases costs and causes delays for everyone involved. If there is a particular specification in the CID that causes you concern, let’s talk it over at the “meet and confer.” Maybe there’s a way to reframe what we’re asking for that would address your concern, but still allow us to get the information we need.

What if we don’t intend to comply with the CID? According to the FTC Rules of Practice, within 20 days after you are served with the CID you may file a petition to limit or quash – in other words, you may ask that the CID be narrowed or withdrawn altogether. One of the FTC Commissioners will review your petition and will either: (1) grant the petition and limit or quash the CID, or (2) deny the petition. The procedure is explained in the FTC’s Rules of Practice at 16 C.F.R. § 2.10. Because we want to resolve concerns as quickly and inexpensively for everyone as we can, the FTC won’t consider a petition to limit or quash unless you’ve already discussed your concerns at the “meet and confer.” If you plan to file a petition to limit or quash certain portions of the CID, you still must file a response to the other portions of the CID by the deadline. Petitions to limit or quash a CID – and the Commission decision – are public documents that will be placed on the FTC’s public record.

Where can we learn more about FTC consumer protection law? The FTC’s webpage, www.ftc.gov, includes links to statutes, cases, reports, workshops, etc. We also have a special website for businesses, www.business.ftc.gov, which features information about law enforcement actions and plain-language guidance on topic like truth in advertising, data security, telemarketing, debt collection, etc.