Responding to an FTC Civil Investigative Demand

Responding to an FTC Civil Investigative Demand

Your company received a certified letter from the Federal Trade Commission: Civil Investigative Demand. It’s demanding production of what looks like every document your company has created in the last five years, answers to dozens of interrogatories, and potentially witness testimony. The compliance date is 30 days from receipt. You don’t know if this is routine inquiry or prelude to major enforcement action. Here’s what you need to understand immediately: you have three critical deadlines – 14 days to meet with FTC staff, 20 days to file a petition to quash, and 30 days to produce everything requested. Missing the first deadline eliminates your ability to negotiate. Filing a petition to quash rarely succeeds and makes the investigation public. Your best strategy is aggressive negotiation during the meet-and-confer combined with strategic compliance.

Thanks for visiting Spodek Law Group. We’re a second-generation law firm managed by Todd Spodek, with over 40 years of combined experience representing companies responding to FTC Civil Investigative Demands and defending clients in FTC enforcement proceedings. In March 2025, the FTC published a blog post titled “Did your business receive a CID? The FTC means business” – emphasizing that the agency expects complete, timely responses and will pursue federal court enforcement against companies that don’t comply. In the last three years, the FTC filed 12 federal court actions to enforce CIDs, winning 11 of them. Here’s how to respond to an FTC CID without triggering enforcement litigation, what gets negotiated during the mandatory meet-and-confer, and why the certification of compliance you must sign carries perjury and obstruction risks.

Three Deadlines You Cannot Miss

FTC CIDs create three overlapping deadlines: 14 calendar days to contact FTC staff and schedule a meet-and-confer discussion, 20 calendar days to file a petition to limit or quash the CID, and typically 30 calendar days to produce all requested documents and interrogatory responses. These are mandatory deadlines under 16 CFR Part 2, the FTC’s Rules of Practice.

The 14-day meet-and-confer deadline is most critical because missing it eliminates your ability to negotiate. The FTC won’t consider a petition to limit or quash unless you’ve already discussed your concerns at the meet-and-confer. Companies that engage counsel on day 12 find themselves scrambling to schedule the meeting by day 14, going in without adequate preparation, and losing negotiation leverage.

The 20-day petition deadline creates a strategic dilemma. Petitions to quash are filed with the FTC itself – not an independent court – and one of the Commissioners reviews and almost always denies them. More problematically, petitions become public record. If you file a petition, you’ve announced to competitors, customers, and media that your company is under FTC investigation. The investigation might have been confidential; your petition made it public.

The 30-day production deadline is when everything must be completed: documents produced, interrogatories answered, certification of compliance signed. Document review takes weeks – you need to identify custodians, collect data from multiple systems, review for privilege, redact personal information, and organize everything in the requested format. Companies that wait until day 15 to start this process inevitably miss the deadline.

First 48 Hours

The moment you receive an FTC CID, implement a legal hold within 48 hours. A legal hold stops all routine document deletion, suspends auto-delete policies for emails and messaging apps, preserves cloud storage and backup systems, and notifies relevant employees they cannot delete anything potentially responsive. Spoliation of evidence after receiving the CID can result in sanctions. In FTC litigation, a federal court sanctioned Amazon and found conduct “tantamount to bad faith” in part because Amazon withheld documents responsive to an FTC CID.

Implementing a legal hold requires technical measures: suspending auto-delete policies in email systems, disabling document destruction schedules, preserving backup tapes, and identifying all data sources where responsive documents might exist – email, Slack/Teams, Google Drive/SharePoint, CRM systems, mobile devices.

Second critical action within 48 hours: retain experienced counsel. You cannot effectively respond to an FTC CID without lawyers who regularly handle these matters. Counsel needs a week to prepare for the day-14 meet-and-confer – reviewing CID requests, understanding your data systems, identifying overly broad requests, researching FTC precedent, developing negotiation strategy. If you wait until day 10 to hire counsel, your negotiation leverage evaporates.

Day 14 Meet-and-Confer

The meet-and-confer is where actual negotiation happens. This is usually a phone call between your counsel and FTC staff attorneys. What gets negotiated? First, scope reduction. Many CID requests are extraordinarily broad – “all documents relating to [business practice]” for five years might encompass millions of emails. Counsel proposes narrower definitions or date ranges. FTC staff sometimes agrees, particularly when literal compliance would be impossibly burdensome while a narrower request provides the information they need.

Second, timing extensions. Counsel can negotiate for 60 or 90 days, or propose rolling productions where you produce critical categories first and less critical material on extended schedule. The FTC generally grants reasonable extensions for legitimate factors like data volume or complex privilege review.

Third, format specifications. The CID might not specify electronic vs. paper, whether native files with metadata are required, how to organize productions. Clarifying during the meet-and-confer prevents disputes later when you deliver production and FTC claims it’s not in usable format.

Fourth, privilege and confidentiality protections. If the CID seeks attorney-client communications or trade secrets, you must produce a privilege log describing each withheld document. During the meet-and-confer, counsel discusses likely volume of privileged material, whether FTC will accept categorical privilege logs, and whether confidential business information can be produced under protective order.

Petition to Quash? (Almost Always a Bad Idea)

After the meet-and-confer, you have six more days to file a petition to limit or quash the CID. The petition goes to the FTC, not a court – one of the Commissioners reviews it. Petitions to limit or quash are rarely filed because they’re not typically granted. The FTC has strong incentive to uphold its own investigative demands, and courts defer to agency investigative authority.

The bigger problem: petitions become public. The investigation itself is typically confidential. File a petition, and suddenly your company name is on the FTC’s public website announcing you’re under investigation. You’ve sacrificed investigation confidentiality for a petition that will almost certainly be denied.

If you don’t file a petition, you’ve arguably waived objections. If FTC later goes to court to enforce the CID and you argue it was overly broad, the court may find you waived that argument by failing to exhaust administrative remedies. Most sophisticated companies choose to skip the petition – negotiate during the meet-and-confer, comply strategically, and preserve investigation confidentiality.

Certification of Compliance

Once you’ve completed production, you must sign a Certification of Compliance – a sworn statement subject to perjury and obstruction penalties. Federal law requires CID recipients to produce a “sworn certificate” assuring the Commission that the recipient has produced “all of the documentary material” responsive to the CID. The person signing attests that they conducted a diligent search, that production is complete, and that answers are accurate.

What makes the certification risky: you’re swearing you’ve produced everything requested, but you can’t personally have reviewed every document in a production that might include hundreds of thousands of pages. If FTC later discovers that responsive documents were withheld – because an employee didn’t search their personal files, or because certain data sources weren’t collected, or because someone intentionally hid documents – the signed certification becomes evidence of false statements under oath.

This is why the compliance process can’t be rushed. You need adequate time to conduct thorough search, and documentation showing what you did: which custodians were identified, which data sources were searched, what search terms were used, how privilege review was conducted, what quality control verified completeness. Sloppy, rushed compliance followed by certification creates massive exposure – you’ve sworn to completeness when the process was inadequate.

At Spodek Law Group – we’ve represented companies through dozens of FTC CID responses, negotiated significant scope reductions during meet-and-confers, and advised clients on when strategic compliance protects them better than litigation. Companies that face enforcement actions are the ones who ignored CIDs, missed deadlines, or produced incomplete responses followed by false certifications. If your company received an FTC CID, contact us immediately at 212-300-5196. You likely have days, not weeks, before critical deadlines pass – and decisions you make in the first 48 hours determine whether you’ll spend months cooperating productively with the FTC or litigating enforcement proceedings in federal court.