Did your business receive a CID? The FTC means business

When businesses know the rules of the road, they can confidently invest in new ventures, technologies, and products. Under my leadership, the FTC’s Bureau of Consumer Protection (BCP) is committed to providing legal clarity to legitimate businesses that wish to deal honestly with their customers and comply with the law.

By offering clear and consistent rules of the road, legitimate businesses can comply with confidence. Businesses that choose not to comply, on the other hand, should know that the FTC’s robust anti-fraud program is going strong. BCP will use the tools at our disposal, like civil investigative demands (CIDs) or, in certain contexts, subpoenas, to seek critical information to investigate and prosecute illegal practices. If your business receives such a demand for information, we expect you to respond in a reasonable and timely manner or face legal consequences.

Here’s what to know about consumer protection CIDs.

What is a CID? Section 20 of the FTC Act gives the Commission authority to issue CIDs to investigate potentially unfair or deceptive acts or practices. CIDs are a form of compulsory process—like a subpoena—that the Commission can use to seek documents, testimony, tangible things, reports, or answers to questions. We use our CID authority responsibly, tailoring our requests to target the specific information we need without unnecessarily burdening businesses and individuals.

Who receives CIDs? The Commission uses CIDs in a few contexts. First, we use CIDs to seek information from people or businesses we think may have violated the law. But the fact you received a CID doesn’t necessarily mean you’re the target of an investigation. The Commission also sends CIDs to people and businesses that may have information related to the subject of an ongoing investigation. If you get a CID, it will clearly identify the subject matter of the investigation and any laws or rules we think may have been violated.

Is a response mandatory? CIDs are legally enforceable demands. If you get one, you must respond completely and on the specified schedule, unless you reach an alternative agreement with BCP staff and their management. If you want to request more time or have another concern, you must reach out to start that discussion with BCP staff as soon as possible. Consistent with the FTC’s Rules of Practice, BCP staff may work with CID recipients to narrow requests, or sequence responses in a way that makes sense for the agency’s and business’s schedules, if appropriate to the situation. BCP staff will also ask you to sign a tolling agreement. But this is not an opportunity for unnecessary delay. And any discussion must happen well in advance of your deadline to respond.

Timing of responses. If you receive a CID, there are two deadlines you should note right away. First, find the deadline for response, which will be printed clearly on the CID form. Then, identify the deadline to contact and meet with BCP staff. Although it can be waived, the FTC’s Rules of Practice generally require such a meeting relatively quickly after receiving a CID. That meeting is your opportunity identify any issues, problems, or concerns that might affect your ability to comply.

Compliance Certification Requirement. CIDs include a Certification of Compliance that recipients must sign to certify their compliance with the CID and verify the truth and accuracy of any interrogatory responses. Federal law requires that CID recipients produce a “sworn certificate” assuring the Commission that the recipient has produced “all of the documentary material” responsive to the CID, and that interrogatory answers have been made “under oath.”. See 15 U.S.C. § 57b-1(c)(11), (13); 28 U.S.C. § 1746.

Are there consequences for noncompliance? Don’t ignore or refuse to comply with a CID. If you do not respond or cooperate, you’re impeding our law enforcement efforts, and we will likely seek judicial enforcement of the Commission’s process. The Commission’s recent experience with Match, the owner of the OKCupid dating site, demonstrates our resolve in enforcing our CIDs to move our investigations forward. The court in that case ordered the company to produce documents that it had improperly withheld. 

And, in recent litigation, a court sanctioned Amazon.com — and, indeed, found that the company had engaged in conduct “tantamount to bad faith” — in part because it had wrongfully withheld documents responsive to a CID. The evidence the court cited included the inaccurate compliance certificate that a company lawyer had signed. 

So, what’s the bottom line? We want to work cooperatively with CID recipients to get the information we need without unnecessary burden on legitimate businesses and judicial intervention. But preventing harm to consumers is our priority and we intend to move our cases in a timely manner. The more responsive and forthcoming you are, the better the process works for everyone.

Note: Updated August 12, 2025, including new examples.