When the Agency Comes Knocking: Defending a US Consumer Protection Investigation

It likely will come without warning. You receive a civil investigative demand (CID) claiming your company has committed an unspecified violation of a consumer protection law and demanding that the company produce documents and information. You may have an inkling about why the investigation was launched, but in many cases you may not know (or ever learn) what prompted the government’s interest.

A dizzying array of US state and federal laws address consumer protection, and any number of state and federal agencies have authority to investigate alleged consumer protection violations and initiate enforcement actions. These agencies, sometimes working in concert, have the ability to demand the production of tens of thousands of documents and depositions under the pretext of a consumer protection investigation. However, often it is the beginning of a fishing expedition or a predetermined outcome in search of support. This can morph multiple times over the course of time.

We will describe the steps involved in defending a consumer protection investigation, including an explanation of the CID process, a description of the key decision points and the overarching concerns involved in resolving a consumer protection investigation. We will also describe strategic choices a company may face during an investigation, tips on interacting with the agency during the investigation process and resolution options. Next, we will analyze an example of how an investigation may attempt to push the boundaries of consumer protection in unexpected directions. Finally, we will provide information to help you discern whether your company is at risk for such a claim and suggestions for how to respond if such a claim is brought against your company.

Background

The basic consumer protection statute enforced by the US Federal Trade Commission (FTC) declares illegal “unfair or deceptive acts or practices in or affecting commerce.” Unfair or deceptive acts or practices, or UDAP, are the foundation of most consumer protection statutes in the United States. The FTC has jurisdiction over UDAP affecting commerce in the United States, and its jurisdiction extends even to acts or practices involving international commerce if those acts or practices cause injury within the United States or involve material conduct occurring within the United States.

Each state and the District of Columbia also have independent consumer protection laws designed to address UDAP. In addition to private causes of actions, state attorneys general have authority to enforce those statutes and conduct investigations and initiate actions to protect the public. State attorneys general can also band together and initiate multistate investigations when they believe the same consumer protection issues cut across state lines. Examples include state investigations against tobacco and drug manufacturers. Not to be outdone, the Dodd-Frank Act created the Consumer Finance Protection Bureau (CFPB), which can address unfair, deceptive or abusive acts by providers of financial services.

The civil investigative demand

The service of a CID generally will notify the target company that the agency has initiated a nonpublic investigation. The agency usually begins its investigation long before issuing the CID, probably due to some external instigation such as a consumer complaint (see sidebar on what or who can instigate a consumer protection investigation). Very likely the agency may have reviewed documents, conducted interviews and even received a presentation from a plaintiffs’ law firm before issuing the CID. Most likely, the agency and its representatives may have formed opinions about your company and its conduct before you even become aware of the investigation.

The CID is also a subpoena duces tecum requesting documents and answers to questions from the target company. For instance, a CID from the FTC can require the target company to produce documents, submit tangible things, answer written questions and provide oral testimony. As another example, the Colorado attorney general can “issue subpoenas to require the attendance of witnesses or the production of documents, administer oaths, conduct hearings in aid of any investigation. . . .” In any CID it issues, the CFPB must “state the nature of the conduct constituting the alleged violation which is under investigation and the provision of law applicable to such violation.” Both the FTC and CFPB can direct their investigations at individuals and companies outside the United States.

The agency investigation technically remains private, meaning the agency will not share details about the investigation with the media or public, but there are limits to that confidentiality. The agency will share information uncovered in its investigation with other law enforcement agencies or other agencies that regulate aspects of the target company. For example, the CFPB and state attorneys general have announced that they are collaborating on a number of issues. The FTC, upon written request, can deliver to a federal, state or foreign law enforcement agency materials obtained in the course of an investigation provided the agency agrees to use the materials only in connection with official law enforcement purposes and agrees to maintain the confidentiality of the information. Also, by statute the FTC and CFPB can share confidential information produced in an investigation with Congress or a congressional committee without restriction.

The company may need to inform key stakeholders such as its board of directors, auditor, regulators or lenders regarding the commencement of a potentially material investigation. For example, a company in the education sector should notify its accrediting body because, in all likelihood, it will also receive a subpoena for records as part of the same investigation. A public company will have to determine whether to make an 8-K Securities and Exchange Commission filing disclosing that an investigation has commenced. Determining whether a pending investigation is material and, if so, what to disclose are critical decisions for any public company and ones that may have ramifications on stock price.

The company should also review its insurance policies and file a claim for coverage. Is a CID a claim against the company under an applicable insurance policy? The answer to this question for insurance purposes is, as usual, “it depends.” The safest route is to place your insurance company on notice as soon as you receive any CID. A CID would be a claim for purposes of many policies on the market today because a CID typically initiates a formal investigation. Policies often define a claim to include a formal investigation initiated by a complaint or subpoena, which would cover a CID. Still other policies, part of a recent trend, can include coverage for even informal investigations under limited circumstances.

But some policies define “claim” as only a demand for monetary relief. A CID would not qualify under this definition. In this instance the insurance company likely will characterize the CID as a potential claim. The significance of this coverage position is that the insurance company will take the position that it bears no responsibility for the defense costs incurred to respond to the CID and to deal with other aspects of the investigation. If the CID leads to a settlement demand that includes a demand for money or a lawsuit, you should immediately advise your insurance carrier regardless of whether notice was given when the company received the CID.

Protective order

One of the first steps you will need to address with the agency following initiation of the investigation is the negotiation of a protective order covering confidential data disclosed during the investigation. Because the CID issues prior to the initiation of formal litigation, in most instances the protective order takes the form of a negotiated confidentiality agreement. This agreement should cover confidential documents and materials produced during the investigation and address what happens to confidential material after the investigation concludes. The federal government and most states have open records laws that prohibit disclosure of materials obtained as part of an ongoing investigation. After the investigation concludes, depending on the applicable state or federal law, this protection can disappear. As a result, documents should be produced with a “confidential” moniker so that documents remain protected.

This is not a pesky detail that can be overlooked. Often a CID will lead to formal complaint proceedings before a court. If the confidentiality agreement does not protect the documents after the investigation concludes, the target company is at risk of its most sensitive documents being filed publicly by the agency as attachments to a complaint or motion. Such disclosures could easily lead to severe competitive harm. If the CID requests competitively sensitive information and the agency demands production of the material despite your stated concerns, you should evaluate the wisdom of objecting to production of these limited materials and forcing the agency to move to compel so you can get a court-issued protective order that will provide greater assurances of protection later.

Statute of limitations

Most consumer protection statutes prescribe a limitation period during which the agency must commence a civil action against a target company. Many industries, especially regulated industries, routinely change or upgrade practices to conform to new laws or to prevent conduct that led to historic complaints. If the agency believes that violations have occurred and the passage of time will take what it believes is more problematic conduct beyond the limitation period, the agency will often ask the target company to execute a tolling agreement.

The decision of whether to toll the statute of limitations is significant for the company. Refuse the request, and the agency may immediately initiate an enforcement action; agree and you give the agency an indefinite period of time to prepare and refine its case. There is no canned best practice here. The company must evaluate the unique circumstances and make a decision. Recognize, however, that an agency may eventually seek injunctive relief. The agency may use an indefinite tolling agreement as nothing more than an extension to perfect its evidence. Once it initiates its enforcement case, the agency may try to move the case swiftly, and in this circumstance the company can be left either unprotected or with a much shorter period of time to prepare for a preliminary injunction hearing than its agency counterparts.

The investigation

The most significant strategic choice the company must make will be its approach to the investigation. Many companies will take the open book approach: cooperation, timely response and regular interactions with the agency. Such an approach suggests that the company has nothing to hide and believes that it can explain its conduct in a way that satisfies the agency that no violation has occurred. This approach generally will work well unless there are political underpinnings to the investigation. In a politically motivated investigation, you can expect a one-sided finding, in favor of the agency, no matter what the company says or does. This is not to suggest noncooperation but rather setting reasonable expectations about the outcome of an investigation. In most instances, stonewalling the agency or significantly delaying response to the CID is not an effective strategy. While the company may use these tactics on discrete issues, agency investigative powers generally provide a means to compel responses to CIDs. A company will see significant downside from noncooperation with the investigation.

The best course of action upon receipt of a CID is to immediately request a meeting with the agency to understand the issues prompting the investigation. This will provide you with an opportunity to gauge the possible scope of the investigation and begin to assess the company’s potential liability. During this meeting the company can also provide the agency with an assessment of the time it will take to comply with the CID and to discuss any logistics for the production. If the company needs additional time to respond to some or all of the CID, the timing of the production can be negotiated and confirmed. Because the agency sets the scope of the investigation, including date ranges and issues, standard litigation objections on relevancy and breadth have no validity; however, burden objections are often well received. Consider negotiating the production of a subset or random sample where responding to the request will require production of an unreasonable volume of materials. Agreeing to the rolling production of documents and responses will show good faith and is a reasonable compromise where some aspects of the production will impose burdens on the company.

This meeting will also provide you with an opportunity to introduce the company to the agency. What the agency knows about the company may only be what it has learned from written complaints, commentary by a whistleblower or documents obtained from another agency. Provide an overview of your business: what do you do, locations, number of employees, how long you have been in business, who owns you, customer base and similar information. Look carefully at the questions posed and documents requested in the CID as a possible roadmap for this meeting. You may want to consider providing the agency with some of your key (nonconfidential) consumer-related documents and explaining how your company interacts with consumers. This is particularly important if consumer contracts or disclosures have changed over time. Also, explaining your internal compliance process, including how your company trains its employees, investigates issues raised by employees, and responds to consumer complaints, may have particular relevance given the nature of the inquiry.

After meeting with the agency, negotiating the protective order and producing information in response to the CID, you can expect that the agency will take some time to review the material produced. Use this time to your advantage and regularly check in with the agency as it reviews your materials. Solicit questions on issues that have arisen during the agency’s review of your materials. This will help you understand the issues of focus for the agency and allow you the opportunity to address those issues. Through these discussions you may find that information not requested by the agency may mitigate some of the agency’s concerns; voluntarily producing such information may make sense. Consider connecting your subject-matter experts with the agency’s subject-matter experts to facilitate greater understanding of the information you produced. Also, inviting the agency where appropriate to tour facilities, watch employees interact with customers or view employee training may help change or improve the context in which the agency views the company.

An agency will use investigative hearings (depositions) as part of its investigation process but under rules far different from those used in deposition practice in civil litigation. Company counsel can receive notice of and participate in the depositions of current employees. However, the company may not have the ability to participate in other aspects of the investigation, such as depositions of former employees or customers. For instance, the Colorado attorney general can subpoena former employees and other members of the public for a CID hearing on the subject of the investigation. The target company cannot participate in these depositions and may not even learn they were conducted unless a deponent notifies the target company.

The investigative hearing procedures may also limit the company’s ability to object during the deposition or even to receive a copy of the transcript. CFPB rules provide a good case in point. Counsel for a witness in a CFPB investigative hearing can object to questions posed only on constitutional or privilege grounds. Other typical deposition objections or statements for the record are prohibited. At the end of the deposition, the company attorney can make a request that the witness be permitted to clarify one or more answers, but only the CFPB examiner can grant or deny such a request. An attorney who in the opinion of the CFPB examiner has engaged “in disorderly, dilatory, obstructionist, or contumacious conduct or [used] contemptuous language in the course of the hearing” is subject to sanction. Those rules also allow an investigator or representative of an agency with which the CFPB is jointly engaged in an investigation to be present during a deposition.

If the target company learns that a former manager or executive has been summoned to testify at an investigative hearing, one strategy the company may use is to offer to pay for counsel to represent the former-employee deponent. Doing so will provide several benefits if the deponent accepts. First, company counsel can confer with the lawyer for the deponent, advising that lawyer on the issues in the investigation and expected questions for the deponent. Second, the deponent and lawyer can use that information to prepare for the deposition. Finally, counsel for the deponent can debrief company counsel on the deposition topics and testimony. As discussed, such an approach may provide the only insights company counsel obtains from the witness examination of a former employee before a lawsuit is initiated.

Negotiated resolution

CID investigations generally conclude in one of three ways: the closing of the investigation by the agency without any further action required by the company, a formal agreement between the company and agency or the initiation by the agency of an enforcement action and/or injunctive proceedings against the company. Because the first and third means of resolution are self-explanatory, we will focus on the resolution of an investigation by means of a negotiated resolution.

Generally, one of two types of agreements is used to resolve a consumer protection action, either a voluntary compliance agreement or a consent order. Both types of agreements likely will contain some or all of the following elements:

• Provisions designed to stop or remediate the alleged deceptive act or practice (e.g., a new or revised consumer disclosure or a change in business practices);
• An agreement by the company to subject itself to third-party monitoring with reports submitted to the agency;
• Release of further claims by the agency for matters asserted or that could have been asserted based on the investigation;
• No admission of liability by the company;
• Restitution (cash or services) to consumers allegedly harmed by company’s actions;
• Payment associated with statutory civil penalties;
• Payment to the agency for the costs of its investigation; or
• A provision detailing what happens if alleged future violations of the agreement occur (e.g., a subsequent violation of the parties’ agreement may be prima facie evidence of an unfair or deceptive practice).

An agreement to resolve a consumer protection investigation generally will become public upon completion, and the company can expect that the agency will, at a minimum, issue a news release disclosing the agreement and what the company has agreed to do and pay. You should negotiate the content of the news release as part of your overall settlement of the matter. Also, an agreement to resolve a consumer-protection investigation will trigger disclosure obligations for the company. Even if there is no legal requirement to do so, the company should communicate directly with its key stakeholders explaining the resolution and its effect on the company.

The main difference between the two types of agreements is that a consent order is filed in conjunction with a complaint initiating a civil action against the company, and it becomes a judgment of the court against the company. In a resolution by consent order, the company should also negotiate the content of the complaint in order to make the allegations as high-level and general as possible. Unless specific dates are agreed on, a consent judgment against the company is permanent, and any alleged future violation of the consent order will create, among other things, contempt liability. Another key difference between a consent order and a voluntary agreement is that the court will retain jurisdiction over the parties to a consent order, and any modifications or amendments will require court approval. As a result, it is essential that consent orders contain language that authorizes modification for changes in law, regulations, accrediting standards etc. The failure to include a change-in-law provision could eventually place the company at a competitive disadvantage: If laws become stricter, the company must of course comply; however, if they become more lenient, the consent order may hold you to a higher standard.

A case study: Google Ad Words®

One would expect a CID to focus on obvious wrongdoing. That is not always the case. In recent years, agencies have issued CIDs in an effort to change the legal or regulatory landscape, even to press the envelope on significant policy changes for an industry. For example, in higher education, some state attorneys general have used CIDs to challenge the adequacy of accrediting-body standards and policies when schools use metrics calculated according to those standards in making consumer disclosures. If the agency believes the accreditor is too lax, it may use the investigation as a vehicle to force the school to agree to more stringent standards as the price of resolution of the investigation and later lobby for a state or federal agency to conform to the heightened standards.

One of the most egregious examples of pressing the envelope comes in the form of some state attorneys general’s recent focus on companies’ Google Ad Words campaigns. They claim that a company can defraud the consuming public simply by bidding on search terms that are not directly related to or descriptive of services provided by the company. Under this theory, a company offering hybrid cars cannot bid on the term “electric car” even though the company may reasonably believe that consumers interested in electric cars may also be interested in their product. They claim that fraud exists simply because a company or its product shows up in search results even though the link the consumer clicks on takes the consumer to a website that accurately describes the company’s product or service.

This theory is compounded by the Internet’s inherent problems. A user types a few words into a search engine, and companies do their best to divine what the consumer’s intent truly is. The process is far from perfect. No reasonable user believes that the display of a website advertisement generated by a Google search guarantees its relevance let alone constitutes a representation that the advertiser’s product will satisfy the searcher’s needs. If such a nexus were the touchstone for the lawfulness of an advertisement, then almost every Google search would provide the basis for a lawsuit against advertisers whose products did not properly address what the user was searching.

A much more accurate and universally understood characterization of an ad is something along the lines of “This website may have information that is relevant to your query.” Google search results are intended to provide information that may help a consumer reach a decision. They are not a wholesale substitute for the user’s judgment. Despite these obvious points, some entities are finding themselves defending against consumer fraud allegations for just this reason. These points should prepare you for what might be behind the curtain. You may find the agency is going far afield of anything you contemplated. Getting ahead of the curve and understanding the agency’s agenda is therefore essential.

A new page

The initiation of a consumer protection investigation is the beginning of a time-consuming, expensive and distracting process for any company. Attorneys responsible for responding to the CID must approach the investigation with the understanding that the agency most likely believes that the company has committed violations that require remediation. The agency will use the investigation to dig deep to determine the extent of violations and the amount and types of remedies. We have outlined information designed to help you understand the investigation process and prepare you to develop strategies and approaches to defend your company throughout an investigation. Understanding the process and what to expect will help you avoid possible land mines and missteps and enable you to navigate the investigative process quickly and with as little impact as possible on your company.