If your online business receives a Civil Investigative Demand (CID) from the Federal Trade Commission, it is a legally enforceable demand for documents, written answers, or testimony, and the clock starts running the day it is served. You generally have 14 days to meet and confer with FTC staff and 20 days to file a petition to limit or quash, and a well-managed response can shape whether the investigation closes quietly or ends in an enforcement action. A CID is not a finding that you broke the law, but how you respond in the first few weeks matters.

This guide explains how FTC consumer protection investigations begin, what the agency can demand, the procedural deadlines and protections available to you, the subject areas that most often draw scrutiny for e-commerce companies, and the practical steps to take when a CID arrives.

How FTC Investigations Start

Under the FTC’s Rules of Practice, investigations may originate from requests by the President, Congress, government agencies, or the Attorney General; from referrals by the courts; from complaints by members of the public; or on the Commission’s own initiative. 16 C.F.R. § 2.1. In practice, that means an investigation can grow out of consumer complaints, a competitor’s report, a referral from another agency, or staff’s own review of advertising and online marketing.

The FTC also conducts coordinated “law enforcement sweeps” that target a particular type of conduct across many companies at once. In September 2024, for example, the agency announced Operation AI Comply, a sweep aimed at deceptive claims and schemes involving artificial intelligence. Pre-complaint investigations are generally non-public, so many businesses learn of an inquiry only when a letter or demand arrives. For a broader overview of the process, see our article on the FTC’s investigation process.

Access Letters vs. Civil Investigative Demands

Not every FTC inquiry begins with compulsory process. Staff sometimes send a voluntary access letter requesting information. A voluntary request is not enforceable in court the way a CID is, but it should still be taken seriously: the response can shape staff’s view of your business, anything you submit can be used in the investigation, and FTC and Department of Justice guidance treats preservation obligations as applying to voluntary access letters as well as compulsory process.

A CID is different. Under 15 U.S.C. § 57b-1, when the Commission has reason to believe a person may have documentary material, tangible things, or information relevant to unfair or deceptive acts or practices, it may issue a CID requiring the recipient to:

• Produce documentary material for inspection and copying
• Submit tangible things
• File written reports or answers to questions
• Give oral testimony

Each CID must state the nature of the conduct under investigation and the provision of law that applies. 15 U.S.C. § 57b-1(c)(2). That statement is worth reading closely, because it tells you what the agency is focused on and frames any argument that a particular request goes beyond the investigation’s scope. If a recipient fails to comply, the Commission can petition a federal district court to enforce the demand. 15 U.S.C. § 57b-1(e).

The Meet-and-Confer Requirement and Petitions to Limit or Quash

Two deadlines control the early stage of a CID response:

• Meet and confer within 14 days. The recipient must meet and confer with Commission staff within 14 days after receiving the process, or before the deadline for filing a petition to quash, whichever comes first. 16 C.F.R. § 2.7(k). The discussion must address all issues, including how privilege claims will be asserted, and the recipient must bring a person familiar with its electronically stored information (ESI) systems and methods of retrieval.
• Petition to limit or quash within 20 days. A petition must be filed with the Secretary within 20 days after service or, if the return date is less than 20 days after service, before the return date. 16 C.F.R. § 2.10(a)(1). Petitions are limited to 5,000 words and must include a signed statement that counsel conferred with staff in good faith and could not resolve the issues. 16 C.F.R. § 2.10(a)(2).

A timely petition stays the remaining time for compliance as to the challenged specifications, and the Commission will rule on the petition within 40 days after it is filed. 16 C.F.R. § 2.10(b)–(c). Senior Bureau and Regional staff are authorized to modify the terms of compliance in writing and to extend deadlines. 16 C.F.R. § 2.7(l). As a result, many scope and timing problems are resolved through negotiation at the meet-and-confer stage rather than through a formal petition. Our discussion of subpoena response covers related strategy for other types of legal demands.

Preserve Documents Immediately

The FTC’s guidance for small businesses is direct: once you receive a CID, you must stop routine procedures that would destroy documents related to the investigation. That means suspending auto-delete settings, issuing a written litigation hold to employees and relevant vendors, and identifying where responsive data lives, including e-commerce platforms, ad accounts, customer service logs, and email.

Do not overlook messaging apps. In January 2024, the FTC and DOJ updated guidance to confirm that preservation obligations extend to collaboration tools and ephemeral messaging such as Slack, Microsoft Teams, and Signal, and DOJ warned that failing to preserve covered material may result in obstruction of justice charges. Under 16 C.F.R. § 2.14(c), if twelve months pass without written communication from FTC staff, the recipient is relieved of the obligation to continue preserving the material.

Privilege and Confidentiality Protections

Privilege. You may withhold attorney-client privileged and work-product material, but the claim must be asserted no later than the production date and supported by a detailed privilege log in a searchable electronic format. 16 C.F.R. § 2.11. A log that does not provide enough information to evaluate the claim may lead to denial of the claim. The rule also includes protection against waiver for inadvertent production if reasonable preventive steps were taken and the error is promptly corrected. 16 C.F.R. § 2.11(d).

Confidentiality. Material produced in response to compulsory process receives statutory protection under 15 U.S.C. § 57b-2. It is exempt from disclosure under the Freedom of Information Act, and before disclosing material designated confidential, the Commission generally must give written notice and wait at least 10 days so the submitter can seek relief in court. Exceptions exist, including disclosure to Congress and use in FTC adjudicative or court proceedings, so mark confidential material clearly when you produce it.

Common Subject Areas for E-Commerce Investigations

FTC investigations of online businesses tend to cluster around a few areas:

• Section 5 deception. Section 5 of the FTC Act prohibits unfair or deceptive acts or practices. Product performance claims, health claims, pricing and discount representations, and hidden fees are frequent issues. See our overview of e-commerce false advertising.
• Subscriptions and negative option offers (ROSCA). The Restore Online Shoppers’ Confidence Act requires online sellers using negative option features to clearly and conspicuously disclose all material terms before obtaining billing information, obtain express informed consent before charging, and provide simple mechanisms to stop recurring charges. 15 U.S.C. § 8403. A ROSCA violation is treated as a violation of an FTC rule. 15 U.S.C. § 8404(a). The FTC’s 2024 amended Negative Option Rule, known as “Click-to-Cancel,” was vacated by the Eighth Circuit on July 8, 2025, in Custom Communications, Inc. v. FTC, and the FTC opened a new advance notice of proposed rulemaking in March 2026. ROSCA itself remains in force. Read more about what happened to the Click-to-Cancel rule.
• Consumer reviews and testimonials. The Rule on the Use of Consumer Reviews and Testimonials, 16 C.F.R. Part 465, took effect October 21, 2024. It addresses fake or false reviews, buying reviews conditioned on their sentiment, undisclosed insider reviews, company-controlled review websites, review suppression, and fake social media indicators.
• Made in USA claims. The Made in USA Labeling Rule, 16 C.F.R. Part 323, prohibits labeling a product “Made in the United States” unless final assembly or processing occurs in the U.S., all significant processing occurs in the U.S., and all or virtually all ingredients or components are made and sourced in the U.S. It also covers mail order and online promotional materials.
• Endorsements and influencers. The Guides Concerning Use of Endorsements and Testimonials in Advertising, 16 C.F.R. Part 255, address disclosure of material connections between advertisers and endorsers. The Guides are advisory, but the underlying conduct can still be challenged as deceptive under Section 5.

How FTC Investigations End

According to the FTC’s own guidance, a CID is the first step in an investigation, and in some instances the agency closes the investigation after reviewing the response. The main possible outcomes are:

• Closing. When corrective action is not warranted, the investigation is closed, although the matter may be investigated further if circumstances warrant. 16 C.F.R. § 2.14.
• Consent order. Many matters resolve through a negotiated settlement. Violating a final cease-and-desist order can expose a company to civil penalties for each violation. 15 U.S.C. § 45(l).
• Administrative complaint. If the Commission has reason to believe a violation occurred, it can issue an administrative complaint under Section 5(b). 15 U.S.C. § 45(b).
• Federal court action under Section 13(b). The FTC can seek preliminary and permanent injunctions in federal court. In AMG Capital Management, LLC v. FTC, decided April 22, 2021, a unanimous Supreme Court held that Section 13(b) does not authorize the Commission to seek, or a court to award, equitable monetary relief such as restitution or disgorgement.
• Civil penalties and redress for rule violations. Because of AMG, rule-based claims carry added weight. The FTC can seek civil penalties for rule violations committed with actual knowledge, or knowledge fairly implied, that the conduct was prohibited. 15 U.S.C. § 45(m)(1)(A). Under Section 19, it can also seek consumer redress, including refunds, rescission of contracts, and damages, for rule violations and for certain conduct covered by a final cease-and-desist order. 15 U.S.C. § 57b.

That is why an investigation involving ROSCA, the reviews rule, or the Made in USA rule can carry greater financial exposure than one based only on a general Section 5 theory. If a matter proceeds to litigation, experienced civil litigation counsel becomes essential.

Practical Steps When a CID Arrives

• Calendar the deadlines on day one. Note the service date, the 14-day meet-and-confer deadline, the 20-day petition deadline, and the return date.
• Issue a litigation hold. Suspend auto-deletion across email, messaging apps, ad platforms, and your e-commerce stack, and put the hold in writing.
• Engage counsel before contacting staff. Early conversations with FTC staff set the tone, and counsel can negotiate scope, rolling production, and extensions.
• Read the resolution and specifications carefully. Identify the conduct and legal provisions under investigation and flag overbroad or burdensome requests for the meet and confer.
• Prepare your ESI representative. Identify the person who can explain your data systems at the meet and confer.
• Build the privilege log as you go. Privilege claims must be logged by the production date.
• Review current practices without destroying evidence. Fixing an ongoing problem can be wise, but do it with counsel and preserve the prior versions of pages, checkout flows, and ads.

Don’t Face an FTC Investigation Alone

An FTC investigation does not have to end in a lawsuit. Many are narrowed through negotiation or closed after the agency reviews a complete, well-organized response. What makes the difference is acting quickly, preserving evidence, and engaging with staff strategically from the start.

If your business has received a Civil Investigative Demand, an access letter, or other inquiry from the FTC, the FTC defense attorneys at Revision Legal can help you meet the deadlines, negotiate scope with staff, and protect your business throughout the investigation. Contact us through the form on this page or call (855) 473-8474.