What Is a Civil Investigative Demand—and What Can It Reveal About Your Privacy Program?

A civil investigative demand, or CID, is a formal demand for information issued by a government authority under a statute authorizing a civil investigation. It can require documents, written answers, testimony or other evidence. An agency can use one to investigate possible violations before deciding whether to bring an enforcement action.

Receiving a CID does not establish that a company broke the law. It does create a legal response obligation, subject to the governing statute, available objections and applicable procedures. A recipient may be the business under investigation or a third party believed to hold relevant evidence.

For a business handling personal information, a CID can turn broad compliance claims into specific questions. What information reached an advertising vendor? Which privacy notice was shown at the time? Did an opt-out stop the relevant processing? The answers often depend on records held by engineering, marketing and vendors as much as by the legal department.

A CID can arrive before anyone files a lawsuit

Government investigators need evidence to determine what happened and whether the law provides a basis for action. A CID supplies compulsory investigative authority without requiring the agency to begin with a complaint in court.

The Consumer Financial Protection Bureau describes its CIDs as investigational subpoenas that can demand documents, emails, reports, written answers and oral testimony. Federal Trade Commission authority appears in 15 U.S.C. § 57b-1. The Department of Justice also has CID authority under particular laws, including the civil antitrust statute. State attorneys general operate under their own statutory powers.

The label therefore does not identify one universal procedure. The issuing authority, cited law, subject matter and instructions determine the response requirements. A deadline or objection process applicable to an FTC demand should not automatically be applied to a state demand.

A plaintiff’s demand letter alleging unlawful tracking is another distinct document. It can require prompt legal attention, but it is not a CID merely because it requests records or threatens litigation. The source of the demand and legal authority behind it matter.

The demand can reach far beyond the privacy policy

A privacy investigation may examine collection, use, disclosure, security, retention or representations made to consumers. Investigators may need evidence of both the company’s stated practices and the systems that implemented them.

Depending on the demand, potentially relevant material could include historical notices, vendor agreements, data maps, assessments, consumer complaints, consent records and communications about a deployment. Written questions may ask who approved a practice, which systems held information or how the company responded to a known problem. A demand for testimony can require a knowledgeable witness to explain those facts.

Third parties can hold important parts of the record. An advertising agency may have deployed a pixel. A software provider may hold configuration history. A platform may retain records explaining where data was sent. Receipt of a CID alone does not establish that any such third party is accused of wrongdoing.

Nor must every privacy investigation follow a security breach. A regulator can investigate whether a company collected information without a required choice, made misleading privacy promises or failed to honor rights while its systems continued operating normally.

Texas expressly connects CIDs to privacy assessments

The Texas Data Privacy and Security Act provides a direct example. Under Section 541.153, the attorney general may issue a CID when there is reasonable cause to believe a person has violated or is violating the chapter. The provision also allows demands for data protection assessments relevant to the investigation.

Section 541.105 addresses those assessments and their protection. It makes them confidential and exempt from specified public disclosure requirements, and states that providing an assessment in compliance with the attorney general’s request does not waive attorney-client privilege or work-product protection concerning the assessment and its contents.

That statutory protection should be read precisely. It does not make every privacy document privileged or eliminate the obligation to provide a requested assessment. Businesses need to distinguish required compliance records from legal advice and understand the rules governing each.

Avast shows how a privacy CID can develop into enforcement

In a securities filing, Avast’s parent company, Gen Digital, disclosed that the FTC issued Avast a CID on December 23, 2019. It sought documents and information about privacy practices, including the use of consumer information by Avast’s analytics subsidiary, Jumpshot. The filing said Avast cooperated with the demand and follow-up requests.

The FTC subsequently alleged that Avast and its subsidiaries sold browsing information despite promises that their products would protect consumers from tracking. In June 2024, the agency finalized an order requiring $16.5 million and prohibiting sales or licensing of web browsing data for advertising. The matter was resolved through a consent order, rather than a trial establishing every allegation.

The sequence illustrates a CID’s role: investigators obtain records, assess the evidence and may pursue a remedy. It does not mean every CID ends in a settlement. It also shows why changing a business practice during an investigation does not, by itself, resolve questions about earlier conduct.

The first response needs legal and technical owners

Once a CID arrives, counsel should promptly identify the governing authority, date of service, response deadlines and available procedures. The company also needs people who understand the relevant systems. Legal strategy can depend on how information is stored, what can be retrieved and which vendors control portions of the record.

Preservation deserves early attention. Counsel should direct a hold appropriate to the investigation, including relevant material that routine deletion, log rotation or employee departures might otherwise remove. For a tracking investigation, the relevant sources could include tag-manager versions, consent configurations, release records and vendor communications.

That work should proceed alongside a realistic collection plan. Identify custodians and data sources, test exports and distinguish records the business possesses from material it may need to obtain through contractual rights. Do not promise a complete production based on a quick search of one shared folder.

Accuracy matters at the certification stage too. The FTC statute provides for sworn certifications accompanying documentary productions and written answers. A responsible signatory needs a reliable account of the search and production process, including unresolved gaps and agreed limitations.

Objections and negotiations have their own deadlines

A company may have grounds to contest scope, burden, relevance, authority or protected material. Those issues need to be raised through the applicable process. A practical request for narrowing is stronger when supported by facts about systems, custodians, date ranges and retrieval effort.

For example, FTC Rule 2.7 generally requires a meet-and-confer within 14 days of receipt or before the petition deadline, whichever comes first, subject to its written-excusal and extension provisions. Personnel familiar with relevant electronic systems may need to participate.

Under FTC Rule 2.10, a petition to limit or quash generally must be filed within 20 days after service, or before the return date if it is earlier. The rule requires supporting objections and documentation, as well as a statement about efforts to resolve issues with staff.

These are FTC examples, not a general CID calendar. An informal discussion about more time should not be treated as an extension of every relevant deadline. Counsel should confirm what has been changed in writing and which obligations remain.

Ignoring the demand is consequential. The governing authority may seek judicial enforcement; disobeying a resulting court order can lead to contempt. The appropriate route is timely compliance, an agreed modification or a properly presented challenge.

For tracking investigations, current screenshots are only part of the answer

Suppose a hypothetical demand concerns a website’s advertising practices during the previous year. The company now has a consent banner and a successful scan showing its current configuration. Those results help explain today’s deployment. They do not establish what a visitor experienced nine months earlier.

A useful technical record connects the relevant period to deployed versions and observed behavior. It may show which tag-manager container was published, how consent defaults were configured, what regional rules applied and whether browser or server-side integrations transmitted information. Historical notices and approval records can help establish what the company represented and why it made the deployment decision.

Testing also needs context. Record the date, tested page, browser state, geography and choices exercised. A test after accepting all categories cannot establish what happened before a choice or after rejection. A cookie inventory alone cannot account for every transmission, because a service may send data without setting a cookie.

When historical evidence is incomplete, describe the gap accurately. A present-day reconstruction can support analysis, but it should be identified as a reconstruction. Retrospective work should never be presented as a contemporaneous log.

Protect personal information during the response

The production itself can involve sensitive material. Counsel should assess relevance, privilege, permitted redactions and appropriate confidentiality procedures. The review should also address secure transfer, access permissions and any cross-border restrictions relevant to the records.

Confidentiality and privilege serve different purposes. A customer database may be commercially sensitive without being privileged. Conversely, a confidential legal communication may warrant withholding under a recognized protection. Merely copying counsel on a business email does not settle that question.

FTC Rule 2.11 sets requirements for asserting protected status, including a detailed log supporting withheld material. The response process needs to identify and support valid claims while producing what is properly required.

Businesses should also avoid promising that an investigation will remain entirely private. The FTC’s CID guidance explains that petitions to limit or quash and Commission decisions are placed on the public record. Confidential treatment and redaction questions need attention before a filing, under the applicable rules.

Remediation should preserve the evidence of the change

A business should address identified problems without erasing the record counsel needs to evaluate them. Before replacing a notice, removing a tag or changing a configuration, coordinate preservation of relevant versions and supporting records. Then document what changed, when it changed and how the new behavior was tested.

Captain Compliance’s technical privacy support for law firms includes website audits, consent-behavior testing, configuration and log review, technical reports and assistance with remediation under counsel’s direction. That work can help explain how a deployment operates and identify records relevant to a response.

Counsel retains responsibility for the legal response, objections and privilege decisions. Software and technical support do not make past conduct compliant or guarantee an investigation’s outcome. Their value is the ability to replace assumptions about a deployment with documented findings, while clearly identifying what cannot be established.

Questions businesses ask about CIDs

Does a CID mean we are being sued?

No. It can be issued during a civil investigation before an enforcement case. Read the document and governing authority to establish its purpose and requirements. The recipient may also hold evidence relevant to another party’s conduct.

Can we negotiate the scope?

Often there is a process for discussing scope, timing and production methods. Bring specific information about burden and alternatives. Negotiation does not automatically replace the formal procedure for objections or challenges.

Can our privacy policy prevent us from producing customer information?

A privacy statement does not itself override valid compulsory process. Counsel should determine what is legally required and address applicable protections, objections and disclosure restrictions. Avoid either withholding responsive information categorically or producing unrelated personal data without review.

Should we delete old data to reduce the amount to review?

No. Once preservation obligations apply, deleting relevant information to reduce the production burden is improper. Counsel should determine the hold’s scope and which routine deletion processes must be suspended. Preserve existing evidence rather than creating a misleadingly cleaner record.

Does fixing a problem close the investigation?

Not necessarily. Remediation can matter, but investigators may still examine earlier conduct and available remedies. Any cure procedure is statute-specific. A CID should not be assumed to be the same thing as a notice that starts a statutory cure period.

The investigation will ask about a particular point in time

The hardest question in a privacy CID may be a simple one: what did the system do on that date? Teams can spend days searching old emails because no one retained the deployed configuration, recorded an approval or connected a vendor change to the relevant notice.

That is a reason to build proportionate, reliable records during ordinary operations. Keep the versions and evidence needed to explain material decisions, with defined retention and access controls. A business that can reconstruct its conduct accurately gives counsel something concrete to work with when the government’s questions arrive.