The scope and scale of state attorneys general investigations has expanded for several reasons, including a perceived lack of enforcement at the federal level. Many state attorneys general are not reticent to fill a perceived regulatory void, and they routinely conduct investigations and bring enforcement actions when they observe a federal agency is not moving fast enough or otherwise has neglected its responsibility.

For example, in the tobacco context, while the U.S. Food and Drug Administration (FDA) has been tasked with primary regulatory oversight of tobacco products, state attorneys general sent the FDA earlier this year two bipartisan comment letters requesting the agency address concerns related to the tobacco industry. First, 23 state and territorial attorneys general urged the FDA to ban menthol cigarettes. Then, 31 attorneys general called on the agency to eliminate characterizing flavors, to limit nicotine levels, and to enact new marketing restrictions on tobacco products, with a particular focus on e-cigarettes and nicotine pouches. Traditionally, these kinds of comment letters — if not sufficiently acted upon — have been followed by state attorneys general taking enforcement directly against an industry, including using state consumer protection laws to issue information-gathering requests, commonly referred to as civil investigative demands (CIDs).

A state attorney general’s investigatory subpoena of a business’ activities carries state-specific complexities that must be navigated to protect a company’s interests. CIDs constitute powerful tools for obtaining a sweeping scope of information based upon a minimal allegation threshold, while maintaining the confidentiality of the state’s investigation. In the early stages of the investigation (and preferably before it even begins), a company must create a corporate strategy that is adaptable and capable of triaging potential pitfalls. While not in any way exhaustive, below are five considerations for managing a CID.

Know Your Audience and What Information They Seek

While many state statutes require that a CID include specific information, including the law authorizing the investigation, there is often much that is unstated. Establishing an open dialogue with the attorney general’s office can help businesses better understand what information the attorney general is — and is not — asking for, how the office intends to use it, and with whom the office intends to share it. Recognizing what prompted the CID can help a company tailor its response to demonstrate that its actions do not implicate the state’s concerns. Most importantly, businesses need to know whether the CID is sent on behalf of a single state or is part of a multistate investigation. In either event, a company should consult experienced outside counsel to help it navigate these complex actions.

Refusing to Produce Documents Can Lead to Major Consequences

While an investigation may be related to a specific product, states routinely conduct broad investigations of businesses to determine whether a practice is “unfair and deceptive.” Although companies generally bristle at the scope of investigations, courts rarely limit a state’s attempt to gather information. In addition, states often are willing to work with companies that express reasonable concerns about the scope of a CID and negotiate in good faith.

In contrast, a state is far more likely to take public action if it believes a production was woefully deficient. For instance, in 2018, the California attorney general opened a pre-litigation investigation into Facebook’s involvement in the Cambridge Analytica scandal, which eventually expanded to examine whether Facebook had violated California law by allowing third parties broad access to user data contrary to the company’s own policies. In November 2019, after determining that Facebook’s responses to the California attorney general’s investigatory CID were deliberately deficient, then-California Attorney General Xavier Becerra disclosed the investigation by filing a motion to enforce compliance with the CID in California state court. In doing so, Becerra declared, “We are left with little choice but to seek a court order compelling Facebook to faithfully comply with our duly authorized subpoenas.”

Produce Responsive Materials, Not a “Document Dump”

Because states perceive their role as seeking to obtain the truth on behalf of a “neutral” government, common litigation tactics might be viewed as hostile or disrespectful, leading the state to view the company skeptically or negatively. Therefore, while “document dumps” or exhaustive objections may reap benefits in private litigation by overwhelming opposing counsel, the state will believe these actions suggest that a company is withholding information. For example, a technology company’s resistance to surrender documents prompted the Texas attorney general to declare: “Every indication right now is that [the company] do[es]n’t believe they’re clean because they don’t act in any way like they are.” As such, when responding to the state’s discovery requests, it is imperative that counsel communicate a commitment to transparency through the production process — especially if a company’s responses could be seen as incomplete based upon unavoidable limitations, such as prior document retention policies.

Keep a Line of Communication Open Upon Completing a Production

Companies should maintain contact with an attorney general’s office even after completing the production in response to the CID, including by offering to supplement the production if requested. This communication demonstrates the company’s desire to work with the state and not hide the ball. This also increases the likelihood that the state will communicate with the company before filing a complaint, even if it is not satisfied with the production. This continues the discussions that allow the parties to make decisions without public pressure and litigation timelines.

After a Production, Be Prepared to Wait It Out

After substantially completing a document production in response to a CID, a company naturally wants to hear back from the state. But the underlying confidentiality of an investigation coupled with the states’ limited resources likely means that a company’s robust production will be followed by weeks, if not months, before further communication. This silence should be viewed as a good thing because the state is likely to complain immediately if it thinks a production was facially deficient. The silence means the state is likely reviewing the production.

Conclusion

While the receipt of a CID is never welcome news for a business and its leaders, a holistic evaluation of the request, the sending state attorney general, and potential follow-on requests by other regulators must be considered. All actions should not be viewed in a vacuum and balance the importance of demonstrating an understanding of the role that state attorneys general play, while also protecting the business’ interests.