Calls are growing for reforms to FTC consent decrees issued as part of commission enforcement action. Tyler Bridegan and Audrey Karman of Womble Bond Dickinson explore the often costly injunctive terms and outline cost-saving measures while the FTC’s leader weighs changes.
While FTC monetary penalties usually grab the headlines, the agency’s enforcement playbook has increasingly come under scrutiny for a different practice: its use of onerous and costly injunctive terms. Companies targeted by the FTC are oftentimes surprised to learn that the real costs are incurred after settling with the commission.
FTC enforcement reform has been a topic of discussion for decades. There are a variety of enforcement tactics with which critics take issue. Following high-profile calls for FTC consent decree reform, the current FTC chairman, Andrew N. Ferguson, has signaled that some (albeit limited) relief may be on the horizon.
Recently, Ferguson publicly directed staff to re-examine whether consent decrees should, by default, continue to automatically include an effective period of 20 years. This direction is notable, in part, because the FTC’s default 20-year term has been in effect since 1995. But the chair’s comments were also notable because he previewed what moving away from a default effective period might look like. Specifically, he noted that a consent decree’s duration should be calibrated to the severity of the alleged unlawful conduct as well as the underlying risk of recurrence, rather than applied as a default.
While the FTC has yet to officially reform its consent decree terms, Ferguson’s apparent willingness to reform FTC practices has already resulted in at least one company formally petitioning the FTC to set aside its consent decree. Depending on the FTC’s response to the company’s petition, there may be opportunities for other companies to follow suit.
Costly injunctive terms
For companies targeted by an FTC investigation or already subject to an FTC consent decree, it is essential that they understand the costs and implications of the more onerous provisions regularly included in FTC consent decrees. These include:
- Recurring independent third-party assessments: Widely regarded as the single largest cost driver, these biennial assessments require engagement of an independent, often highly specialized assessor approved by the FTC. Critically, assessors must conduct independent testing, sampling and fact-gathering rather than relying on management representations. Each cycle demands extensive internal preparation, production of documentation, remediation of findings, and follow-up, repeated every two years for the life of a decades-long order. This is not an audit that can be handled with a checklist; it is a substantive, resource-intensive evaluation.
- Verified compliance reports and certifications: Interim, annual and sometimes quarterly reports detailing compliance with the order must be signed under penalty of perjury by a senior officer. The legal review, internal audit coordination and personal liability exposure associated with these certifications add significant cost layers beyond the assessment itself. This is a somewhat open-ended requirement where the FTC retains discretion to mandate additional reports at any time, creating an ongoing compliance obligation.
- Recordkeeping and data retention obligation: Some orders impose retention requirements lasting five or more years, and legacy orders have required perpetual retention of broad categories of business records. These obligations can become misaligned with evolving data-minimization best practices and impose ongoing storage, governance and retrieval costs.
Practical cost-mitigation strategies
Given the FTC’s own recent signals that order terms should be proportionate, compliance teams have both the opportunity and the obligation to approach consent decree negotiations and ongoing compliance strategically.
- Negotiate duration and scope at settlement: Rather than accepting default terms, push for risk-calibrated order duration, sunset or step-down provisions and early-termination mechanisms tied to demonstrated compliance milestones. The FTC’s public statements create leverage for these arguments.
- Build on existing infrastructure: Mandate-specific compliance programs should be layered on top of not parallel to existing enterprise risk management, internal audit and information security frameworks. Duplicative cost centers are avoidable with thoughtful program design from the outset.
- Treat assessments as continuous compliance: Transform the biennial third-party assessment from a fire drill into a continuous-readiness function. Maintain assessment-ready documentation, control testing evidence and sampling logs year-round so that each assessment cycle requires incremental effort rather than ground-up mobilization.
- Insist on precise definitions: During settlement negotiations, seek technology-neutral, precisely defined terms for covered data categories, reportable incidents and compliance triggers. Overbroad or outdated language, particularly around consent mechanisms or retention, becomes costly to comply with and difficult to modify after entry.
- Centralize recordkeeping and reporting: Consolidate the audit trail needed for both the FTC order and overlapping state or federal obligations into a single reporting function to reduce duplication and coordination costs.
- Assign clear accountability: Designate a single executive function with unambiguous authority over certification, training and reporting obligations. Fragmentation across departments multiplies coordination costs without improving compliance quality.
- Seek modification of outdated terms: Where business practices or technology evolve, petition to reopen or modify legacy order terms that have become disproportionate. The FTC has signaled openness to reconsidering order scope where a party demonstrates the terms are no longer calibrated to the underlying risk.
Looking ahead
The growing consensus that FTC consent decree terms warrant reform reflects a broader recognition that effective enforcement need not require indefinite or disproportionate compliance burdens. For companies facing or currently subject to FTC orders, the message is clear: the injunctive terms deserve at least as much strategic attention as the penalty amount. Proactive negotiation, thoughtful program design, and continuous compliance readiness are the most effective tools for managing the true cost of settlement.
Tyler R. Bridegan
Audrey Karman
