FTC Consent Orders and Decrees Explained

FTC consent orders and consent decrees are legally binding settlements that resolve Federal Trade Commission enforcement actions without a full trial. These instruments define specific obligations a respondent must fulfill — and prohibitions they must observe — for a fixed period, typically 20 years. Understanding how they are structured, when they arise, and what consequences attach to violations is essential for any business operating under FTC jurisdiction.

Definition and scope

A consent order is a formal legal document negotiated between the FTC and a company or individual accused of violating consumer protection or competition law. It carries the force of law once finalized, even though the respondent neither admits nor denies the underlying allegations. The distinction between an administrative consent order and a federal court consent decree is significant:

• Administrative consent order: Issued through the FTC's in-house administrative process under the FTC Act. Violations expose the respondent to civil penalties of up to $51,744 per violation per day (FTC, Civil Penalty Amounts), adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act.
• Federal court consent decree: Filed in U.S. district court, typically sought when the FTC pursues injunctive relief, monetary redress, or disgorgement alongside behavioral remedies.

Consent orders issued by the Commission enter a 30-day public comment period before they are finalized, giving third parties an opportunity to submit objections or supporting statements (16 C.F.R. § 2.34).

The scope of a consent order can cover a single product line or an entire enterprise. Orders frequently include audit requirements, third-party assessments, record-keeping mandates, and provisions for FTC monitoring access. More complex orders — particularly those arising from FTC data security enforcement — routinely require biennial independent security assessments for the full duration of the order.

How it works

The lifecycle of an FTC consent order follows a defined sequence:

1. Investigation: The FTC opens an investigation, often triggered by consumer complaints, referrals, or staff monitoring. A civil investigative demand may be issued to compel production of documents and testimony.
2. Staff recommendation: Bureau staff, typically the Bureau of Consumer Protection or the Bureau of Competition, present findings to the Commission and recommend enforcement action.
3. Negotiation: FTC staff and the respondent negotiate settlement terms. Respondents frequently seek narrower prohibitions, shorter duration, or reduced reporting obligations.
4. Provisional acceptance: The Commission votes to accept the proposed order provisionally. The agreement and an accompanying analysis are published in the Federal Register.
5. Public comment period: A 30-day window opens for public input.
6. Final order: The Commission reviews comments, modifies the order if warranted, and issues the final consent order. It becomes enforceable immediately upon finalization.
7. Compliance reporting: The respondent submits periodic compliance reports — typically annually — for the life of the order.

Respondents who violate a finalized consent order face civil penalties assessed per-violation, per-day. Because order terms are often broad and cover entire business practices, a single ongoing violation can accumulate penalties rapidly across multiple consumer interactions.

Common scenarios

Three categories of conduct generate the majority of FTC consent orders:

Deceptive advertising and marketing: Companies making unsubstantiated health claims, false endorsements, or misleading pricing representations frequently resolve enforcement through consent orders. The FTC endorsement guides and health claims regulations define substantiation standards that orders often codify as affirmative obligations.

Data security and privacy failures: Following the Commission's authority affirmed in FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015), consent orders addressing inadequate data security have become a standard enforcement tool. These orders typically require comprehensive information security programs, employee training protocols, and independent audits. The FTC privacy framework provides the policy backdrop for these settlements.

Anticompetitive conduct and merger remedies: In merger reviews conducted through the FTC merger review process, consent orders often require divestitures of specific business units or assets as a condition for allowing a transaction to proceed. Behavioral remedies — such as prohibitions on exclusive dealing — appear in orders arising from monopolization or antitrust enforcement investigations.

Negative option and subscription billing: Companies enrolling consumers in recurring charges without adequate disclosure frequently face consent orders under the FTC Negative Option Rule. These orders typically mandate clear disclosure, express informed consent, and simple cancellation mechanisms.

Decision boundaries

Not every FTC investigation results in a consent order. Several factors determine whether the Commission pursues a consent order versus litigation, a closing letter, or a no-action outcome:

Consent order vs. administrative litigation: When settlement negotiations fail, the FTC may proceed to administrative litigation before an Administrative Law Judge. The Commission pursues litigation when it seeks to establish precedent, when proposed order terms are inadequate to remediate harm, or when a respondent refuses reasonable settlement terms.

Consent order vs. federal court action: The FTC may bypass its administrative process and file directly in federal district court when it seeks consumer redress, civil penalties for known violations of a rule, or emergency injunctive relief. The Supreme Court's 2021 ruling in FTC v. AMG Capital Management eliminated the Commission's ability to obtain equitable monetary relief under Section 13(b), shifting enforcement strategy toward administrative orders combined with targeted court filings under Section 19.

Duration and modification: Standard consent orders run 20 years. Parties may petition for modification or early termination, but the Commission grants such requests only when circumstances have materially changed and the public interest no longer requires the original terms. The FTC's overview of its authority and jurisdiction provides broader context on the agency's enforcement framework and the statutes underlying these instruments.

Orders covering children's privacy under COPPA or telemarketing under the TSR may include additional provisions specific to those regulatory schemes, reflecting the specialized obligations Congress attached to those statutory frameworks.