About Consent Decrees

Last Friday, Aug. 30, 2024, the Federal Trade Commission filed a stipulated lawsuit against Verkada, Inc.¹ The FTC makes several allegations in its complaint, ranging from failure to use appropriate information security practices to protect personal information collected through the company's security cameras, to false statements about compliance with HIPAA and Privacy Shield, failure to disclose that specific positive reviews were written by people associated with the company, and violations of the CAN-SPAM Act.² Since I work in email deliverability and privacy/data protection, this is the perfect case for me, so I'll take a closer look at the issues over the next few posts.

I'll start today with consent decrees: what they are, how they happen, and why they can be a problem.

A consent decree is a settlement with a judge's signature

A "consent order" (also known as a "consent decree") is "a decree or order made by a judge with the consent of all parties. It is not strictly a judgment, but rather a settlement agreement approved by the court. The agreement is submitted to the court in writing after the parties have reached a settlement, and once approved by the judge, the agreement is binding and enforceable on both parties."³

We often see consent decrees used to short-circuit the litigation process in cases involving governmental units (like civil rights litigation involving police forces or school districts), the FCPA,⁴ HIPAA,⁵ or the CAN-SPAM Act. In exchange for the government agreeing not to pursue the case further, the defendant agrees to certain actions but does not admit guilt or liability. In litigation involving private businesses, this almost always includes "disgorgement" of "unlawful gain" or some other penalty. The judge retains jurisdiction over the case for as long as the consent decree is in effect (which can be indefinitely in civil rights cases, while other civil cases usually run for an agreed term of years).

A good way to understand a consent decree is to compare it to what many people do when they get a traffic ticket. In exchange for the government dismissing the case, the person who got the ticket agrees to take a defensive driving course (and often pays some court fees), whether or not they agree that they committed the offense. They take the agreement to the judge, who retains control of the case until proof is presented that the course was completed, then dismisses the case.

Cost usually decides whether a defendant settles

How a consent decree happens depends on the kind of case. I'm not a civil rights attorney, so I won't discuss school desegregation, policing, or voting rights cases that have ended (or might end) in consent decrees.

In civil enforcement cases, the government usually starts with an investigation. In Verkada's case, the FTC appears to have opened an investigation after the company suffered a data breach in March 2021.⁶ During the investigation, the FTC found other issues, including a prior breach and what it believed were CAN-SPAM Act violations. Once those issues surfaced, Verkada could dispute them and proceed to trial or seek to settle with the FTC.

One of the primary considerations in these cases is cost. Attorneys cost money, and a defendant can spend more defending a case than it would save by winning in court. It makes little sense to pay $1,000,000 in attorney's fees to defend against a $100,000 fine. If a defendant knows it will lose anyway, it is often more cost-effective to settle and avoid the expense of trial. In either case, the government saves time and money by not having to prepare for trial.

Another consideration is how onerous the proposed agreement is. If the FTC offers a consent agreement that requires the defendant to do what it has already done or planned to do anyway, then entering into the consent decree may make more sense.

Finally, publicly traded companies may gain a slight advantage in future derivative litigation by not having an actual judgment on the record. Shareholders suing the company and its officers will likely use the allegations in an FTC complaint, but those allegations carry less weight than a final judgment.

Settlements let regulators set standards they never had to prove

Consent decrees can hurt the industry in two ways.

When a company settles, it avoids the costs and uncertainties of litigation, but that comes at the societal cost of letting the government win without proving its claims. Repeated wins this way can encourage regulators to pursue more aggressive cases, even when they lack strong evidence. It also lends the government's interpretation of the law weight it never earned in a court decision.

Additionally, if many companies agree to similar consent decrees, they can create de facto standards.⁷ Those standards are not set through legislation, formal rulemaking, or industry consensus. They come from a critical mass of individual settlements, which may not be practical in all instances or reflect industry realities. Companies can end up feeling pressured to follow guidelines that were never widely agreed upon or developed with input from the people they bind. (Interestingly, the Supreme Court's decision in Loper Bright⁸ may have lessened this effect.)

The cost math that makes settling rational for one company is the same math that, repeated across an industry, turns a regulator's untested theory into the standard everyone else is measured against.

This post does not constitute legal advice. Readers should consult competent legal counsel before taking action based on the analysis presented here.