Criminal Defense Lawyers

What Does It Mean When the State Attorney General Investigates Your Business?

What Does It Mean When the State Attorney General Investigates Your Business?

Welcome to Spodek Law Group. We handle federal and state investigations across the country, and our goal is simple: give you the information you need to protect yourself, your business, and your future. If you’re reading this because you just received something from your state’s attorney general, take a breath. Then keep reading.

Most business owners make the same mistake when they receive notice of a state attorney general investigation. They treat it like a routine regulatory matter. Answer some questions, produce some documents, maybe negotiate a small settlement, move on with life. This assumption will destroy you. A state attorney general investigation is not a consumer complaint with a government letterhead. It’s the activation of a system designed to multiply your exposure exponentially, and by the time you understand what’s happening, you’ve already provided the ammunition being used against you in jurisdictions you didn’t know were watching.

Let me explain exactly what you’re facing and why the conventional wisdom about cooperation and transparency might be the worst advice you’ll ever follow.

This Isnt a Consumer Complaint: What an AG Investigation Really Means

Heres the thing most people miss. When a state attorney general opens an investigation into your business, they’re not responding to one angry customer. They’re exercising authority under your state’s Unfair or Deceptive Acts and Practices statute, commonly called UDAP laws. These statutes give attorneys general sweeping pre-litigation discovery powers that would make a plaintiff’s lawyer weep with jealousy.

The investigation typically begins with something called a Civil Investigative Demand, or CID. This isnt a subpoena. Its worse. A CID can be issued before any complaint has been filed against you. There’s no lawsuit. There’s no formal accusation. Theres just a demand that you produce documents, provide written responses to interrogatories, and potentially submit to testimony under oath. And you have roughly 20 days to comply.

Think about what that means. Your ordinary business operations continue. Employees are working. Customers are buying. And somewhere in your state capital, an investigator is building a file on your company based on complaints, media coverage, or a tip from another state’s AG office. You dont know this is happening. Then the CID arrives, and suddenly your entitled to exactly 20 days to analyze the scope of the investigation, identify and preserve relevant documents, retain counsel if you havent already, and begin production.

The timeline is designed to create pressure. Dont let it create panic.

But heres were it gets dangerous. Your instinct is to cooperate. To be transparent. To show you have nothing to hide. This instinct will be weaponized against you in ways you cannot currently imagine.

What Actually Triggers an AG Investigation

Before we go further, you need to understand how you probably ended up on the attorney general’s radar in the first place. This isnt random. Its systematized.

Consumer complaints are the most common trigger. Every state attorney general maintains a consumer complaint database. These complaints get categorized, analyzed, and trended. When complaints about a company start clustering around similar issues, the pattern becomes a priority. You might think of these as isolated unhappy customers. The AG’s office sees them as a systematic violation affecting potentially thousands of consumers.

But consumer complaints arent the only trigger. Whistleblower reports from current or former employees can initiate investigations. Media coverage that raises consumer protection concerns often gets the AG’s attention. Referrals from other agencies, including federal regulators and other state attorneys general, can put you on the list. And increasingly, state AGs are initiating proactive investigations into entire industries they beleive are engaging in problematic practices.

Heres what this means for you: by the time you recieve a CID, the investigation has already been running for months. The AG’s office has already reviewed complaints, identified patterns, and made preliminary determinations about what they think happened. Your first contact with the investigation is actualley the middle of their process, not the beginning.

That timing assymetry matters enormously. They have a head start. They have a theory. They have complaint narratives that support that theory. You have 20 days to catch up.

The Multiplication Machine: How One State Becomes Forty

The National Association of Attorneys General exists. This isnt a secret. Its a membership organization were state attorneys general coordinate on investigations, share information, and pool resources. They maintain something called the Multistate Settlements Database, tracking every coordinated investigation going back to the early 1980s.

What this means for your business is simple and terrifying. When you produce documents to one state attorney general, that information dosent stay in one state. The attorney general who issued your CID talks to attorneys general in other states. They look for patterns. They ask: is this company doing the same thing in your jurisdiction? And if enough states see a pattern, you suddenly face a multistate investigation with an executive committee of lead states making decisions that affect your exposure everywhere.

Look at the numbers:

• In 2022, 40 state attorneys general coordinated to secure a $391.5 million settlement from Google over location tracking practices. The largest multistate privacy settlement in history.
• Fifty state attorneys general coordinated on the Equifax data breach investigation, ultimately securing $600 million.
• Marriott faced a $52 million settlement with attorneys general from all 50 states.

Now your probably thinking: my company isnt Google. Were not Equifax. Surely multistate investigations are only for the giants.

This is the most dangerous assumption you can make.

The information sharing happens BEFORE anyone decides whether your case warrants multistate treatment. You produce documents to California. California shares them with the NAAG working group. Attorneys general in New York, Texas, and Illinois see something interesting in your production. They issue there own CIDs. Now your responding to four states simultaneously, each with slightly different demands and deadlines.

By the time you realize your facing multistate exposure, its to late. The documents are already circulating.

The Math That Destroys Your Leverage

Heres were most business owners completly misunderstand there situation. They think about state attorney general investigations in terms of realistic settlements. What would we actually pay to resolve this? A few hundred thousand? Maybe a couple million if it gets bad?

Thats not how the leverage works.

State consumer protection laws typically impose penalties of $5,000 to $25,000 per violation. And heres the critical part that your lawyer needs to explain to you very clearly: each affected consumer can constitute a seperate violation.

Do the math:

• A regional company with 50,000 customers facing $10,000 per violation penalties has theoretical exposure of $500 million.
• A company with 100,000 customers facing $25,000 per violation penalties? That’s $2.5 billion in theoretical exposure.

Nobody expects you to actually pay $2.5 billion. But that number exists in the attorney general’s briefing memo. That number appears in there internal risk assessment. And that number creates the leverage that produces settlements in the hundreds of millions from companies that thought they we’re facing a managable local inquiry.

The penalties arent about what you’ll pay. There about what you could pay. The gap between those numbers is were your negotiating leverage dies.

This is why mid-size companies often face worse outcomes then giants. Google has the resources to fight multistate investigations for years. They have armies of lawyers in every jurisdiction. They can absorb a $400 million settlement and report record profits the same quarter. A mid-size company with 100,000 customers has enough customer volume to create massive theoretical exposure but lacks the resources to mount a comprehensive multistate defense.

Your caught in the worst possible position: big enough to matter, to small to fight.

When Civil Becomes Criminal: The Parallel Proceedings Trap

Everything weve discussed so far assumes this stays civil. But theres another pathway that most business owners dont understand untill its to late.

The Department of Justice has explicit policies governing something called parallel proceedings. DOJ attorneys are instructed to coordinate with civil regulators and state enforcement authorities. Information gathered during civil investigations can be shared with federal criminal prosecutors.

Let me say that more directly: the documents you produce to a state attorney general in response to a civil investigation can end up in the hands of federal prosecutors building a criminal case against you personally.

The DOJ policy states that attorneys should “maximize the government’s ability to share information among criminal, civil, and agency administrative teams.” Information sharing is not an accident or an exception. Its the official policy of the federal government.

So your cooperating with what you beleive is a civil consumer protection inquiry. Your being transparent. Your producing documents that show what happened and why. And while your focused on the state investigation, federal prosecutors may be reviewing those same documents to determine whether criminal charges are warranted.

This is the parallel proceedings trap. You think your navigating one investigation. Your actualy providing evidence to multiple enforcement authorities simultaneously, some of whom you dont even know are watching.

Heres what makes this especialy dangerous: the Fifth Amendment protection against self-incrimination works differently in civil and criminal proceedings. In a civil matter, invoking the Fifth can result in adverse inference, the judge or jury can assume the worst about what you we’re hiding. In a criminal matter, invoking the Fifth is protected but dosent prevent prosecutors from using other evidence against you.

The result is an impossible choice. Cooperate with the civil investigation and potentially hand criminal prosecutors the evidence they need. Or invoke the Fifth, lose the civil case through adverse inference, and still face potential criminal exposure from other sources.

Todd Spodek, the founder of Spodek Law Group, has guided clients through exactly these situations. The key is understanding your exposure across both civil and criminal dimensions before you produce anything. Once documents are out there, you cant take them back.

Timeline Reality: How Long This Actually Takes

If your hoping this resolves quickly, I need to tell you something your probably not going to want to hear. State attorney general investigations dont move fast. There designed to be thorough, wich means there designed to take time.

For context: the SEC’s Inspector General reported that the average time from opening an investigation to first enforcement action was 22.8 months. For complex cases, it was 34 months, nearly three years. State attorney general investigations often follow similar timelines, sometimes longer.

During this entire period, your business operates under a cloud. You cant talk about the investigation publicly. You cant reassure customers who might hear rumors. Every major business decision has to be evaluated through the lens of: how will this look to investigators? The investigation becomes a constant drain on management attention, legal resources, and strategic flexibility.

The financial costs accumulate in ways that go beyond legal fees:

• Document preservation holds that prevent normal records management
• Delayed product launches or market expansions
• Increased insurance premiums
• Strained banking relationships

And if this becomes a multistate investigation? Multiply everything. You now have different response deadlines in different jurisdictions. Different document requests with different scopes. Different attorneys general with different enforcement priorities and different political incentives.

Remember: state attorneys general are often elected officials. They campaign on being tough on corporations. Your investigation might become someone’s campaign platform.

The costs during this period can be staggering. Legal fees for responding to a single-state CID can easily reach six figures. Multistate investigations routinly cost companies millions in defense alone, before any settlement is reached. The internal costs, diverting employees to document collection, hiring forensic consultants, managing communications, these add up quickly. And during the entire investigation, your business continues to incur ordinary operating expenses while laboring under extraordinary constraints.

Some companies dont survive the investigation period. Not becuase they’re found liable, but becuase the investigation itself consumes resources the business needs to operate. This is particulary true for mid-size companies that lack the financial reserves of larger corporations.

Containing the Multiplication: What Actually Works

By now you understand the system your facing. The question is what to do about it.

The first and most critical step is getting experienced counsel involved immediatly. Not tomorrow. Not after you’ve reviewed the CID yourself. Now. The 20-day clock is already running, and every day you spend trying to understand the scope of the investigation is a day your not spending on strategic response.

Experienced counsel serves multiple functions. They analyze the CID to understand what the attorney general is really investigating, wich is often different from what the document requests suggest. They establish privilege protections that preserve your ability to defend yourself later. They open dialogue with the AG’s office to understand motivations and potentially negotiate the scope of production.

But heres what most people dont realize: the initial response strategy is also about limiting multistate exposure. Your counsel needs to be thinking about how information produced to one state could be interpreted by others. They need to be considering confidentiality protections and priviledge claims that might limit information sharing. They need to be evaluating whether proactive engagement with other states might actually reduce exposure by controlling the narrative.

Spodek Law Group handles these investigations across the country. Our approach is built around understanding exactly how the multistate coordination system works and using that understanding to protect our clients.

Some specific tactical considerations:

Document Preservation: The obligation to preserve relevant documents begins the moment you have reason to anticipate litigation or investigation. Destroying documents after receiving a CID is obstruction. But overly broad preservation holds can burden your business for years. The preservation scope needs to be defensible but reasonable.

Privilege Protection: Attorney-client priviledge and work product protection are critical. But there easy to waive inadvertantly. Every document you produce should be reviewed for priviledge. Every communication about the investigation should be structured to maintain protection.

Proactive Engagement: Sometimes the best defense is controlled offense. If you know your business practices are compliant, demonstrating that proactivley to the AG’s office may prevent escalation. But this has to be done carefully, you dont want to produce damaging information thinking it shows compliance when it actualy raises new questions.

Settlement Considerations: If settlement becomes the path forward, understanding the multistate dynamics is critical. A settlement with one state may need to account for potential claims by others. The terms of settlement, including compliance monitors and ongoing reporting obligations, will affect your business for years.

Executive Committee Dynamics: In multistate investigations, a small group of lead states forms an executive committee that effectivley makes decisions for all participating states. Understanding who sits on this committee, what there priorities are, and how decisions get made is essential to effective defense. Your actualy negotiating with the committee, not with 40 individual states.

The Meeting Question: The AG’s office will likely want to meet with you early in the investigation. Whether to accept this invitation, what to say, and who should attend are critical strategic decisions. These meetings can help or hurt you dramaticaly depending on how there handled. Some business owners walk into these meetings thinking cooperation will resolve everything and walk out having made incriminating statements.

Never meet with investigators without counsel. Ever. The downside risk is catastrophic.

Industry Patterns: If your facing investigation, theres a good chance other companies in your industry are facing similar scrutiny. Understanding whether this is a one-company investigation or an industry-wide sweep affects your strategy considerably. Industry-wide investigations sometimes create opportunities for coordinated defense or information sharing among targets.

Call us at 212-300-5196. The consultation is confidential and the earlier we get involved, the more options you have.

The Reality You Need to Accept

A state attorney general investigation is not a routine regulatory matter. Its the activation of a system designed to coordinate enforcement across jurisdictions, multiply penalties through per-consumer violations, and potentially feed information to criminal prosecutors. The cooperation and transparency that work in normal business dealings can be weaponized against you in this context.

This dosent mean you should obstruct or lie. Absolutely not. Those paths lead to far worse outcomes. But it means your cooperation needs to be strategic. Your transparency needs to be bounded by legal protections. Your response needs to be guided by counsel who understands exactly how the multistate coordination system works.

The window for strategic response is narrow. Once documents are produced, they cant be unproduced. Once information is shared across states, it cant be unshared. The decisions you make in the first 20 days after receiving a CID will shape your exposure for years.

Your facing something serious. But serious dosent mean hopeless. It means you need serious help, immediately.

Spodek Law Group has the experience and the understanding of these systems to help you navigate whats coming. The call is free. The advice might save your business.