What is a consent order? Settled regulator orders in data security cases, defined

A consent order is a binding order that a company or person agrees to in order to settle a regulator's charges without a contested hearing, usually without admitting liability. In US data security cases the Federal Trade Commission (FTC) uses consent orders to impose security programs and other duties, and violating a final order can bring civil penalties.

How an FTC consent order is made

When the Commission has reason to believe the law was violated, it can issue an administrative complaint. A respondent that settles signs a consent agreement, accepts a final order and waives judicial review. The FTC's own overview says the order then goes on the public record for 30 days of comment before the Commission decides whether to make it final. A federal district court assesses any penalty for a later violation.

A data security example

On 1 February 2024 the FTC voted 3-0 to issue a complaint against Blackbaud and accept a proposed consent agreement, alleging lax security let a hacker reach consumers' personal data. The proposed order required the company to delete data it no longer needs, run a comprehensive information security program, keep a data retention schedule and tell the FTC about future breaches it must report to other agencies. The FTC put each violation's penalty at up to $51,744, and finalized the order on 20 May 2024.

The SEC version

The Securities and Exchange Commission (SEC) reaches the same result through settled cease-and-desist orders. In the four cyber disclosure orders of 22 October 2024, each company agreed to cease and desist and pay a penalty without admitting or denying the findings.

Why it matters to a CISO

A consent order turns a security program into a legal obligation. Under an order like Blackbaud's, a later control failure is no longer only an incident; it can also be an order violation, priced per violation.

What it is not

It is not a court judgment after trial, and it is not an admission of liability. It is also not a private settlement: a data breach class action settles under court approval, not agency order.

Where it appears on cisonews.net

The FTC data security enforcement tracker lists every FTC case tagged under the FTC's Data Security topic, built from the FTC's own case listing back to 2000. Related terms: SEC enforcement action, breach notification law.