2. Pre-search. Before the FTC contacts your company, its Bureau of Consumer Protection will assign the case to one of its 100-plus lawyers in its Washington headquarters and seven regional offices. The assigned attorney will usually search the Internet for readily available information about the subject matter. This helps the FTC determine which cases are worth devoting further resources to.

"During this phase, the FTC will likely look closely at any consumer complaints or negative press regarding your privacy practices or business model," Saverice-Rohan explained.

3. Civil Investigative Demand or access letter. The first your company will hear of it usually will come in the form of a letter from the FTC sent to your general counsel. The FTC will list the information it expects you to provide. Over the course of the next several months, the FTC may submit additional requests for information via e-mail or over the phone, but rarely if ever in person.

Saverice-Rohan recommends securing outside help for this phase. "We retained outside counsel that was experienced with FTC investigations. This is very important," she said. "Lack of experience could have a material impact on your investigation and the ultimate outcome."

Andrew Serwin, a partner at law firm Foley and Lardner who has participated in several FTC privacy decrees and investigations, echoed this advice. "Managing your communications with the FTC is a critical component of the process."