Auto dealerships that arrange or offer financing are treated as financial institutions under federal law, and that classification pulls them into a specific set of Federal Trade Commission rules. FTC compliance for auto dealerships covers data security, used-car disclosures, consumer privacy, credit contract terms, identity theft prevention, advertising, adverse action notices, and telemarketing. The FTC’s authority runs primarily through Section 5 of the FTC Act, which prohibits unfair or deceptive acts in commerce.1Office of the Law Revision Counsel. 15 US Code 45 – Unfair Methods of Competition Unlawful; Prevention by Commission Civil penalties currently reach $53,088 per violation, and because each affected consumer can be counted separately, a single enforcement action can easily run into the millions.
The Safeguards Rule and Your Data Security Program
The Safeguards Rule (16 CFR Part 314) is the heaviest single obligation for most dealerships. Every dealer that arranges financing must develop, implement, and maintain a written information security program tailored to its size, complexity, and the sensitivity of the data it holds.2Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know Dealerships that maintain information on fewer than 5,000 consumers get a partial exemption from some elements, but the core program is still required.
You must designate a Qualified Individual to run the program. That role can go to an employee, someone at an affiliated company, or an outside service provider, but the dealership itself keeps the compliance responsibility. If you outsource the role, a senior member of your own staff has to direct and oversee that outside person.3eCFR. 16 CFR 314.4 – Elements
The program is built on a written risk assessment identifying reasonably foreseeable internal and external threats to customer information. The assessment must include criteria for evaluating and categorizing risks, criteria for judging how well existing controls handle them, and a plan for mitigating or accepting each identified risk. It’s not a one-time document.
Encryption and Multi-Factor Authentication
The rule imposes specific technical controls. Customer information must be encrypted both at rest and in transit over external networks. The only way out is a written determination from your Qualified Individual that encryption is infeasible for a given system, backed by an approved compensating control. Multi-factor authentication is required for anyone accessing information systems, again unless the Qualified Individual has approved a reasonably equivalent or more secure alternative in writing. Ordinary username-and-password access to customer data no longer meets the rule.
Incident Response and Board Reporting
You need a written incident response plan covering the program’s goals, the internal processes triggered by a security event, roles and decision-making authority, internal and external communications, remediation of weaknesses, documentation, and post-event review of the plan itself. If a security event affects 500 or more consumers, you must report it to the FTC.4Federal Trade Commission. Safeguards Rule Security Event Reporting Form
The Qualified Individual also has to submit a written report to the dealership’s board or equivalent governing body at least annually. That report has to cover the status of the program, risk assessment results, service provider arrangements, testing outcomes, any security events, and recommended changes.
Service Providers and Training
You have to take reasonable steps to select service providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically reassess whether each provider’s security still fits the risk. A breach at your document management vendor or CRM host remains your compliance problem.
Everyone who handles customer information has to receive security awareness training appropriate to their role, and information security staff need a specialized track beyond the general awareness program. Running the same slide deck every January without updating for current threats does not satisfy the rule.
The Used Car Rule and the Buyer’s Guide
Under 16 CFR Part 455, every used vehicle offered for sale has to display a Buyer’s Guide before a consumer sees the car on the lot. It must be posted on a window, plainly visible, with both sides readable. The glove box and the trunk don’t count.5Federal Trade Commission. Dealers Guide to the Used Car Rule The guide becomes part of the sales contract and overrides conflicting verbal promises from a salesperson.
The guide must state whether the vehicle comes with a dealer warranty or is sold “As Is — No Dealer Warranty.” In states that prohibit as-is sales, an “Implied Warranties Only” version is used instead.6eCFR. 16 CFR Part 455 – Used Motor Vehicle Trade Regulation Rule When a warranty is offered, the guide has to spell out coverage duration, the percentage of repair costs the dealer will pay, and the systems covered. It must also recommend an independent inspection before purchase.
If the sale is negotiated in a language other than English, the guide has to be provided in that language. The FTC publishes a Spanish version; for any other language, the dealership is responsible for producing the translation.
Privacy Notices and Record Disposal
The Privacy Rule (16 CFR Part 313) requires you to give customers a clear notice describing what personal information you collect, which categories of third parties receive it, and how you protect it. That initial notice has to be delivered no later than when the customer relationship is established, which for most dealers means when the buyer applies for financing or signs a retail installment contract.7eCFR. 16 CFR Part 313 – Privacy of Consumer Financial Information
Customers can opt out of having their nonpublic personal information shared with non-affiliated third parties, and you must give them a clear notice of that right and a reasonable method to use it before sharing occurs. You are exempt from sending annual privacy notices only if two conditions are met: you share information only in ways that do not trigger the opt-out right, and you haven’t changed your data-sharing policies since your last notice.8Federal Register. Amendment to the Annual Privacy Notice Requirement Under the Gramm-Leach-Bliley Act Regulation P Change either condition and the annual notice obligation returns.
The Disposal Rule (16 CFR Part 682) covers what happens when you’re done with consumer report information. Paper records must be burned, pulverized, or shredded so the data can’t practicably be read or reconstructed. Electronic media must be destroyed or wiped to the same standard.9eCFR. 16 CFR 682.3 – Proper Disposal of Consumer Information A credit application in the dumpster or a donated computer with an intact hard drive both violate the rule.
Red Flags Rule: Written Identity Theft Program
Any dealership offering or maintaining covered accounts, which includes essentially every dealer that extends credit or arranges financing, needs a written Identity Theft Prevention Program. The program has to identify red flags relevant to the dealership’s accounts, detect them when they appear, respond to prevent or mitigate identity theft, and update itself as risks change.10eCFR. 16 CFR Part 681 – Identity Theft Rules
The FTC’s guidance groups red flags into five categories: alerts from reporting agencies (fraud alerts, credit freezes, notices from fraud detection services); suspicious documents (identification that appears altered, forged, or inconsistent with the applicant); suspicious personal information (address mismatches with credit reports, Social Security numbers flagged elsewhere, inconsistent documents); unusual account activity; and external notices from customers, law enforcement, or identity theft victims.
The program has to fit the dealership’s size, complexity, and account types. A small buy-here-pay-here lot’s program should not look identical to a multi-franchise group’s. What the FTC will not accept is no program at all.
Credit Contract Requirements
The Credit Practices Rule (16 CFR Part 444) bans several contract provisions the FTC treats as inherently unfair. You cannot include a confession of judgment clause that would let the lender take a default judgment without court proceedings. Irrevocable wage assignments are prohibited unless the assignment is revocable at will, is a payroll deduction plan set up at the time of the transaction, or applies only to wages already earned.11eCFR. 16 CFR Part 444 – Credit Practices The rule also restricts taking a security interest in household goods that are not the item purchased.
The Holder Rule (16 CFR Part 433) requires every consumer credit contract a dealership originates or accepts proceeds from to contain a specific notice in at least 10-point boldface type. The notice says any holder of the contract is subject to all claims and defenses the buyer could assert against the seller, with recovery capped at the amount the buyer has paid.12eCFR. 16 CFR 433.2 – Preservation of Consumers Claims and Defenses If a dealer sells a defective car and assigns the loan, the buyer can raise the complaint against the assignee. Leaving the notice out of a credit contract is itself a Section 5 violation.
Advertising and Credit Disclosures
Two sets of rules govern dealership advertising: Regulation Z’s trigger terms and the FTC’s general prohibition on deceptive practices.
Regulation Z (12 CFR 1026.24) works as a tripwire. If an ad mentions a specific down payment amount or percentage, the number of payments, the payment amount, or the finance charge, then the ad has to disclose the full credit terms: the down payment, the repayment terms reflecting the full loan (including any balloon payment), and the annual percentage rate using that exact phrase.13Consumer Financial Protection Bureau. 12 CFR 1026.24 – Advertising Advertising “$299/month” in large type with the APR and 72-month term buried in fine print is not permitted.
Beyond Regulation Z, the FTC enforces against deceptive pricing and hidden fees under Section 5. The CARS Rule (16 CFR Part 463), finalized in January 2024 to add specific disclosure and consent requirements for vehicle pricing and add-on products, was withdrawn by the FTC in February 2026 after a federal court challenge.14Regulations.gov. Revision of the Negative Option Rule, Withdrawal of the CARS Rule, Removal of the Non-Compete Rule To Conform These Rules to Federal Court Decisions The withdrawal does not legalize the underlying conduct. The FTC continues to bring cases against dealers that advertise prices they don’t honor, add undisclosed charges, or slip add-on products into deals without clear consumer consent. Bait-and-switch advertising remains a Section 5 violation whether or not any specific rule applies.
Adverse Action Notices for Credit Decisions
When you deny a credit application or offer less favorable terms based on information from a credit report, federal law requires an adverse action notice. The Equal Credit Opportunity Act and the Fair Credit Reporting Act both impose notice duties, and dealers that arrange financing have a specific role. For most closed-end auto loans, the notice must be provided before the consumer becomes contractually obligated.15Federal Trade Commission. What to Know About Adverse Action and Risk-Based Pricing Notices
The notice has to be in writing and include the specific reasons for the action (or a disclosure of the applicant’s right to request them), the name and address of any consumer reporting agency that supplied the report, and a statement of the consumer’s rights. Special rules let the dealer, rather than the lender, provide the notice in certain auto sale transactions. Dealerships under FTC jurisdiction should direct consumers to the FTC’s website for information about credit rights; the Consumer Financial Protection Bureau does not have enforcement authority over most auto dealers.
Telemarketing, Do Not Call, and Text Messaging
Dealers making outbound sales calls or sending marketing texts fall under the Telemarketing Sales Rule. Before making telemarketing calls, you must scrub your call lists against the National Do Not Call Registry using a version pulled within the previous 31 days.16Federal Trade Commission. Complying with the Telemarketing Sales Rule If a consumer tells your dealership specifically to stop calling, you have to honor it and maintain an internal do-not-call list whether or not the number is on the national registry.
An established business relationship creates a limited exception: you can call an existing customer whose number is on the registry unless that customer has asked you to stop. Written permission also provides a basis for calling. Calls must occur between 8 a.m. and 9 p.m. in the consumer’s local time zone, caller ID must display accurate information, and prerecorded messages require prior written consent along with an automated opt-out mechanism.
Text-message marketing adds another layer. Under the Telephone Consumer Protection Act, you must obtain prior express written consent before sending promotional texts. That consent has to disclose that the consumer will receive marketing messages, that message and data rates may apply, how often to expect messages, and how to opt out. Consent cannot be required as a condition of buying or financing a vehicle. Statutory damages accumulate per message, which is why TCPA cases regularly produce large settlements.
Penalties and Recent Enforcement
As of 2026, the maximum civil penalty for a knowing violation of an FTC rule or for violating a final FTC order is $53,088 per violation. Each affected consumer or each deceptive transaction can count as a separate violation.
Recent enforcement shows the rules are being applied. In April 2026, the FTC and the Maryland Attorney General secured an order against Lindsay Automotive Group for advertising deceptively low prices that most consumers could not actually receive, then loading deals with unwanted add-on products such as service plans and GAP protection that buyers had not agreed to purchase. More than $75 million in charges were identified as potentially eligible for consumer refunds, and the dealer group paid a $3.1 million civil penalty.17Federal Trade Commission. FTC, Maryland Attorney General Secure Full Refunds and Additional Penalties Against Lindsay Auto Group The consent order prohibits specific misrepresentations going forward, requires the dealer to disclose the total price excluding only required government charges, and mandates express informed consent before any charge.
FTC consent orders typically last 20 years and carry ongoing compliance monitoring, and the agency has pursued individual executives, not just corporate entities, in serious cases. For a dealership, the practical cost of noncompliance runs well beyond the penalty check.