The FTC Safeguards Rule, enforced by the Federal Trade Commission (FTC), imposes requirements on certain businesses to protect the security and confidentiality of customer information.
While the rule is not specifically targeted at car dealerships, dealerships are subject to its provisions and specific obligations when they collect and maintain sensitive customer information. Informativ’s compliance technology proactively enforces the physical and administrative requirements of the FTC Safeguard Rule.
Recently, the Federal Trade Commission (FTC) released updated Frequently Asked Questions (FAQ) to the FTC Safeguards Rule. These updates provide crucial clarity for auto dealers—especially around breach reporting, customer information, service provider oversight, and data retention.
Below are the six most important updates dealers need to know, followed by a refresher on the Safeguards Rule itself.
Six FTC Updates for Auto Dealers To Know in 2025
1. Breach Reporting Requirements Now in Effect
The FTC’s breach reporting requirement went live in May 2024, following the 2023 amendments to the Safeguards Rule.
Dealers must notify the FTC within 30 days if a “notification event” occurs. This includes:
- A breach involving 500+ consumers’ unencrypted data, or
- Encrypted data if the encryption key was accessed.
Important: The FTC presumes unauthorized access = unauthorized acquisition unless proven otherwise.
The FAQs clarify what qualifies as a reportable event, giving dealers much-needed guidance on compliance.
2. Clearer Definition of “Customer Information”
The FAQs provided sharper examples of what is covered—and not covered—under the Safeguards Rule.
Covered:
- Applications.
- Spreadsheets of financed/leased customers.
- Financial information tied to financing.
Not Covered:
- Service/maintenance records.
- General sales data.
- Names/addresses from all customers (unless tied to financing).
New clarification: If financing data is commingled with other data, the entire dataset must be safeguarded.
3. Privacy Rule vs. Safeguards Rule: Two Separate Obligations
The FAQs draw a stronger distinction between the Privacy Rule and the Safeguards Rule:
- Privacy Rule → Governs collection and sharing (notice & opt-out requirements).
- Safeguards Rule → Governs protection (written security program & safeguards).
Key takeaway: Compliance with one does not equal compliance with the other. Dealers must address both obligations separately.
4. Clarifications on OEMs and Service Providers
The update clarified who is and isn’t a service provider under the Safeguards Rule.
- Not a service provider: An OEM receiving recall information.
- Dealers’ obligation: Oversight applies only to service providers who access customer financial data.
This clarification helps dealers understand the limits of their responsibility.
5. Service Provider Oversight: Three-Part Obligation
The FAQs also made service provider obligations more explicit. Dealers must:
- Select providers capable of safeguarding customer information.
- Require contracts that obligate providers to protect data.
- Periodically assess providers’ safeguards.
Note: Dealers don’t have to force vendors to adopt all 10 Safeguards Rule elements—just ensure protections are adequate for the risk level.
6. Continuing Relationships & Data Retention
The FTC clarified that obligations don’t end just because a dealer sells the loan paper.
- If you arrange a loan—even if you don’t hold it—you maintain a continuing relationship and must safeguard that customer’s info.
- Even after the customer relationship ends, info must be protected until it’s securely disposed of.
- Secure disposal when data is no longer needed is emphasized.
A Quick Refresher on The FTC Safeguards Rule
What It Is and Why It Matters
- Requires financial institutions (including most auto dealers) to protect customer information.
- Originally issued in 2003, amended in 2021 for technology updates, and in 2023 to add breach reporting.
- Bottom line: Dealers are held to the same standards as banks or credit unions for safeguarding consumer data.
Who Is Covered?
Dealers are considered “financial institutions” if they:
- Finance or facilitate financing for consumers, or
- Lease vehicles for more than 90 days.
It’s not about your title—it’s about what you do.
What Dealers Must Do
The Safeguards Rule requires a written information security program with:
- Administrative, technical, and physical safeguards (e.g., MFA, encryption, locked file storage).
- Regular monitoring, testing, and updating.
- Secure disposal of customer data.
Think of it as governing:
- How you collect and store customer info.
- How you share it with others.
- How you securely dispose of it.
Enforcement and Penalties
- First violation: No civil penalties, but the FTC can mandate safeguards.
- Subsequent violations: Civil penalties may apply.
- States may impose additional requirements.
- Section 5 of the FTC Act also prohibits “unfair” practices, including poor data security.
Practical Best Practices for Dealers
The FTC emphasized compliance “musts”:
- Inventory your data and know where it’s stored.
- Segment data to reduce commingling risks.
- Use MFA and encryption.
- Review vendor contracts for written security obligations.
- Dispose of unneeded data securely.
- Stay current with FTC FAQs and guidance.
Key Takeaways
The FTC’s FAQ updates give dealers clarity on:
- Breach reporting obligations.
- What counts as customer information.
- Oversight of service providers.
- Continuing responsibilities for loan and data retention.
Dealers who stay proactive not only avoid penalties but also build trust with consumers—a competitive edge in today’s market.
Next Steps for Dealers
- Review your written information security program.
- Confirm service provider contracts align with Safeguards obligations.
- Train staff on data security practices.
- Establish a tech-enforced compliance process.
- Bookmark the FTC’s FAQ page and check regularly for updates.
You can explore more about how Informativ’s compliance technology proactively enforces the requirements of the FTC Safeguard Rule and protects dealerships from fines!