1.4 Privacy Disclosure Rules

As a vehicle dealer, you collect a tremendous amount of personal information from your customers — names, addresses, Social Security numbers, dates of birth, driver’s license numbers, employment information, income data for financing. You are a custodian of some of the most sensitive data your customers possess. That makes you subject to significant privacy laws that you must understand and comply with.
The two primary privacy frameworks that apply to you as a dealer are the California Consumer Privacy Act — the CCPA, as amended by the CPRA — and the federal Gramm-Leach-Bliley Act, known as GLBA. Let’s take them one at a time.
The CCPA gives California consumers specific rights regarding their personal information. They have the right to know what personal data you’re collecting about them and why. They have the right to request deletion of their personal information. They have the right to opt out of the sale of their personal information to third parties. And they have the right not to be discriminated against for exercising these rights. As a dealer, you need to have a privacy policy posted — typically on your website and available in your dealership — that explains your data collection and sharing practices in plain language.
Now, the Gramm-Leach-Bliley Act applies to you specifically because of your involvement in consumer financing. When you arrange financing for a customer — when you act as the intermediary between the buyer and a lender — you are functioning as a financial institution under GLBA. That triggers obligations to provide your customers with a privacy notice that explains what nonpublic personal information you collect, how you use it, and with whom you share it. The customer must receive this notice at the time the customer relationship is established, and annually thereafter if the relationship continues.

💡 Real-World Example
A dealership in Sacramento shared its customer database — including names, addresses, phone numbers, and vehicle purchase information — with a local aftermarket accessories company in exchange for referral fees. They never disclosed this practice to customers and never offered an opt-out. When customers complained to the Attorney General’s office, the dealership faced enforcement action under both CCPA and GLBA. The cost of the fines and legal fees far exceeded any referral income the dealer had earned.

Here’s what this means for your day-to-day operations: you need to protect customer deal jackets and financial documents. You need to shred or securely destroy documents containing personal information when you no longer need them. You need to limit access to customer data to employees who need it. And if you experience a data breach — if customer information is compromised — you may have obligations to notify affected individuals under California’s data breach notification law, Civil Code Section 1798.82. The bottom line: treat your customers’ personal information as if it were your own.