FTC Safeguards - what we know thus far

[Alex Snyder]

TLDR:

1. nobody knows every specific of a new government rule - specifics should later come out of court cases
2. document everything - have a written document showing how you are trying to comply just in case the FTC knocks on your door

---

DealerRefresh has been working to educate dealers and vendors on the FTC Safeguards and Gramm-Leach-Bliley Act. We have worked with NADA and NIADA on this. We have spoken to consultants (including Tom Kline) and attorneys who help businesses create a definition for their own interpretation of these changes.

There are a lot of misinformed people out there. In our last RefreshFriday with Tom Kline, we rated the readiness of the automotive industry, and on a scale of 1-10, we rated our industry a 3.

I have encountered dealerships who thought they would have to eliminate all their vendors. Others believe they can't quote a customer a price or payment anymore or show pricing on their website. This thread is an attempt at curbing this kind of fear.

Here are some simple ways to get started on documenting how you plan to comply with these new rules:

• Identify all the places you show a price or payment.
• Identify where you collect or farm a customer's email address, phone number, and/or physical address.
• If an outside vendor is involved with any of those places, contact the vendor for a written explanation of their plan for complying with the FTC changes and hold onto all those responses.
• If you are the one hosting one of those forms or calculating and showing price/payment, you will need to come up with your own interpretation of the FTC rules and develop a plan to comply.
• If your sales agents talk about pricing or collect customer information, you will need to come up with your own interpretation of the FTC rules and develop a plan to comply.

The name of the game is identifying what areas might be subject to these new rule changes and planning how and when you think you can comply based on your interpretations of these rules today.

I fully anticipate specific definitions will be made through legal battles. If you are the subject of that, you're going to get familiar with things quickly. But it is hard to punish someone who is making an effort to comply... hence, the identifying and planning.

Here are more resources to help you:

A Dealer Guide to the FTC Safeguards Rule - Download PDF

Dan Sayer shares a comprehensive FTC Safeguards Rule compliance guide ahead of the December deadline, prompting discussion among dealers about implementation strategies—whether to hire external compliance vendors like ComplyAuto or handle it in-house with skilled IT teams. The thread reveals...

forum.dealerrefresh.com

The end of ADF via Email is upon us

DealerFire announced it will stop sending leads via email after June 9, 2023, requiring vendors to use SFTP instead for GLBA compliance—though the announcement raised concerns about the actual security of the transition and why other vendors haven't made similar moves. The thread reveals...

forum.dealerrefresh.com

Upcoming (December) FTC Regulations

Automotive industry professionals discuss upcoming December FTC regulations that will require data encryption both in transit and at rest, with particular concern about how these requirements affect CRM vendors and the ADF/XML lead transmission process commonly used in dealerships. Key insight...

forum.dealerrefresh.com

PR & News - FTC Proposed Rules for Dealers’ websites, F&I offices

The FTC has proposed new regulations that would ban F&I and vehicle add-on products deemed to provide "no benefit," require dealers to list prices online, and expand disclosure requirements—measures the industry views as restrictive and burdensome. Key concerns raised include stricter...

forum.dealerrefresh.com

 

[Ryan Everson]

What's everyone's opinion on whether a website cookie consent banner / popup is required?

Complyauto is pressuring dealers to install one. But it seems to be more of a thing necessary in Europe and the wonderful state of California.

It reminds me of the $300 /mo ADA AudioEye icon that no one uses, but everyone has to prevent scummy ambulance-chasing lawyers from suing us.

But there's a big difference - having AudioEye doesn't really hurt us.

Requiring users to opt-in to cookies does hurt us:

• Negatively impacts website conversion rate (popup = bad / annoying)
• Makes our online advertising less effective / more expensive
• Limits reporting and attribution capabilities
• Restricts the ability to do retargeting ads

So it would definitely cost us real $ and sales to install the banner popup that no one seems to know whether it's actually required or not.

I don't believe the FTC would ever go after a dealer solely over their cookie policy, BUT it is possible that something else could trigger an FTC investigation over more unscrupulous F&I or data safeguard practices, and then the investigation could spread over into the cookie realm.