The FTC Safeguards Rule Changed Everything.

What the FTC Safeguards Rule Actually Requires

The 2023 Update: What Changed

The FTC Safeguards Rule (16 CFR Part 314) governs how financial institutions protect customer information. Car dealerships are classified as financial institutions under the Gramm-Leach-Bliley Act (GLBA), which means the Rule applies directly to them.

The original 2003 rule required covered institutions to develop, implement, and maintain a comprehensive information security program. The 2023 update replaced that general obligation with specific, prescriptive requirements.

Key additions include: 

• mandatory multifactor authentication for systems accessing customer information
• required encryption of customer data both in transit and at rest
• annual penetration testing and vulnerability assessments
• a designated Qualified Individual responsible for overseeing the safeguards program
• a board-level reporting requirement for the above individual's findings

9 Key Elements and the Three That Matter Most for OEMs

In accordance with the Rule’s information security program, it must include nine required elements under section 314.4. Three of them are where many OEM dealer programs most commonly fail: 

Section 314.4(d) Access controls: Covered institutions must limit access to customer information to authorized users only, and must implement controls to identify, authenticate, and restrict that access.

Section 314.4(e) Data minimization: Institutions must collect only the customer information they need for a legitimate business purpose, and must limit who has access to it.

Section 314.4(f)(2) Vendor oversight: Institutions must oversee service providers by selecting and retaining vendors that maintain appropriate safeguards, requiring those safeguards by contract, and periodically assessing vendor compliance.

Of these three, Section 314.4(f)(2) is the most commonly misunderstood requirement. This is because OEMs and dealers often assume the vendor is responsible for their own compliance.
But, under this section, the OEM or dealer is responsible for verifying that the vendor is compliant and for having the contractual documentation to prove it. In order to do this, the FTC specifically added "periodical assessing" to the 2023 update to close the gap that existed in the original rule, where requiring safeguards by contract was considered sufficient. It is no longer sufficient.

The 5 Mistakes OEMs Are Still Making

Mistake 1: Treating Vendor Data Access as Self-Governing

What it looks like: The OEM has agreements with vendors stating that each vendor is responsible for their own compliance. The OEM considers this sufficient. Nobody at the OEM is actively verifying that vendors' safeguards are current or adequate.

Why it's non-compliant: Under Section 314.4(f)(2), covered institutions must not just require safeguards by contract. They must periodically assess vendor compliance. A contract that delegates responsibility without assessment does not satisfy the requirement. An OEM that relies solely on vendor self-attestation has not met its oversight obligation.

The fix: Establish a vendor review cycle. At minimum, collect annual written certification from each vendor confirming their safeguards program is current and compliant. For vendors with broad DMS access, conduct actual security assessments. Document every review with a timestamped record, because the documentation is what demonstrates compliance in an audit.

Mistake 2: No Standardized Dealer Consent Documentation Across the Network

What it looks like: Dealers handle vendor data access differently. Some have signed authorization forms on file. Some have verbal agreements. Some have unorganized email chains. The OEM doesn't know which dealers have formal documentation and which don't, and has no centralized way to find out.

Why it's non-compliant: Dealer consent must be explicit, documented, and auditable. Under Section 314.4(d), access to customer information must be controlled and tracked. "We have agreements in place" is not an audit trail. If a specific dealer's consent record cannot be produced in a regulatory review, that authorization effectively doesn't exist. Patchwork documentation across a dealer network is a systematic compliance gap, not a minor administrative issue.

The fix: Standardize consent collection across the dealer network using a governed workflow that captures a timestamped, field-level authorization record for every vendor-dealer connection. Whatever mechanism the OEM uses, the documentation must be uniform, centrally accessible, and updated when authorizations change.

Mistake 3: Legacy Vendor Integrations With No Current Authorization on File

What it looks like: A vendor has been connected to dealer DMS data for several years. The original authorization was obtained when the relationship started. Nobody has reviewed whether that authorization is still current, whether the consent record is properly documented, or whether the vendor's scope of access has grown beyond what was originally approved.

Why it's non-compliant: Authorization is not permanent. Under Section 314.4(f)(2), vendor oversight must be periodic, not a one-time review at onboarding. A vendor connection that began with proper authorization four years ago, with no subsequent review, may no longer satisfy the Rule's oversight requirements. The CDK Global breach in June 2024, which disrupted operations across approximately 15,000 dealerships, illustrated what happens when legacy vendor access accumulates without active governance: the number of connections, the scope of access, and the actual data being transmitted become impossible to audit or control at the point a problem occurs.

The fix: Audit all active vendor connections for current, properly documented authorization. Any connection without a recent authorization record should be suspended pending re-authorization. Going forward, set authorization expiration windows that automatically trigger periodic re-authorization reviews rather than leaving connections open-ended.

Mistake 4: Vendors Receiving More Than They Need

What it looks like: Vendors are receiving full customer data exports from the DMS when their product only requires a subset of fields. The broad access was set up at onboarding for convenience, or because nobody reviewed what the vendor's product actually needs to function. Nobody has revisited it since.

Why it's non-compliant: Section 314.4(e) requires that access to customer information be limited to authorized users and that the data collected be limited to what is needed for the legitimate business purpose. Providing a marketing platform with access to F&I transaction data, or giving a digital retailing tool access to employee records, is not limited access. It is a data minimization failure that creates unnecessary exposure for the dealer and the OEM. The more data a vendor has access to beyond their stated purpose, the greater the exposure in the event of a breach.

The fix: Audit field-level permissions for every vendor connection. Map what each vendor's product actually requires against what they currently receive. Restrict access to the minimum necessary for the stated purpose. This is a field-level permission change, not a contract renegotiation, but it requires an access platform that supports granular field-level control rather than all-or-nothing DMS access.

Mistake 5: No Process for Revoking Access When Vendor Relationships End

What it looks like: A vendor contract is terminated. Weeks or months later, the vendor's DMS access credentials are still active. Nobody flagged the access for revocation because there's no process connecting contract lifecycle management to access governance. The termination and the access revocation live in different systems owned by different teams.

Why it's non-compliant: Section 314.4(d) requires access controls that include a process for revoking access promptly when it is no longer needed. Terminated vendor access that remains active is not just non-compliant. It is an open exposure. In the context of a data breach or regulatory investigation, active credentials belonging to a terminated vendor are among the first gaps that surface, and one of the clearest signals that access governance is not functioning.

The fix: Connect vendor contract lifecycle to access governance. When a vendor relationship ends, access revocation must happen within a defined, short window. A centralized access management platform makes this immediate and automatic. Manual processes require an explicit checklist, a defined SLA, and an accountable owner who acts on it.

Why the DMS Access Layer Is the Highest-Risk Point

Where Enforcement Actions Concentrate

The FTC's enforcement focus in the automotive data space has consistently centered on access controls and vendor oversight, not general security policy failures. The CDK breach, while not an FTC enforcement action, illustrated the systemic risk at the DMS access layer: when vendor connections to dealer systems accumulate without active monitoring and governance, a single failure point can cascade across thousands of dealerships simultaneously.

The reason enforcement concentrates at this layer is straightforward. The DMS access layer is where customer data most frequently crosses organizational boundaries. Every time a vendor receives a DMS data feed, customer information leaves the dealer's direct control. How that transfer is governed, who authorized it, what fields were shared, when, and whether that authorization is still current, is precisely what compliance reviews focus on.

What a Compliant Access Layer Looks Like

A compliant DMS access layer has four characteristics. First, every vendor connection is authorized by an explicit, documented, field-level consent record. Second, access is scoped to the minimum data fields the vendor's product requires, not a full export. Third, every feed is logged and auditable, with a timestamped record of what was delivered, when, and to whom. Fourth, access can be modified or revoked immediately and the revocation is enforced at the platform level, not dependent on a vendor honoring a termination notice.

For a detailed walkthrough of how compliant dealer data access and permissions work in practice, including the full six-step vendor authorization workflow, see our companion guide.