FTC SAFEGUARDS GUIDE

FTC Safeguards Rule for auto dealers: what compliant document delivery looks like for credit apps, deal jackets, and IDs.

A dealership that arranges financing is a financial institution under federal law, and every credit application, driver's license image, pay stub, and signed contract it moves is customer information under the Safeguards Rule. This guide covers what 16 CFR Part 314 requires when those documents leave the store, why email and text keep failing it, and what a compliant channel looks like.

All guides → What is Secure Digital Transport? →

Why dealerships are covered and what counts as customer information

The FTC Safeguards Rule, 16 CFR Part 314, applies to financial institutions under FTC jurisdiction, and the FTC has been explicit that automobile dealers that extend credit or arrange financing are financial institutions. The amended rule's compliance date was June 9, 2023; the breach notification amendment took effect May 13, 2024. Customer information is any record containing nonpublic personal information about a customer, in any form, handled by the dealer or its affiliates and service providers. A credit application, a driver's license photo, a Social Security number on a buyer's order, a pay stub, a bank statement, and a signed retail installment contract all qualify.

The requirements that apply when a document moves

Encryption, 314.4(c)(3). Encrypt all customer information in transit over external networks and at rest. Where encryption is infeasible, the Qualified Individual must approve effective alternative controls in writing. A credit app leaving the store by email is in transit over an external network. Access controls, 314.4(c)(1). Limit access to authorized users and to the information they need. For a document, that means only the intended lender, customer, or vendor can open it. Multi-factor authentication, 314.4(c)(5). Required for any individual accessing any information system containing customer information. A customer-facing portal holding deal documents is such a system. Data retention and disposal, 314.4(c)(6). Securely dispose of customer information no later than two years after last use for the customer relationship unless retention is required or a legitimate business purpose exists. Copies in sent folders, texting apps, and personal phones are copies on a two-year clock nobody is watching. Monitoring and logging, 314.4(c)(8). Log authorized user activity and detect unauthorized access or use. The question an auditor asks about a document is who received it, when, and who else. Service providers, 314.4(f). Select providers capable of maintaining appropriate safeguards, require them by contract, and assess them periodically. Any vendor that transmits deal documents for the store is in scope. Breach notification, 314.4(j) and 314.5. Notify the FTC as soon as possible and no later than 30 days after discovering a notification event involving unencrypted customer information of at least 500 consumers. Encryption is the difference between an incident and a reportable event.

Why the dealership document flow keeps failing the rule

The store's workflow was built for speed: the salesperson photographs the license and texts it to the desk, F&I emails the credit app to three lenders, the deal jacket is scanned to email for the lender's funding package, and the customer's proof of income arrives as a photo in a text thread. Every one of those is customer information in transit over an external network, and none of it is encrypted the whole way. Text and consumer messaging apps store the image on two phones and a carrier. Email delivers hop by hop and persists the attachment in every mailbox and backup. The copier sends the scan as an SMTP attachment with a mail credential stored on the device. None of it produces a record of who opened what. That is four 314.4 clauses at once, on every deal.

Why a customer portal does not fix it

A portal encrypts at rest and logs access, and it requires the customer to create an account and, under 314.4(c)(5), get through MFA, in the middle of buying a car. Adoption is poor, the documents arrive by text instead, and the store now governs a credentialed system full of consumer financial data that it must protect and eventually dispose of. For dealer-to-lender traffic, portals multiply: every lender has its own, and the F&I manager falls back to email.

What compliant document delivery looks like in a dealership

A transport that satisfies the rule looks like this: the sender's system creates a one-time encrypted delivery for a named recipient; the recipient opens it from a notification with no account, password, or app; the document is encrypted from pickup to delivery and the encrypted container is destroyed once delivered, so nothing persists on a relay, in an inbox, or in a backup; and every pickup is logged per document with who, when, and from where. That is the Secure Digital Transport model, and it is the control, not a workaround. The practical walkthrough is in how to send sensitive documents without a portal.

Mapped to 314.4: encryption from pickup to delivery meets (c)(3) in transit and at rest with no fail-open hop; a delivery bound to one recipient, with identity verification at open for ID documents, meets (c)(1) and avoids building a customer credential base that (c)(5) would have to govern; destruction of the container after delivery means no stray copy on a phone, a relay, or a backup for (c)(6); and the per-document access log is the (c)(8) evidence and the basis for a 30-day breach determination. For collection, the customer drops a pay stub or license photo into a one-time request from their own phone with no app and no account, which is where portals lose them.

Where this runs in auto retail today

SecureMyDealer is the dealership product built on this transport for customer documents, deal jackets, and lender packages, used by dealership groups selling the most well-known automotive brands. ID Verify adds identity capture and document authenticity checks at the moment a delivery opens, and SecureMFP replaces scan-to-email on the store's copiers so a scanned deal jacket never leaves as an attachment. Dealer management and compliance platforms can embed the same transport through the SDT Engine.

Frequently asked questions

Does the FTC Safeguards Rule apply to car dealerships?

Yes. The FTC treats automobile dealers that extend credit or arrange financing as financial institutions under 16 CFR Part 314. The amended rule has applied in full since June 9, 2023, and the breach notification requirement since May 13, 2024.

Can a dealership email or text a credit application or driver's license?

Not compliantly as normally done. Section 314.4(c)(3) requires encryption of customer information in transit over external networks and at rest. Standard email is hop-by-hop and fails open, text and messaging apps store the image on multiple devices and with the carrier, and neither produces a record of who accessed the document. Each is a finding in a Safeguards audit.

Does the Safeguards Rule require a customer portal?

No. It requires outcomes: encryption, access control, MFA on information systems holding customer information, retention discipline, logging, and vendor oversight. A portal is one path and it fails on adoption in a sales process. A transport that sends and collects documents without a customer account meets the same requirements without creating a credential base the store must protect.

What is the breach notification requirement for dealers?

Since May 13, 2024, a dealer must notify the FTC no later than 30 days after discovering a notification event in which unencrypted customer information of at least 500 consumers was acquired without authorization. Encrypted information is excluded, which makes encryption the whole way the difference between an incident and a federal filing.

What does FTC Safeguards compliant document delivery look like?

The document is encrypted from pickup to delivery, access is bound to the intended lender, customer, or vendor with identity verification where warranted, the encrypted container is destroyed after delivery so no copy persists on phones or servers, and every pickup is logged per document. Secure Digital Transport is the category built on that model and is what SecureMyDealer runs on.