GLBA and dealership data

Under the Gramm-Leach-Bliley Act, a dealer may not share a customer's nonpublic personal information from financing with a non-affiliated company without notice and a chance to opt out. An AI data buyer is a non-affiliated company, so F&I records stay out of any deal. Service, CRM and process records can still be licensed once identities are removed.

Why does GLBA cover a dealership at all?

Because arranging financing or leasing is a financial activity under the Act, whatever else the business does.

The Gramm-Leach-Bliley Act (GLBA) was written for banks, but its privacy rules reach any business "significantly engaged" in financial activities. A dealership that takes a customer's application and arranges financing through a lender, or offers leases, is one of them for the information collected in that process.

That information is "nonpublic personal information" (NPI): what the customer tells you to get financing, what you learn from the transaction, and lists derived from it. Social Security numbers, income, employer, account details and the terms of the deal all sit here. So does the simple fact that a named person bought a car with financing through your store.

Section 502 of the Act (15 U.S.C. 6802) bars sharing NPI with a non-affiliated third party unless the customer received a privacy notice and a reasonable chance to opt out, or a listed exception applies. The exceptions cover things like servicing the customer's own transaction and complying with law. Licensing deal files to a company that trains AI models is not one of them.

A second rule sits alongside it. The FTC Safeguards Rule (16 CFR Part 314) requires covered businesses to keep a written information security program. An export of customer files sent to an outside buyer is exactly the kind of event that program has to control.

Where is the line inside a dealership?

A practical split most dealer counsel would recognize. It is general guidance, not legal advice for your store.

GLBA line by departmentBefore any contract review

Department	Typical records	GLBA status	For an AI data deal
F&I office	Deal jackets, applications, contracts, menu presentations, product sales	NPI	Leave out entirely
Sales floor and CRM	Leads, follow-ups, appointment outcomes, desk notes	Mixed	Possible after identities and any F&I detail are removed
Service drive	Repair orders, labor operations, technician notes, inspections	Usually outside GLBA	The strongest candidate; strip customer and VIN details
Parts and inventory	Parts sales, stock levels, vehicle inventory and pricing	Outside GLBA	Possible; check DMS and OEM terms
Operations	SOPs, service menus, training material, BDC scripts	Outside GLBA	Possible; remove employee names

"Mixed" means a CRM often holds notes copied from the F&I office or desking. Search those fields before anything is exported.

What should a dealer do before talking to a buyer?

Decide the boundary in writing. "Nothing from F&I, nothing with a customer identity" is short enough for every manager to follow.
Find the stray copies. CRM notes, scanned documents attached to service records and email threads are where NPI turns up outside the F&I office.
Read your own privacy notice. It tells customers what you share and with whom. A deal should not contradict it.
Scrub it yourself first. The buyers on this site all promise de-identification, Scale AI on your own servers. Run your own pass regardless: the customers, and the liability, are yours.
Have your lawyer read the agreement. Look for who is responsible if identifiable data turns up later, and what the buyer may do with it.

Then check the other contracts that decide what you may export: the DMS agreement first. If you want to know which buyers your store fits once F&I is set aside, the eligibility check compares their published rules.

Sources behind these numbers

GLBA questions from dealers

Does GLBA apply to car dealers?

It applies to a dealer that arranges financing or leasing for customers, because that activity makes the dealer a financial institution under the Act for the information it collects. That covers most stores with an F&I office.

Is a repair order covered by GLBA?

A repair order on its own is service information, not information collected to arrange financing. But it carries the customer’s name and contact details, and other state privacy laws and your own privacy notice still apply. Remove identities either way.

Can we just add AI licensing to our privacy notice?

Changing a notice affects future customers and carries its own opt-out duties. It is a question for your lawyer. The simpler route, and the one this site recommends, is to leave F&I material out.

Does de-identification take data outside GLBA?

That depends on how thoroughly it is done and on legal analysis we cannot give. The safer course for a dealer is to keep F&I records out entirely rather than rely on de-identifying them.

Who enforces this for dealers?

The Federal Trade Commission enforces the GLBA privacy and safeguards rules for most auto dealers. State attorneys general enforce state privacy laws on top.