GLBA and dealership data: what can never be shared?

A dealer principal who gets an email from an AI training-data company usually asks two questions in the same breath: what would they pay, and am I allowed? The second one has a firm answer for one part of the store. The Gramm-Leach-Bliley Act draws a line around the F&I office, and no data deal should cross it.

Why a car dealer is covered

GLBA privacy rules apply to businesses engaged in financial activities, not only banks. Arranging financing or a lease for a customer counts. For the information a store collects while doing that, it is treated as a financial institution, and the Federal Trade Commission enforces the rules for most dealers.

The protected category is nonpublic personal information, usually shortened to NPI. Think of everything a customer handed over to get approved, plus what the transaction itself reveals: Social Security number, income, employer, the lender, the payment, the products sold in the F&I office. Even a list of customers who financed through you is NPI.

The rule in one sentence

Section 502 of the Act, at 15 U.S.C. 6802, says NPI may not be disclosed to a non-affiliated third party unless the customer got a privacy notice and a reasonable chance to opt out, or a listed exception applies.

An AI data buyer is a non-affiliated third party. Selling or licensing deal files to it is not one of the exceptions, which cover things such as processing the customer’s own transaction or complying with law. Your existing privacy notice was not written with model training in mind. So the practical answer is short: F&I records never go into the deal.

What can never be shared, and what can

Record	Where it lives	Can it go into an AI data deal?
Deal jackets, applications, contracts	F&I, DMS deal module	Never
F&I product sales and menus by customer	F&I, menu software	Never
Copies of licenses, insurance cards, pay stubs	Scanned into DMS or CRM	Never
CRM lead and follow-up history	CRM	Yes, once identities and any F&I notes are removed
Repair orders	DMS service	Yes, once customer details and VINs are removed
Parts and vehicle inventory history	DMS	Yes, subject to DMS and OEM terms
SOPs, menus, scripts, training material	Shared drives	Yes, once employee names are removed

The “never” rows are not a judgment call about risk. They are the records GLBA was written to protect.

Where NPI turns up in the rest of the store

The hard part is not the F&I office. It is everywhere F&I information gets copied.

CRM notes

Salespeople and desk managers type notes like “approved at 6.9, wants lower payment” into the CRM. That single line carries NPI into a system you might otherwise license. Search free-text fields for lender names, rates and payment amounts before any export.

Scanned documents

Many stores scan the driver’s license and insurance card into the customer record, and some attach them to service tickets too. Attachments should be excluded from any extract by default.

Email and shared drives

Buyers such as Scale AI list email threads and documents among the records they take. A dealership’s inbox is full of deal paperwork. If email is ever in scope, the F&I mailboxes are not.

The second rule: safeguards

GLBA also has a security side. The FTC Safeguards Rule, 16 CFR Part 314, requires covered businesses to run a written information security program. A bulk export that leaves the building is precisely the event that program has to govern: who approves it, what is in it, how it travels and who checks it afterward.

What the buyers themselves say

The buyers’ own pages point the same way. Scale AI scrubs records on the seller’s systems before extraction and lists employee and customer identities among the things it will not take. Nyne promises de-identification before any release. Useful, but your obligation does not transfer to them. You remain the business that collected the information, so do your own pass first.

A dealer’s working rule

Write this down and give it to every manager who might touch an export:

1. Nothing from the F&I office, in any form.
2. Nothing that still identifies a customer or an employee.
3. No attachments or scanned documents.
4. A second person checks the export before it leaves.

With those four lines in place, the records that remain (repair orders, CRM activity with the names stripped, inventory history and your operating documents) are what buyers are actually asking for. For the buyers, their posted rules and the published ranges in one place, start with the overview at sell dealership data, and the service repair orders guide goes through the most valuable records field by field.

None of this is legal advice; your own counsel should read the agreement and your privacy notice before anything is signed. The F&I office can stay exactly as it is, and the deal can still happen without it.