How Dealers Protect Themselves in 2026: The Real Compliance Picture After the CARS Rule Died

I spent twenty years in automotive retail. I sold cars off faxed booksheets. I ran my own store for seven years. I have watched the FTC come for dealers more times than I can count, and I have watched dealers misread the threat almost every time.

2026 is one of those years.

The story most dealers are telling themselves is that the federal CARS Rule was vacated, the threat is over, and the compliance work of the last two years was wasted effort. That story is wrong in every direction. The CARS Rule is gone. The compliance burden is heavier than ever. The enforcement risk is not lower. It just shows up in different uniforms.

This is the post I wish someone had handed me when I was running my own store. What is actually true in 2026, and what to do about it before an auditor walks into your dealership.

What Happened to the CARS Rule

Short version. The Federal Trade Commission's Combating Auto Retail Scams Rule was supposed to take effect July 2024. NADA sued. The Fifth Circuit threw it out in January 2025 on a procedural error. The FTC did not appeal. In February 2026 the FTC formally withdrew the rule.

That is the part dealers know. Here is what they are missing.

The CARS Rule Was Never the Real Federal Threat

While dealers were focused on CARS, the FTC was quietly building its case under a different rule. The Safeguards Rule. It is part of the Gramm-Leach-Bliley Act. It has been on the books since 2003. It got a major rewrite in 2021 that took effect in June 2023.

It applies to dealers because dealers handle credit applications, which makes them financial institutions under the law. There is no size exemption. A single-rooftop used car store and a forty-rooftop new car group are held to the same standard.

What changed in 2026 is not the rule. It is the FTC's posture. The agency is done writing rules. It is done extending deadlines. It is done issuing polite guidance documents. It is enforcing. Penalty exposure runs to roughly $43,000 per violation per day. A single audit can produce findings on multiple controls, each treated as a separate violation, each accruing daily.

The dealers getting hit in 2026 are the ones who treated the 2023 compliance deadline as something to satisfy and then move on from. The ones who are fine treated it as the start of a new operating posture.

What the Safeguards Rule Actually Wants From You

I have walked into stores where five sales managers share one DMS login. Where the F&I director has root access to the entire customer database because nobody figured out role-based permissions. Where the incident response plan is a Word document nobody has opened since 2019.

That is the kind of thing that ends a dealership in a Safeguards Rule audit.

The rule wants seven things, in order of how likely they are to get flagged.

Multi-factor authentication on every system that touches customer credit data. This is the single most common audit finding. If your DMS, your CRM, or your F&I platform lets anyone log in with just a password, you have a problem that will get found on day one.

A written information security program. Current. Reviewed in the last twelve months. Signed by ownership. Tied to a real risk assessment of your store, not a checklist your IT vendor filled out.

A named qualified individual. A real person with real authority, not the junior IT guy with no budget. The FTC wants to know who they are and what they can actually do.

Encryption. Customer data encrypted in transit and at rest. Old DMS deployments with unencrypted database backups sitting on a server in the back office are a recurring failure point.

Role-based access. The salesperson does not need the F&I director's permissions. The lot porter does not need access to credit applications. The rule expects each user to have only the access they need to do their job.

Vendor oversight. Every vendor touching customer data, your DMS, your CRM, your digital retailing platform, your online credit app provider, needs to demonstrate equivalent security. Saying "the vendor handles it" is not a defense.

An incident response plan that actually works. Documented. Tested. The FTC is now asking dealers to prove the plan works, not just that it exists on paper. A tabletop exercise run twice a year is the minimum.

And one more thing. Since May 2024 you have to notify the FTC within 30 days of discovering a breach involving unencrypted information of 500 or more consumers. Notifications at that scale are public. The reputational damage hits before the penalty does.

The States Are Picking Up Where the FTC Stopped

The federal CARS Rule died. The state versions are filling the gap. Several have already passed.

California signed its CARS Act into law in October 2025. It takes effect October 1, 2026. It does most of what the federal rule would have done. Total price disclosure in advertising. Add-ons disclosed as optional in writing before the customer signs. A ban on charging for products that provide no benefit, including nitrogen tire fills below 95% purity, surface protection that voids the paint warranty, and oil changes for electric vehicles. A three-day cooling-off period for used car purchases.

Colorado, Connecticut, Maryland, Pennsylvania, and Virginia are moving on similar legislation. If you operate in more than one state, your advertising template, your add-on disclosure language, and your cooling-off policies all have to be state-aware. A single template will not satisfy all of them.

State Attorneys General Are the New Federal Enforcers

While the federal CARS Rule was being litigated, state AGs were getting active. In April 2026 the Lindsay Automotive Group settled for around $78 million in consumer redress and penalties for deceptive pricing and unwanted add-ons. That settlement was state-driven, not federal.

State AGs are pursuing the same conduct the CARS Rule would have banned, under state consumer protection laws that have been on the books for decades. The conduct that would have been illegal under the federal rule is still illegal under state law in most states. You did not get a free pass when the Fifth Circuit threw the rule out. You got a venue change.

The Add-On Floor Is Where Most Dealers Will Get Caught

If I had to pick the one practice creating the most enforcement risk in 2026, it would be how add-ons get sold. State AGs are looking for three patterns.

Payment packing. Quoting a payment that includes optional add-ons without disclosing they are optional. The customer thinks the payment is the cost of the car. It is the cost of the car plus everything you loaded on top.

Junk fees. Mandatory fees that are not actually mandatory. Document prep fees, processing fees, dealer fees that were not in the advertised price.

Add-ons that provide no benefit. The nitrogen tire fill that is not actually nitrogen. The surface protection that voids the manufacturer warranty. The service contract on a vehicle already under factory warranty for the same coverage. The VIN etching at $400 that costs $40 in materials.

When an enforcement action lands at your store, these are the practices the regulators look at first. If your F&I director cannot explain in writing why every add-on you sell provides measurable benefit at the price you charge for it, you have a problem.

What CFPB Is Doing to You Indirectly

The Consumer Financial Protection Bureau does not regulate dealers directly. It regulates lenders. That separation matters less than you think.

When CFPB hits a lender, the lender tightens its dealer agreements. Suddenly you are operating under deal-by-deal compliance terms you did not sign up for. If your F&I margins look unusual, your lender's compliance team will notice before any regulator does.

I have watched dealers lose lender relationships over F&I patterns the lender saw and did not like. Once a lender drops you, getting another is harder than getting the first one was.

Seven Things to Do This Quarter

This is the operator action list. Not the legal checklist. The order matters. Do them in order.

One. Close the MFA gap.

If multi-factor authentication is not enforced on every system that touches credit data, fix that this quarter. Most modern DMS, CRM, and F&I platforms support it natively. If yours does not, that is a vendor conversation, and it should happen this week. Document the rollout. Document any exceptions. Document the verification that MFA is actually enforced, not just configured in a settings panel.

Two. Get a real risk assessment done.

Not a checklist. A documented assessment that identifies where customer data lives in your store, who accesses it, what threats apply to your specific environment, and what controls you have in place. Signed by your qualified individual. Reviewed by ownership. Updated annually.

If you have not had one done in the last twelve months, you do not have a current information security program. You have a paper one.

Three. Audit your vendors.

Pull the list of every vendor that touches customer financial data. DMS. CRM. F&I platform. Online credit application provider. Digital retailing. Marketing platforms with consumer data. For each one, document what they access, what security they have in place, and what their contract obligates them to do.

If a vendor cannot produce a SOC 2 report or equivalent, that is a problem you need to surface now, not when the FTC asks for it.

Four. Tabletop your incident response plan.

Pick a Tuesday. Get the leadership team in a room for two hours. Run a hypothetical breach. Walk through who calls whom, who decides on the FTC notification, who talks to customers, who talks to lenders, who talks to insurance. Find the gaps. Fix them.

An imperfect tabletop is better than no tabletop. The FTC in 2026 is asking dealers to prove the plan works, not just that it exists.

Five. Clean up the F&I floor.

Review your add-on disclosure language. Three questions. Is the optional nature of every add-on disclosed in writing before the customer signs? Are you charging for any product that does not provide measurable benefit at the price charged? Is the advertised price in your ads the price the customer actually pays before government fees and optional products?

If any answer is uncertain, you have a risk that will only grow as state CARS Acts take effect.

Six. Map your state exposure.

If you operate in California, the October 1, 2026, deadline is real. Your form provider's updates may not arrive in time to do everything you need on their own. Start the readiness work now. If you operate in multiple states, build a matrix of which CARS-style requirements apply where. Your advertising and your add-on language need to be state-aware.

Seven. Document everything.

In a Safeguards Rule audit or a state AG investigation, the difference between "we are doing the right thing" and "we cannot prove we are doing the right thing" is whether you have records. Policies signed by ownership. Training completion logs. Tabletop exercise results. MFA enforcement screenshots. Vendor attestations.

The dealers who survive audits in 2026 are not the ones with the most expensive compliance programs. They are the ones who can produce documentation for every control the rule requires within forty-eight hours of being asked.

The Mindset Shift

Compliance in this environment is not a project. It is an operating function. Same as service. Same as F&I. Same as sales. It needs an owner, a budget, a rhythm, and a measurement. Most stores do not have any of that.

The good news is none of the controls the Safeguards Rule requires are exotic. They are the same controls that protect the dealership from ransomware, from the data breach that costs you your lender relationships, from the reputational damage of a public breach notification. The compliance work is also the business protection work.

If I were running a store today, I would treat the next ninety days as a compliance sprint. MFA closed. Risk assessment refreshed. Vendor list audited. Tabletop done. F&I floor reviewed. State exposure mapped. Documentation tight enough that if an investigator walked in tomorrow, the records would be ready before lunch.

And I would stop telling myself that the CARS Rule going away means the threat went away. The threat moved. It is still here. It just shows up in different uniforms.

Structure before tools. Strategy before speed. Systems before scale.

The AI Operator Framework is the methodology for designing, governing, and scaling AI operations inside a business, including the data governance and compliance layers most dealerships skip. Explore the full framework at JamilAshkar.com/framework. Start with the free course at JamilAshkar.com/course.