Is ADF XML Still GLBA Compliant in 2026?
ADF XML is not GLBA-compliant in 2026 when used as designed. The standard transports consumer financial data, including contact details and purchase intent, over plaintext SMTP email with no required encryption. The Gramm-Leach-Bliley Act amendments that took effect in 2022 require dealers to protect consumer financial information with reasonable safeguards, including encryption in transit. Plaintext email transport does not meet that standard. Every dealer running ADF-over-email today is exposed to compliance risk that did not exist in 2000 and is enforceable now.
I have written this piece because the automotive industry has been quietly avoiding this question for four years. The compliance risk is real. The fix is not complicated. The longer the industry waits, the more enforcement actions are going to surface.
What Does GLBA Actually Require?
The Gramm-Leach-Bliley Act (15 U.S.C. 6801 through 6809) governs how financial institutions, including automotive dealerships under the FTC Safeguards Rule, protect consumer financial information. The 2022 amendments to the Safeguards Rule expanded what counts as a covered institution and tightened the safeguards required.
Three obligations matter here.
One. Encryption in transit. Customer information must be encrypted when transmitted over external networks and at rest. Email is an external network. Plaintext email transport does not meet the requirement.
Two. Access controls. Only authorized personnel can access customer financial information. Email leaves copies on every server the message passes through. Access control is fundamentally weak.
Three. Logging and monitoring. Covered institutions must monitor and log access to consumer information for audit purposes. SMTP email does not provide reliable audit trails.
The standard is not vague. The enforcement is becoming less vague every year.
Why Is ADF XML Non-Compliant by Default?
Because ADF was designed in 2000, before GLBA Safeguards Rule existed in its current form. The original specification assumes plaintext SMTP. Most CRM vendors built their ADF parsers around the email assumption. The downstream effect is that the lead data, which often includes financial readiness signals and contact information, moves across the internet unencrypted.
Two specific problems.
Problem one. SMTP is unencrypted by default. TLS is available as an extension, but not all SMTP servers enforce it, and intermediate relays may downgrade encrypted traffic. The result is that an ADF lead transmitted from a lead provider to a dealer CRM may pass through multiple servers, some of which strip encryption.
Problem two. ADF content is human-readable. Even if the transport were encrypted, the payload is XML in plaintext. Any server that has access to the mail body can read every field. This is fundamentally different from a TLS-encrypted API call where the body is encrypted with the connection.
The combination is what creates compliance exposure. Plaintext over often-plaintext transport, with no consistent audit trail of who accessed what when.
Has Anyone Been Fined for ADF Non-Compliance?
Not yet. Not publicly. Not attributed to ADF specifically.
That misses the point. The FTC Safeguards Rule applies regardless of which transport caused the breach. When a dealer is breached and the investigation finds customer data moving unencrypted through ADF emails, the dealer is exposed. Whether anyone was fined for the same cause before does not change the outcome.
Run the right risk model. Not if a breach happens. When. When it happens and the compliance posture is examined, plaintext transport will not survive the examination.
What Are the Compliant Alternatives?
Three options exist today.
Option one. ADF over enforced TLS. Configure all SMTP relays in the lead flow to require TLS. Verify that no relay in the chain downgrades. This addresses transport encryption but does not address the human-readable payload or the audit trail problem. Better than default. Still not great.
Option two. ADF over secure transport API. Some vendors have moved ADF payloads into HTTPS POST endpoints. The XML format remains the same. The transport is now HTTPS. This is a meaningful improvement and is enough to address the transport-encryption requirement.
Option three. Switch to ACP. ACP (Automotive Commerce Protocol) was designed from day one for HTTPS transport with audit logging. It is compliant by default. The full specification is at ACPspec.org. I cover the comparison in detail in ADF XML vs ACP.
Of the three, option three is the strategic answer. Options one and two are tactical patches on a 26-year-old standard. ACP solves the compliance problem and the AI-era data problem at the same time.
What Should Dealers Do This Quarter?
Three actions.
One. Audit your ADF flows. Map every place ADF is being received in your stack. Identify which flows use plaintext SMTP. Note the dollar value of leads flowing through each path.
Two. Push vendors to TLS or HTTPS. The short-term fix is to require enforced TLS or HTTPS-wrapped ADF from every lead provider. Most vendors can do this with a configuration change. Make it a contract requirement.
Three. Plan the ACP migration. The long-term answer is to move off ADF entirely. Build the migration into your 2026 vendor selection criteria. Vendors that support ACP get priority. Vendors that resist get scrutiny.
What Should Lead Providers Do?
Stop shipping leads over plaintext email. The dealers who care about compliance are going to start asking. The dealers who do not care today will care after the first enforcement action.
HTTPS-based delivery is a small engineering lift. ACP support is a slightly larger lift. Both are cheaper than losing accounts to lead providers that already support secure transport.
What Should OEMs Do?
Stop accepting ADF-over-email from your dealer network. OEMs sit at the top of the data flow and have leverage that no one else has. If OEMs require HTTPS or ACP at the portal level, the rest of the network follows.
OEMs that lead on this will be cited in compliance audits as having done the right thing. OEMs that do not lead will be cited as having ignored a known compliance gap.
The Underlying Issue
ADF was built before modern compliance frameworks existed. The standard was never updated to address them. The industry has been running on the assumption that a 2000-era standard would somehow keep working in a 2026 regulatory environment. That assumption is breaking.
The fix is structural, not incremental. The fix is a modern standard that was designed for current compliance, current data shapes, and current transport security. That standard is ACP.
Final Thought
The longer the industry waits to retire ADF, the more expensive the eventual retirement becomes. Compliance exposure compounds. Breach risk compounds. Every quarter without a migration plan is a quarter of accumulating liability. Dealers, OEMs, lead providers, and CRMs all share the exposure. They all share the fix. The standard is published. The reference implementation is open. The only thing left is the decision to move.
Structure before tools. Strategy before speed. Systems before scale.
The AI Operator Framework is the methodology for designing, governing, and scaling AI operations inside a business. Explore the full framework at JamilAshkar.com/framework. Start with the free course at JamilAshkar.com/course.
