What federal compliance rules apply to Colorado car dealers?

The FTC Safeguards Rule, the Red Flags Rule, the GLBA privacy notice, OFAC sanctions checks, Form 8300 for cash over $10,000, adverse action and risk-based pricing notices, the Used Car Rule's Buyers Guide, and the FTC's pricing rules for ads.

Colorado Dealer Compliance Checklist (2026)

Q: How fast must a Colorado car dealer report a data breach?

Colorado's law (Colo. Rev. Stat. § 6-1-716) says to notify affected residents in the most expedient time possible and without unreasonable delay, but not later than 30 days after the date of determination that a security breach occurred (unless the investigation determines misuse has not occurred and is not reasonably likely to occur). Also tell the Attorney General. If the breach is reasonably believed to have affected 500 or more Colorado residents; in the most expedient time possible and not later than 30 days after determining a breach occurred. Nationwide consumer reporting agencies also if more than 1,000 residents are notified (not required for GLBA Title V entities). Separately, the FTC Safeguards Rule asks for an FTC notice within 30 days when 500 or more consumers are affected.

Q: Does Colorado have a privacy law that applies to car dealers?

Colorado has the Colorado Privacy Act. It covers: controllers that conduct business in Colorado or intentionally target products/services to Colorado residents and either control or process personal data of 100,000+ consumers in a calendar year, or derive revenue or receive a discount from selling personal data and process or control personal data of 25,000+ consumers. Whether a store is covered depends on its own numbers. The federal GLBA privacy notice applies either way.

At a glance

Breach notice to residents: 30 days at most
State regulator notice: Attorney General
State consumer privacy law: Colorado Privacy Act

On this page

Federal rules every dealer follows
Colorado's data breach notice law
Colorado's consumer privacy law
Colorado dealer compliance checklist
Rules checked and limits
Common questions
Sources

Federal rules every dealer follows

These apply in every state. Each links to a free tool or guide.

FTC Safeguards Rule (16 CFR Part 314): a written security plan, a Qualified Individual, a risk assessment, MFA, encryption and the FTC breach notice. Safeguards checklist.
Red Flags Rule (16 CFR 681): a written identity theft program; most dealers who arrange financing treat themselves as covered. Red Flags program.
Privacy notice (Gramm-Leach-Bliley Act): give it to buyers who finance or lease. GLBA privacy notice.
OFAC: never sell to someone on the Treasury's sanctions lists; keep records 10 years. Free OFAC search.
Form 8300: report cash over $10,000 within 15 days. Form 8300 worksheet.
Credit notices: adverse action within 30 days, and risk-based pricing notices. Adverse action notice.
Used Car Rule: the Buyers Guide on every used car for sale. Buyers Guide.
Advertised prices: include doc fees and other required fees, per the FTC's September 2026 FAQs. Ad and price check.

Colorado's data breach notice law

Colorado's breach notice law is Colo. Rev. Stat. § 6-1-716. If personal information of Colorado residents is breached, it says to notify them in the most expedient time possible and without unreasonable delay, but not later than 30 days after the date of determination that a security breach occurred (unless the investigation determines misuse has not occurred and is not reasonably likely to occur).

Who else to tell: the Attorney General. If the breach is reasonably believed to have affected 500 or more Colorado residents; in the most expedient time possible and not later than 30 days after determining a breach occurred. Nationwide consumer reporting agencies also if more than 1,000 residents are notified (not required for GLBA Title V entities).

The law has a clause for businesses that follow the breach rules of their own federal regulator (Colo. Rev. Stat. § 6-1-716(3)(b) (entity regulated by state or federal law that maintains breach procedures under its primary or functional regulator's rules is deemed in compliance, except AG notice under (2)(f) is still required and the shortest individual-notice timeframe controls)). Some clauses like this cover only banks and credit unions, so don't count on it: plan to meet the state deadline as well as the FTC's.

The law reads: "Notice must be made in the most expedient time possible and without unreasonable delay, but not later than thirty days after the date of determination that a security breach occurred"

This is on top of the federal rule. Under the FTC Safeguards Rule, a dealer must tell the FTC within 30 days of discovering a breach of unencrypted information about 500 or more consumers. How the FTC notice works.

Colorado's consumer privacy law

Yes. The Colorado Privacy Act (Colo. Rev. Stat. § 6-1-1301 et seq.) has applied since July 1, 2023.

Who it covers: Controllers that conduct business in Colorado or intentionally target products/services to Colorado residents and either control or process personal data of 100,000+ consumers in a calendar year, or derive revenue or receive a discount from selling personal data and process or control personal data of 25,000+ consumers.

The law exempts both financial institutions subject to the Gramm-Leach-Bliley Act and the data that act covers. A dealer that arranges financing or leases is generally treated as one, so ask your attorney whether that covers your store. (Colo. Rev. Stat. § 6-1-1304(2)(j)(II) (personal data under GLBA) and § 6-1-1304(2)(q) (financial institutions and affiliates subject to GLBA), as enacted by SB 21-190)

The law reads: "Controls or processes the personal data of one hundred thousand consumers or more during a calendar year"

Whether your store is covered depends on your own numbers, so check them each year, and keep giving financing buyers the federal privacy notice. Make a free GLBA privacy notice.