What federal compliance rules apply to Connecticut car dealers?

The FTC Safeguards Rule, the Red Flags Rule, the GLBA privacy notice, OFAC sanctions checks, Form 8300 for cash over $10,000, adverse action and risk-based pricing notices, the Used Car Rule's Buyers Guide, and the FTC's pricing rules for ads.

How much is the Connecticut dealer bond?

$60,000 for a retail dealer license, with other amounts for some license types or sales volumes. See the Connecticut dealer license guide.

Connecticut Dealer Compliance Checklist (2026)

Q: How fast must a Connecticut car dealer report a data breach?

Connecticut's law (Conn. Gen. Stat. § 36a-701b) says to notify affected residents without unreasonable delay and no later than 60 days after discovery of the breach. Also tell the Attorney General. For any breach requiring resident notice (no minimum number); no later than when residents are notified. Separately, the FTC Safeguards Rule asks for an FTC notice within 30 days when 500 or more consumers are affected.

Q: Does Connecticut have a privacy law that applies to car dealers?

Connecticut has the Connecticut Data Privacy Act (as amended by Public Act 25-113 / SB 1295, effective July 1, 2026). It covers: persons conducting business in Connecticut or targeting products/services to Connecticut residents that controlled or processed personal data of at least 35,000 consumers (excluding payment-only data), or controlled or processed consumers' sensitive data (excluding payment-only data), or offered consumers' personal data for sale (thresholds as amended effective 2026-07-01). Whether a store is covered depends on its own numbers. The federal GLBA privacy notice applies either way.

At a glance

Breach notice to residents: 60 days at most
State regulator notice: Attorney General
State consumer privacy law: Connecticut Data Privacy Act (as amended by Public Act 25-113 / SB 1295, effective July 1, 2026)
Dealer bond: $60,000

On this page

Federal rules every dealer follows
Connecticut's data breach notice law
Connecticut's consumer privacy law
Connecticut dealer license and bond
Connecticut dealer compliance checklist
Rules checked and limits
Common questions
Sources

Federal rules every dealer follows

These apply in every state. Each links to a free tool or guide.

FTC Safeguards Rule (16 CFR Part 314): a written security plan, a Qualified Individual, a risk assessment, MFA, encryption and the FTC breach notice. Safeguards checklist.
Red Flags Rule (16 CFR 681): a written identity theft program; most dealers who arrange financing treat themselves as covered. Red Flags program.
Privacy notice (Gramm-Leach-Bliley Act): give it to buyers who finance or lease. GLBA privacy notice.
OFAC: never sell to someone on the Treasury's sanctions lists; keep records 10 years. Free OFAC search.
Form 8300: report cash over $10,000 within 15 days. Form 8300 worksheet.
Credit notices: adverse action within 30 days, and risk-based pricing notices. Adverse action notice.
Used Car Rule: the Buyers Guide on every used car for sale. Buyers Guide.
Advertised prices: include doc fees and other required fees, per the FTC's September 2026 FAQs. Ad and price check.

Connecticut's data breach notice law

Connecticut's breach notice law is Conn. Gen. Stat. § 36a-701b. If personal information of Connecticut residents is breached, it says to notify them without unreasonable delay and no later than 60 days after discovery of the breach.

Who else to tell: the Attorney General. For any breach requiring resident notice (no minimum number); no later than when residents are notified.

The law has a clause for businesses that follow the breach rules of their own federal regulator (Conn. Gen. Stat. § 36a-701b (subsection on persons maintaining breach procedures under the rules of their primary or functional regulator, as defined in 15 U.S.C. 6809(2), deemed in compliance; AG notice still required)). Some clauses like this cover only banks and credit unions, so don't count on it: plan to meet the state deadline as well as the FTC's.

The law reads: "Notice to consumers must be made without unreasonable delay and no later than sixty (60) days from discovery of the breach."

This is on top of the federal rule. Under the FTC Safeguards Rule, a dealer must tell the FTC within 30 days of discovering a breach of unencrypted information about 500 or more consumers. How the FTC notice works.

Connecticut's consumer privacy law

Yes. The Connecticut Data Privacy Act (as amended by Public Act 25-113 / SB 1295, effective July 1, 2026) (Conn. Gen. Stat. § 42-515 et seq.) has applied since July 1, 2023.

Who it covers: Persons conducting business in Connecticut or targeting products/services to Connecticut residents that controlled or processed personal data of at least 35,000 consumers (excluding payment-only data), or controlled or processed consumers' sensitive data (excluding payment-only data), or offered consumers' personal data for sale (thresholds as amended effective 2026-07-01).

The law reads: "Controlled or processed the personal data of at least 35,000 consumers, excluding data processed solely to complete payment transactions;"

Whether your store is covered depends on your own numbers, so check them each year, and keep giving financing buyers the federal privacy notice. Make a free GLBA privacy notice.

Connecticut dealer license and bond

A Connecticut retail dealer license calls for a $60,000 surety bond; other amounts apply to some license types or sales volumes. Everything about the Connecticut dealer license: who needs one, the lot rules and the application.