What federal compliance rules apply to Louisiana car dealers?

The FTC Safeguards Rule, the Red Flags Rule, the GLBA privacy notice, OFAC sanctions checks, Form 8300 for cash over $10,000, adverse action and risk-based pricing notices, the Used Car Rule's Buyers Guide, and the FTC's pricing rules for ads.

How much is the Louisiana dealer bond?

$50,000 for a retail dealer license. See the Louisiana dealer license guide.

Louisiana Dealer Compliance Checklist (2026)

Q: How fast must a Louisiana car dealer report a data breach?

Louisiana's law (La. R.S. 51:3074) says to notify affected residents in the most expedient time possible and without unreasonable delay but not later than 60 days from the discovery of the breach. Also tell the Attorney General (Consumer Protection Section). When notice to Louisiana residents is required; AG notice is timely if received within 10 days of distribution of notice to residents (AG rule, Title 16, Part III, Chapter 7, §701). If resident notice is delayed, written reasons must go to the AG within the 60-day period (R.S. 51:3074(E)). Separately, the FTC Safeguards Rule asks for an FTC notice within 30 days when 500 or more consumers are affected.

Q: Does Louisiana have a privacy law that applies to car dealers?

Louisiana has the Louisiana Data Privacy Act, which takes effect on January 1, 2027. It covers: persons or entities doing business in Louisiana that meet one or more of: annual gross revenues over $25 million; annually buy, receive for commercial purposes, sell, or share for commercial purposes the personal information of 75,000 or more consumers, households, or devices; or derive 50% or more of annual revenues from selling consumers' personal information. Whether a store is covered depends on its own numbers. The federal GLBA privacy notice applies either way.

At a glance

Breach notice to residents: 60 days at most
State regulator notice: Attorney General (Consumer Protection Section)
State consumer privacy law: Louisiana Data Privacy Act (from January 1, 2027)
Dealer bond: $50,000

On this page

Federal rules every dealer follows
Louisiana's data breach notice law
Louisiana's consumer privacy law
Louisiana dealer license and bond
Louisiana dealer compliance checklist
Rules checked and limits
Common questions
Sources

Federal rules every dealer follows

These apply in every state. Each links to a free tool or guide.

FTC Safeguards Rule (16 CFR Part 314): a written security plan, a Qualified Individual, a risk assessment, MFA, encryption and the FTC breach notice. Safeguards checklist.
Red Flags Rule (16 CFR 681): a written identity theft program; most dealers who arrange financing treat themselves as covered. Red Flags program.
Privacy notice (Gramm-Leach-Bliley Act): give it to buyers who finance or lease. GLBA privacy notice.
OFAC: never sell to someone on the Treasury's sanctions lists; keep records 10 years. Free OFAC search.
Form 8300: report cash over $10,000 within 15 days. Form 8300 worksheet.
Credit notices: adverse action within 30 days, and risk-based pricing notices. Adverse action notice.
Used Car Rule: the Buyers Guide on every used car for sale. Buyers Guide.
Advertised prices: include doc fees and other required fees, per the FTC's September 2026 FAQs. Ad and price check.

Louisiana's data breach notice law

Louisiana's breach notice law is La. R.S. 51:3074. If personal information of Louisiana residents is breached, it says to notify them in the most expedient time possible and without unreasonable delay but not later than 60 days from the discovery of the breach.

Who else to tell: the Attorney General (Consumer Protection Section). When notice to Louisiana residents is required; AG notice is timely if received within 10 days of distribution of notice to residents (AG rule, Title 16, Part III, Chapter 7, §701). If resident notice is delayed, written reasons must go to the AG within the 60-day period (R.S. 51:3074(E)).

The law has a clause for businesses that follow the breach rules of their own federal regulator (La. R.S. 51:3076). Some clauses like this cover only banks and credit unions, so don't count on it: plan to meet the state deadline as well as the FTC's.

The law reads: "shall be made in the most expedient time possible and without unreasonable delay but not later than sixty days from the discovery of the breach"

This is on top of the federal rule. Under the FTC Safeguards Rule, a dealer must tell the FTC within 30 days of discovering a breach of unencrypted information about 500 or more consumers. How the FTC notice works.

Louisiana's consumer privacy law

Yes. The Louisiana Data Privacy Act (La. R.S. 51:1780.1 to 51:1780.5) takes effect on January 1, 2027.

Who it covers: Persons or entities doing business in Louisiana that meet one or more of: annual gross revenues over $25 million; annually buy, receive for commercial purposes, sell, or share for commercial purposes the personal information of 75,000 or more consumers, households, or devices; or derive 50% or more of annual revenues from selling consumers' personal information.

The law exempts both financial institutions subject to the Gramm-Leach-Bliley Act and the data that act covers. A dealer that arranges financing or leases is generally treated as one, so ask your attorney whether that covers your store. (La. R.S. 51:1780.2(B))

The law reads: "(1) Has annual gross revenues in excess of twenty-five million dollars."

Whether your store is covered depends on your own numbers, so check them each year, and keep giving financing buyers the federal privacy notice. Make a free GLBA privacy notice.

Louisiana dealer license and bond

A Louisiana retail dealer license calls for a $50,000 surety bond. Everything about the Louisiana dealer license: who needs one, the lot rules and the application.