On this page
Dealer compliance in every state
| State | Breach notice to residents | State privacy law |
|---|---|---|
| Alabama | 45 days | From May 1, 2027 |
| Alaska | Without unreasonable delay | No |
| Arizona | 45 days | No |
| Arkansas | Without unreasonable delay | No |
| California | 30 days | Yes |
| Colorado | 30 days | Yes |
| Connecticut | 60 days | Yes |
| Delaware | 60 days | Yes |
| District of Columbia | Without unreasonable delay | No |
| Florida | 30 days | No |
| Georgia | Without unreasonable delay | No |
| Hawaii | Without unreasonable delay | No |
| Idaho | Without unreasonable delay | No |
| Illinois | Without unreasonable delay | No |
| Indiana | 45 days | Yes |
| Iowa | Without unreasonable delay | Yes |
| Kansas | Without unreasonable delay | No |
| Kentucky | Without unreasonable delay | Yes |
| Louisiana | 60 days | From January 1, 2027 |
| Maine | 30 days | No |
| Maryland | 45 days | Yes |
| Massachusetts | Without unreasonable delay | No |
| Michigan | Without unreasonable delay | No |
| Minnesota | Without unreasonable delay | Yes |
| Mississippi | Without unreasonable delay | No |
| Missouri | Without unreasonable delay | No |
| Montana | Without unreasonable delay | Yes |
| Nebraska | Without unreasonable delay | Yes |
| Nevada | Without unreasonable delay | No |
| New Hampshire | Without unreasonable delay | Yes |
| New Jersey | Without unreasonable delay | Yes |
| New Mexico | 45 days | No |
| New York | 30 days | No |
| North Carolina | Without unreasonable delay | No |
| North Dakota | Without unreasonable delay | No |
| Ohio | 45 days | No |
| Oklahoma | Without unreasonable delay | From January 1, 2027 |
| Oregon | 45 days | Yes |
| Pennsylvania | Without unreasonable delay | No |
| Rhode Island | 45 days | Yes |
| South Carolina | Without unreasonable delay | No |
| South Dakota | 60 days | No |
| Tennessee | 45 days | Yes |
| Texas | 60 days | Yes |
| Utah | Without unreasonable delay | Yes |
| Vermont | 45 days | From January 1, 2028 |
| Virginia | Without unreasonable delay | Yes |
| Washington | 30 days | No |
| West Virginia | Without unreasonable delay | No |
| Wisconsin | 45 days | No |
| Wyoming | Without unreasonable delay | No |
Checked October 31, 2026 on each state's official code or attorney general site.
Federal rules every dealer follows
These apply in every state. Each links to a free tool or guide.
- FTC Safeguards Rule (16 CFR Part 314): a written security plan, a Qualified Individual, a risk assessment, MFA, encryption and the FTC breach notice. Safeguards checklist.
- Red Flags Rule (16 CFR 681): a written identity theft program; most dealers who arrange financing treat themselves as covered. Red Flags program.
- Privacy notice (Gramm-Leach-Bliley Act): give it to buyers who finance or lease. GLBA privacy notice.
- OFAC: never sell to someone on the Treasury's sanctions lists; keep records 10 years. Free OFAC search.
- Form 8300: report cash over $10,000 within 15 days. Form 8300 worksheet.
- Credit notices: adverse action within 30 days, and risk-based pricing notices. Adverse action notice.
- Used Car Rule: the Buyers Guide on every used car for sale. Buyers Guide.
- Advertised prices: include doc fees and other required fees, per the FTC's September 2026 FAQs. Ad and price check.
Breach notices: state law and the FTC
Every state and DC has a data breach notice law, and each sets its own deadline and who to tell. A dealer also owes the FTC a notice within 30 days of discovering a breach of unencrypted information about 500 or more consumers. Your incident response plan should list both. How the FTC notice works.
Rules checked and limits
Rules checked October 31, 2026. We read every rule on this page in the eCFR or on the agency's own site, and each is linked in the sources below. We re-check them every quarter.
State laws checked October 31, 2026 on each state's official code or attorney general site.
Templates and tools, not legal advice. CarShots is software, not a law firm. For a question about your own dealership, ask your attorney or your state dealer association.