FTC enforcement against car dealerships in 2026 has been about pricing: warning letters to 97 dealership groups, then settlements over advertised prices, fees, and add-ons. On data security it has been quiet, and we haven’t found a Safeguards Rule case against a dealer.
Last updated: November 10, 2026
The FTC’s busiest dealership file this year isn’t about firewalls. It’s about the price on the website.
Writing service was my first customer-facing job. That seat changed how I saw the whole store. It still does. The customer at the counter only knows what the store told them, and an advertised price is something the store told them before they ever pulled in.
That’s exactly where the agency has spent 2026. Since March it has sent warning letters to 97 dealership groups about advertised prices and announced proposed settlements in four dealer cases over fees, add-ons, and advertised prices that buyers couldn’t actually get. Data security? Much quieter. Erik Nachbahr, our founder, said it plainly during an October webinar on AI governance: “we have not seen much FTC action in terms of the safeguard rules with dealers.” In the same breath he said the agency is “always focused on the low-hanging fruit picking on you for websites and doc fees and everything else.”
This year’s docket matches him.
This isn’t a scare piece. It’s a map of what the FTC actually did in 2026, which person in the building each action lands on, and why the quiet on the Safeguards side still deserves a slot on the calendar. I’m not a lawyer, and nothing here is legal advice. For the security side, our dealership cybersecurity services page explains how we run it day to day.
What Does FTC Enforcement Against Dealerships Look Like in 2026?
FTC enforcement against dealerships is the agency using the FTC Act, and rules written under other laws like the Safeguards Rule, to stop practices it considers deceptive or unfair. In 2026 that has meant warning letters, staff guidance, and proposed settlements (two of them alongside a state), nearly all of them about advertised prices, fees, and add-ons.
Here’s the year as we found it on ftc.gov, in order, with a link to the FTC’s own announcement for each one. I’ve described the dealers instead of naming them. The FTC’s pages name them, so click through if you need that.
| Date | What the FTC did | What it was about | Who it lands on |
|---|---|---|---|
| Mar 13, 2026 | Warning letters to 97 dealership groups | Advertised prices that don’t reflect all required fees, plus five other pricing practices | Internet sales, marketing vendors |
| Apr 2, 2026 | Proposed settlement with a dealer group, jointly with Maryland’s attorney general | Buyers told they didn’t qualify for rebates behind the advertised price or had to finance through the dealer; add-ons buyers didn’t want or agree to | Sales desk, F&I |
| Aug 19, 2026 | Proposed settlement with a dealership, jointly with the state of Connecticut | Double-charging for “certified pre-owned” vehicles; charges like total loss protection added without the buyer’s knowledge or consent | F&I, accounting |
| Sep 15, 2026 | Price transparency FAQs for dealers | Staff guidance on document fees, rebates, negotiation, and vehicles in transit | Anyone who puts a price in front of a customer |
| Oct 8, 2026 | Proposed settlement with a dealer group, filed in federal court in Florida | Advertised prices thousands of dollars below what it actually charged; false prize mailers | Marketing, BDC, sales desk |
| Nov 9, 2026 | Proposed settlement with a Long Island dealer | Online prices it refused to honor, required down payments on top of the advertised price, dealer fees and unwanted add-ons | Internet sales, sales desk, F&I |
One older case ended differently, and I think it’s worth saying out loud. According to the FTC’s case page, the Commission dismissed its 2024 administrative complaint over three of a dealer group’s Texas stores on Oct 5, 2026. The order says the public interest no longer called for continuing, with years of federal court litigation likely still ahead. A complaint isn’t a finding. Now look back at that last column for a second. You won’t find IT anywhere in it.
Which Pricing Practices Did the FTC Single Out?
The FTC’s warning letters cited advertised prices that don’t reflect all required fees, rebates or discounts not available to all buyers, required down payments the price doesn’t account for, prices conditioned on dealer financing, extra items buyers must purchase, and unavailable vehicles. Its September FAQs say the FTC Act requires that the advertised price be “the actual price any consumer can walk in and pay.”
Here are those six next to what each one can look like on an ordinary Saturday. The FAQs also take on document fees by name.
| What the letters flagged | What it can look like at the store |
|---|---|
| Advertised prices that don’t reflect all required fees | A website price that doesn’t include the doc fee every buyer pays |
| Rebates or discounts not available to all buyers | A number that assumes a rebate not every shopper qualifies for |
| A price that doesn’t account for a required down payment | Cash down that first comes up at the desk |
| Prices conditioned on using dealer financing | A price that changes if the customer brings their own lender |
| Requiring extra items not reflected in the advertised price | Products already on the car and already on the buyer’s order |
| Advertising unavailable or non-existent vehicles | A unit in the ad that has already sold |
In the case brought with Maryland’s attorney general, the FTC’s announcement says consumers who were charged a total of more than $75 million between April 2020 and December 2025 may be eligible for redress, and the group will pay a $3.1 million civil penalty to the Maryland Attorney General’s office. It’s still a proposed order. I’m including the number because it’s the clearest signal of where the agency’s attention went this year, not because I think your store is next.
Look at that table again. Every item on it is a process problem long before it turns into a legal one.
Who in the Store Does Each Action Land On?
Nobody in your building reads the Federal Register for fun. Why would they? The F&I manager doesn’t. Neither does the internet sales manager. So when I read FTC news, I translate it into the people on the floor and one task each, something a manager can run with their team this week.
| Role | What 2026 put on their desk | One task this month |
|---|---|---|
| Internet sales manager | Website and listing prices | Pick ten live listings and have the desk work each one to an out-the-door number. Compare. |
| Sales manager on the desk | Honoring the advertised number | Write down which rebates the website price assumes |
| F&I manager | Add-ons and consent | Check that every product on a deal has the customer’s clear yes attached to it |
| Office manager and accounting | Charges that don’t match the paperwork | Spot-check funded deals against the signed menu |
| BDC and marketing vendor | Mailers and promotions | Read the next mailer as a customer would before it drops |
None of those tasks needs new software. Not one. They need a person, a name next to the task, and an hour. Time is money in this business, and an hour of spot checks is cheap compared to rebuilding trust with a customer who felt the price moved on them at the desk.
Pricing belongs with your attorney and your compliance counsel. That’s their lane. We’re an IT and cybersecurity company, and I’d be overstepping if I told you how to word an ad. This next part is ours.
Where Do Privacy and Data Security Fit This Year?
The FTC’s Safeguards Rule page doesn’t list a single enforcement case, and we haven’t found one against a dealer, in 2026 or since the 2021 amendments. On privacy, we didn’t find a 2026 FTC case against a dealer either. The one 2026 auto privacy order we found, finalized in January, involved an automaker and connected-car location data, not a dealer.
Quiet isn’t gone. The rule still covers most dealers that finance or lease vehicles, as the FTC’s Safeguards Rule FAQs for auto dealers put it, and since May 2024, a breach involving the unencrypted information of at least 500 consumers has to be reported to the FTC as soon as possible and no later than 30 days after discovery. The agency said in an August 2026 Federal Register notice that it received approximately 163 breach notifications in 2025. That count covers every business under the rule, not only dealers. Our guide to the 30-day breach report walks through what counts and how it gets filed.
Erik made two more points in that same webinar that I’d pass along. Both stuck with me. The FTC, in his words, “doesn’t freak people out as much.” The bigger data-exposure risks, he said, are litigation and reputation. And AI is getting attention, because it opens “a much quicker way into the data,” and he noted that state regulation is growing too. If your team has started using AI tools with customer information, our post on AI legal risks for dealerships covers which existing rules already apply. Worth the read.
Here’s my honest read, from someone who has worked in finance support, service, and parts, and spent years building training for the people on the floor: the real cost of a security problem was never mainly the FTC. It’s the day the DMS goes dark and nobody can desk a deal, fund a contract, or close a repair order. Plan around that one.
Why Is Quiet Safeguards Enforcement Still Worth a Meeting?
Because the program protects the store whether or not anyone is checking. Erik’s read is that a couple of years ago there was a lot of conversation about the Safeguards Rule, and now dealers aren’t paying attention to it. One of our compliance leads has seen a version of that. Some dealers skip the compliance meetings scheduled with them, even when we’re the ones running their compliance program.
I get why. The sales floor is loud and the meeting feels optional. But skipping it because nobody has been fined is like skipping the pre-delivery inspection because the last ten cars came off the truck fine. The PDI was never about the last ten cars. It’s about the next one.
We support 2,000-plus dealerships. The programs that hold up are the boring ones. The rule’s full list is in our breakdown of the FTC Safeguards Rule requirements, but these are the pieces I’d want on the calendar first:
- A named Qualified Individual. A real person by name, even if they work for your IT provider.
- The written risk assessment, re-assessed periodically and revisited when the store makes a material change, because a new DMS, CRM, or AI tool changes where customer data lives.
- Multifactor authentication for anyone who accesses your information system.
- A written incident response plan. Who files the 30-day FTC report? Write the name in it.
- Vendor oversight, which means knowing every service provider that touches your customers’ data and periodically checking on them after the contract is signed.
- Security awareness training for everyone. In my experience it sticks with hands-on practice and repetition, not a slide deck signed once a year.
- The written report to your board or owners, at least once a year, which our Safeguards board report template lays out.
That’s the real work. It’s quiet, and it should be.
Questions Dealers Bring Us About the FTC
Were the 97 warning letters fines?
Has the FTC actually fined a dealer under the Safeguards Rule?
Is the CARS Rule back in effect?
Pricing cases and IT: is there any real overlap?
Where should a store start this month?
The Price, the Paperwork, and the People Behind Both
The FTC spent 2026 on the price a customer sees and whether the store honors it. That’s a process question. Not a software one. It gets answered by the people on the floor, one deal at a time. The Safeguards side stayed quiet. A quiet year is the best time to get a program set up for success instead of rushing it after something goes wrong.
If you’d like a second set of eyes on the security half, our complimentary IT and cybersecurity assessment looks at your tech setup, security posture, and Safeguards compliance together, and our dealership compliance program is how we keep it running all year. The teams that keep up with this stuff aren’t the ones with the most software. They’re the ones who show up to the meeting.