State Privacy Laws
Dealership Privacy Laws by State: What Applies to Your Rooftops
About two dozen states have passed a consumer privacy law, and most of them exempt a dealer that arranges financing. A few don’t. Here’s the state-by-state read for the places you sell.
Most dealership privacy laws by state exempt a dealer that arranges financing, a few such as California’s exempt only the financing data, and about half the states have no consumer privacy law, only breach notice and security rules.
Last updated: October 13, 2026
Fifty states, three patterns. Know which one each rooftop sits in.
A store that arranges financing or leases is a financial institution under the Gramm-Leach-Bliley Act, which is why every dealer already answers to the FTC Safeguards Rule requirements. That federal rule is the floor in all fifty states. State law sits on top of it, and the states haven’t agreed on much, which is how a dealer group with rooftops in three states ends up reading three different statutes to answer what sounds like one simple question about customer data. Some wrote a privacy law and waved dealers through. A few didn’t wave. Automakers add their own cybersecurity requirements on top of both.
Helion Technologies has worked only with automotive and heavy truck dealerships since 1997, and state law comes up in nearly every dealership cybersecurity conversation we have with a group that crosses a state line. The question is always the same one, asked by a controller or a general manager who’s just heard about a new law from a vendor with something to sell, and who wants to know whether it’s real before spending money on it. Usually it’s half real.
We’ve written about several of these laws one at a time, and those posts are linked from each state below. This page is the map. Find your state, read the entry, then follow the link for the detail.
The GLBA Exemption Decides Most of It
State data privacy laws for car dealerships turn on one clause. Nearly every state privacy law carves out the Gramm-Leach-Bliley Act somehow, because lawmakers didn’t want two sets of rules for the same loan file. How they wrote that carve-out is what matters to you. There are two versions, and they lead to very different amounts of work.
Read the clause for each state where you have a store or a meaningful number of customers. Then read it again next year. Legislatures have started trimming the broad version, and a dealership that was exempt as a whole business in January can find itself covered for its service and marketing data by the following January without a single thing changing inside the store. Our FTC Safeguards compliance work covers the federal half, and the same written program does most of the lifting for the state half.
Same store. Different answer.
Entity-level exemption
The law doesn’t apply to a financial institution subject to the Gramm-Leach-Bliley Act. A dealership that arranges financing is one, so the whole business sits outside the privacy law. Texas, Virginia, Maryland, Colorado, New Jersey and Florida are written this way.
The store is out. The breach law still applies.
Data-level exemption
Only the information handled under the Gramm-Leach-Bliley Act is exempt. The credit application is out. The service customer who paid cash, the website visitor, the lead who never applied and your own employees are all still in. California is written this way, and Oregon, Minnesota, Montana and Connecticut now treat a dealership the same.
The loan file is out. Everything else is in.
State by state
Dealership Privacy Laws by State at a Glance
Fifteen places where dealers ask us about this most, drawn from the metros Helion supports. Pick a state name to jump to its entry. Laws change every session, so treat the table as a starting map and have your attorney confirm what applies to your stores.
| State | Consumer privacy law | Does it reach a dealership? | Breach notice clock |
|---|---|---|---|
| California | California Consumer Privacy Act, as amended by the CPRA (2020, amended 2023) | Yes, above the size thresholds. Only the financing data is exempt. | 30 days. A copy to the attorney general when more than 500 residents are affected. |
| Colorado | Colorado Privacy Act (2023) | No. The dealership is exempt as a financial institution. | 30 days. The attorney general too, at 500 or more residents. |
| Delaware | Delaware Personal Data Privacy Act (2025) | Not today. Yes from January 1, 2027, when the exemption narrows. | 60 days. The attorney general too, above 500 residents. |
| Florida | Florida Digital Bill of Rights (2024) | No. It targets companies with over $1 billion in revenue, and dealers are exempt anyway. | 30 days. The state too, at 500 or more residents. |
| Maryland | Maryland Online Data Privacy Act (2025) | No. The dealership is exempt as a financial institution. | 45 days. The attorney general hears first, in every breach. |
| New Jersey | New Jersey Data Privacy Act (2025) | No. The dealership is exempt as a financial institution. | No day count. The State Police are told before customers. |
| Texas | Texas Data Privacy and Security Act (2024) | No. The dealership is exempt as a financial institution. | 60 days. The attorney general within 30 days, at 250 or more residents. |
| Virginia | Virginia Consumer Data Protection Act (2023) | No. The dealership is exempt as a financial institution. | No day count. The attorney general and credit bureaus above 1,000 people. |
| District of Columbia | None | No privacy law. The breach and security law applies. | No day count. The attorney general at 50 or more residents. |
| Georgia | None | No privacy law. Ask counsel how the breach statute fits your store. | No day count. |
| Illinois | None | No privacy law. The biometric law is the one to ask about. | No day count. The attorney general above 500 residents. |
| Massachusetts | None yet. Senate Bill 2619 is in conference. | Not yet. The written security program rule applies now. | As soon as practicable. The attorney general and the consumer affairs office, in every breach. |
| New York | None. The SHIELD Act covers security and breach notice. | No privacy law. The SHIELD Act applies to every dealer. | 30 days. The attorney general, Department of State and State Police, in every breach. |
| Ohio | None. The Data Protection Act is an optional safe harbor. | No privacy law. A safe harbor rewards a written security program. | 45 days. No attorney general notice. |
| Pennsylvania | None yet. House Bill 78 is pending in the Senate. | Not yet. The bill as amended would exempt dealerships. | No day count. The attorney general above 500 residents. |
Checked October 13, 2026 against state codes and legislature pages, including the Texas, Delaware and California statutes, and the federal rule at 16 CFR Part 314. NADA publishes its own guidance on state privacy legislation. This page is general information and isn’t legal advice.
Eight states with a law
State Privacy Laws That Already Cover Your Market
Each entry gives the law, when it took effect and how it treats a store that arranges financing. The note on the right is the short version. Rules for AI tools are a separate layer, covered in AI legal risks for dealerships.
Not sure how your stores would hold up if one of these applied tomorrow? Request a complimentary IT and cybersecurity assessment.
Where Helion fits
Helion isn’t a law firm and doesn’t give legal advice. We run the security controls these laws expect, and we keep the records that show they’re running.
States with a consumer privacy law Checked October 2026
CA California
California is the one that bites. The California Consumer Privacy Act exempts information handled under the Gramm-Leach-Bliley Act and nothing else, so a store over the thresholds (revenue above $26,625,000, or data on 100,000 consumers or households) owes privacy rights to service customers, web visitors, leads and employees. The agency has already fined two automakers over website opt-outs. Since January 2026 a breach notice is due within 30 days. Our post on the California Privacy Rights Act explains how the agency came to be, and our Los Angeles dealership IT page covers the local side.
Only the financing data is exempt.
CO Colorado
The Colorado Privacy Act has been in force since July 2023, and it exempts a financial institution subject to the Gramm-Leach-Bliley Act along with its affiliates. Your store is out. What still applies is the older security law, which requires reasonable security, a written disposal policy and breach notice within 30 days. That older law is the subject of our Colorado blueprint for auto and truck dealers.
Dealership exempt. The security law still applies.
DE Delaware
Watch this one. Delaware’s law exempts financial institutions today, but House Bill 380, signed in September 2026, rewrites that exemption from January 1, 2027 so it covers banks, credit unions, insurers and securities firms and leaves everyone else with only the data carve-out. A dealership isn’t on the list. The same bill drops the threshold from 35,000 consumers to 10,000, which a busy store can reach on service traffic alone. Both versions sit side by side in the Delaware Code.
Exempt until 2027. Then only the financing data.
FL Florida
Florida’s Digital Bill of Rights sounds broad and isn’t. It applies to companies with more than $1 billion in global revenue that also run an app store, a smart speaker or an ad business, and it exempts Gramm-Leach-Bliley financial institutions on top of that. No dealership fits. The law that matters here is the Florida Information Protection Act, which gives you 30 days to notify customers after a breach and requires notice to the Department of Legal Affairs when 500 or more Floridians are affected. See our Miami dealership IT page.
Not aimed at dealers. Mind the 30-day breach clock.
MD Maryland
Maryland’s law took effect October 1, 2025 and is one of the strictest on what a business may collect. It exempts a financial institution, its affiliates and Gramm-Leach-Bliley data, so a store that arranges financing sits outside it. The breach law doesn’t let you off. Notice is due within 45 days, and the attorney general must be told before your customers are. We explain the law in why Maryland’s privacy law matters to dealers everywhere, and our Baltimore dealership IT page has the local rules.
Dealership exempt. Attorney general notified first.
NJ New Jersey
In force since January 15, 2025. The New Jersey Data Privacy Act doesn’t apply to a financial institution, its affiliates or data subject to the Gramm-Leach-Bliley Act, which takes a dealership out. The breach statute is unusual. It sets no number of days, and it sends your first call to the Division of State Police, before any customer hears from you.
Dealership exempt. State Police before customers.
TX Texas
The Texas Data Privacy and Security Act has no revenue or customer-count threshold, which makes it look like it covers everybody. It doesn’t cover you. Section 541.002 says the chapter doesn’t apply to a financial institution subject to the Gramm-Leach-Bliley Act. Texas enforces its breach law hard, though. Customers get notice within 60 days and the attorney general within 30 when 250 or more Texans are involved. Our Houston and Dallas-Fort Worth pages cover the local picture.
Dealership exempt. Two breach clocks.
VA Virginia
Virginia wrote the template most states copied. Section 59.1-576 says the law doesn’t apply to a financial institution or data subject to the Gramm-Leach-Bliley Act, and that sentence shows up nearly word for word in Texas and Florida. Breach notice goes out without unreasonable delay. No day count.
Dealership exempt. The original version of the clause.
Seven without one
No State Privacy Law Doesn’t Mean No Rules
These states and the District haven’t passed a consumer privacy law. Every one of them has a breach notice statute, and several add security, disposal or biometric rules that reach a dealership directly.
The federal clock runs alongside all of them. Our guide to the Safeguards Rule notification requirement covers the 30-day notice to the FTC.
One plan, every clock
A group with stores in three states can face four notice deadlines after one incident. Put each one in the incident response plan before you need it.
States without a consumer privacy law Checked October 2026
DC District of Columbia
The District has no consumer privacy law, and its breach law has one of the lowest reporting triggers in the country. Fifty residents. At that point the attorney general gets written notice, and a breach that exposes Social Security numbers means 18 months of identity theft protection at your cost. A business that meets the federal Safeguards Rule is treated as meeting the District’s security requirement. Our Washington, DC dealership IT page covers Maryland and Virginia alongside it.
Fifty residents triggers attorney general notice.
GA Georgia
Georgia came close. Senate Bill 111 passed the Senate as a consumer privacy act in 2025, then the House swapped out its text, and it was signed in May 2026 as a rural hospital tax credit bill with no privacy language left in it. So there’s nothing new at the state level. The breach statute is written for information brokers and government data collectors, which is why we tell Georgia dealers to ask their attorney how it applies to them instead of assuming either way. More on our Atlanta dealership IT page.
No state law. The federal rule sets the bar.
IL Illinois
No consumer privacy law here. Two bills stalled in committee in 2026. Illinois dealers ask us about the Biometric Information Privacy Act instead, because fingerprint time clocks are common in service departments and the Act lets individuals sue for $1,000 to $5,000 a violation. Section 25(c) says the Act doesn’t apply to a financial institution subject to the Gramm-Leach-Bliley Act. Courts have applied that to universities that make student loans. We haven’t found a ruling on a dealership, so treat it as an argument your attorney can make, not a guarantee.
Fingerprint time clock? Ask your attorney first.
MA Massachusetts
Massachusetts may be next. The Senate passed a data privacy act 40 to 0 in 2025, the House passed its own version 146 to 0 in June 2026, and a conference committee is working out the differences. It isn’t law yet. What already applies is 201 CMR 17, which requires a written information security program from any business that holds personal information on a Massachusetts resident, wherever that business is located. Every breach goes to the attorney general and the consumer affairs office.
A written security program is already required.
NY New York
The New York Privacy Act has been introduced year after year and hasn’t passed either house. The SHIELD Act did, back in 2019, and it has teeth. It requires reasonable safeguards, although a business that complies with the Gramm-Leach-Bliley rules is treated as compliant with that part. The breach side got stricter in December 2024, when the state added a hard 30-day deadline. Not sure where you stand? We wrote a SHIELD Act readiness check for dealers. Start with what dealerships need to know about the SHIELD Act.
Thirty days. No exceptions for size.
OH Ohio
Ohio took a different road. Its Data Protection Act doesn’t require anything. It rewards you. A business with a written cybersecurity program that conforms to a recognized framework gets an affirmative defense if it’s sued over a breach, and the statute lists the Gramm-Leach-Bliley security rules as one of those frameworks. A real Safeguards program does double duty in Ohio. Breach notice is due within 45 days. See our guide to the Ohio Data Protection Act.
Your Safeguards program can be a legal defense.
PA Pennsylvania
Still pending. House Bill 78 passed the House 127 to 76 in October 2025 and has been moving through the Senate since, with its last recorded action on October 6, 2026. The Senate’s version exempts financial institutions and Gramm-Leach-Bliley data, so a dealership would likely sit outside it if it passes as written. The breach law changed in 2024. The attorney general now gets notice whenever more than 500 Pennsylvanians do. Our Philadelphia dealership IT page follows the bill.
Not law yet. Check again after the session.
What Helion Brings to State Privacy Compliance
Helion Technologies doesn’t interpret statutes for a living. We run the security these statutes assume is already there, for automotive and heavy truck dealerships and nobody else, and we’ve been writing about state privacy law since 2019, when Helion partnered with a statewide association of California new car dealers to help its members get ready for the California Consumer Privacy Act. When a law changes, the controls underneath rarely do. The paperwork does.
How to Work Out Which State Privacy Laws Apply to Your Rooftops
-
1
List every state you touch
Start with where the stores are. Then add the states your customers live in, because most of these laws follow the resident, not the rooftop.
-
2
Read the exemption
For each state, find out whether the law exempts the dealership or only the financing data. It’s one clause. Ask your attorney to confirm it.
-
3
Sort your data
Where only the data is exempt, split what you hold. Credit applications go on one side, and service records, web leads and employee files go on the other.
-
4
Write down every clock
Put each state’s breach deadline in the incident response plan beside the FTC’s 30 days. Then build security to the strictest rule you found.
Common Questions
Stores in more than one state?
Bring the list to a complimentary IT and cybersecurity assessment. We’ll show you where your security stands against the strictest rule on it.
Do state privacy laws apply to car dealerships?
What is the GLBA exemption in a state privacy law?
Does the CCPA apply to car dealerships?
Which states have no consumer privacy law?
We have stores in several states. Which law do we follow?
Does following the FTC Safeguards Rule cover state breach notice laws?
Are the exemptions for dealerships going away?
The laws differ by state. The security behind them doesn’t have to. See where your stores stand today.
Request a Complimentary Assessment →