How auto dealerships can sell data to AI companies

A dealership service department produces one of the most consistent records in retail. Every repair order states the customer's concern, the technician's diagnosis and the correction, with labor times and parts, and a busy store writes thousands of them a year.

That structure suits AI buyers building diagnostic and service agents. The deal jackets and CRM records next to it are financial records under federal law, so dealers need to separate the two before any buyer conversation.

What dealership data do AI companies buy?

AI companies buy dealership data that shows expert diagnosis and process. Repair orders and technician notes are the strongest asset, followed by the procedures and training materials your managers wrote.

Our guide to selling CRM data covers sales and BDC records, and CRM and sales data sets out what buyers check.

Who buys dealership data?

No buyer whose terms are public publishes a dealership price or program. Handshake AI lists retail among the industries it buys operational data from, and micro1 asks for CRM records and support tickets, requires 30 or more full-time staff and publishes tiers starting at $100,000 to $500,000.

micro1 also says several years of records across multiple systems is generally a stronger fit, which favors stores and dealer groups with long service histories. A free data valuation tells you which records are in demand.

Does GLBA apply to auto dealer data?

GLBA applies to auto dealers that arrange or provide consumer financing or leasing. The FTC's Privacy Rule, at 16 CFR 313.1(b), covers persons described in 12 U.S.C. section 5519 that are mainly engaged in selling, servicing or leasing motor vehicles, other than dealers that extend credit directly and do not routinely assign the contracts.

Under 16 CFR 313.10(a)(1), a covered dealer may not disclose a consumer's nonpublic personal information to a nonaffiliated third party unless it has given an initial notice and an opt-out notice, given a reasonable opportunity to opt out, and the consumer has not opted out. An AI buyer is a nonaffiliated third party.

What does the Safeguards Rule require during a data sale?

The Safeguards Rule requires customer information to stay inside your information security program during a data sale. Its own example, at 16 CFR 314.2(h)(2)(ii), says a dealership that leases automobiles on a nonoperating basis for longer than 90 days as a usual part of its business is a financial institution for its leasing business.

The rule defines customer information as any record containing nonpublic personal information about a customer, in any form, handled by you or on your behalf. The FTC says breach notification requirements took effect in May 2024, requiring notice to the FTC no later than 30 days after discovering a breach involving at least 500 consumers' unencrypted information. Exports prepared for a buyer are customer information until they are properly de-identified.

The FTC CARS Rule is not in force. The Fifth Circuit vacated the Combating Auto Retail Scams Rule on January 27, 2025 in National Automobile Dealers Association v. FTC, holding that the FTC had failed to issue an advance notice of proposed rulemaking. The FTC withdrew the rule in a final rule effective February 12, 2026.

The CARS Rule dealt with pricing and add-on practices rather than data sharing, so its withdrawal does not loosen any data rule. GLBA, the Safeguards Rule and state privacy laws still apply in full.

What other dealer records need care?

Credit reports, DMV records and connected vehicle data need the most care. Under 15 U.S.C. section 1681b(f), a person may not use or obtain a consumer report for any purpose the FCRA does not permit. Under 18 U.S.C. section 2721(c), most authorized recipients of motor vehicle record information may resell or redisclose it only for a use the Driver's Privacy Protection Act permits.

Connected vehicle data has drawn FTC action. On January 14, 2026, the FTC finalized an order against GM and OnStar over allegations that they sold precise geolocation and driving behavior data without consent, requiring affirmative express consent before collecting, using or sharing connected vehicle data for 20 years. Leave telematics out of any package.

If you hold UK or EU data

UK dealers apply UK GDPR. Article 8A, fully in force from February 5, 2026, tests whether reusing customer data for a new purpose is compatible with the purpose it was collected for, weighing the link between purposes, the context of collection and the possible consequences for customers.

Telematics location data is an identifier under UK GDPR Article 4(1), so UK connected vehicle data should stay out as well.

How do you sell dealership data through Sell My Data To AI?

You start with a consultation about your dealer management system, CRM, service history and stores. Sellers pay nothing to be assessed. We charge a success fee only when a deal completes, agreed in writing before we introduce you to any buyer.

Every buyer is verified for company identity, intended use, security and retention commitments and onward transfer limits before seeing a sample. You approve every buyer, every sample and every license term. Book a consultation to start.