# How auto dealerships can sell data to AI companies

URL: https://sellmydatatoai.net/sell-your-data/auto-dealerships

Auto dealerships can license service repair orders, technician notes, sales process records and F&I procedures to AI companies once customer data is removed. No buyer publishes a dealership price range. Dealers that arrange financing are covered by the FTC's GLBA Privacy Rule and Safeguards Rule. The FTC's CARS Rule is not in force: it was vacated in January 2025 and withdrawn in February 2026.

## Key takeaways

- AI buyers most want these records from auto dealerships: (1) service repair orders with customer concern, cause and correction, (2) technician diagnostic notes and warranty claim narratives and (3) sales and BDC process records, de-identified.
- No AI buyer publishes a price range for auto dealerships yet, so value depends on volume, years of history, structure and how cleanly the rights can be shown.
- The first rights issue to clear: FTC Privacy Rule, 16 CFR part 313: notice and opt-out before sharing nonpublic personal information with nonaffiliated third parties. This page covers 5 more.
- Sellers pay nothing to be assessed. We charge a success fee only when a deal completes, and the fee is agreed in writing before we introduce you to any buyer.

## At a glance

- Records buyers ask for: Service repair orders with customer concern, cause and correction; Technician diagnostic notes and warranty claim narratives; Sales and BDC process records, de-identified; F&I procedures, compliance checklists and training materials; Customer service emails and chat transcripts, de-identified; Parts, inventory and reconditioning procedures
- Why buyers want them: A repair order records a problem, a diagnosis and a fix in a fixed structure, over many years and many vehicles. Handshake AI lists retail among its industries, and micro1 asks for CRM records and support tickets.
- Rights issues: FTC Privacy Rule, 16 CFR part 313: notice and opt-out before sharing nonpublic personal information with nonaffiliated third parties; FTC Safeguards Rule, 16 CFR part 314: customer information must stay inside your information security program; FTC CARS Rule status: vacated by the Fifth Circuit on January 27, 2025 and withdrawn by the FTC on February 12, 2026; Driver's Privacy Protection Act: DMV-sourced personal information may be redisclosed only for permitted uses; Credit reports in deal jackets are limited to FCRA permissible purposes, and connected vehicle data needs consent; UK and EU: UK GDPR Article 8A tests reuse of customer data for a new purpose

A dealership service department produces one of the most consistent records in retail. Every repair order states the customer's concern, the technician's diagnosis and the correction, with labor times and parts, and a busy store writes thousands of them a year.

That structure suits AI buyers building diagnostic and service agents. The deal jackets and CRM records next to it are financial records under federal law, so dealers need to separate the two before any buyer conversation.

## What dealership data do AI companies buy?

AI companies buy dealership data that shows expert diagnosis and process. Repair orders and technician notes are the strongest asset, followed by the procedures and training materials your managers wrote.

| Record | Typical risk | Our usual recommendation |
| --- | --- | --- |
| Repair orders and technician notes | Customer names, VINs and contact details | De-identify, then license |
| Warranty claim narratives | Manufacturer agreement terms | Check the dealer agreement |
| F&I procedures and training | Low if written in-house | License |
| Sales and BDC process records | Customer personal information | De-identify carefully |
| Deal jackets and credit applications | GLBA and FCRA | Exclude |
| Connected vehicle and telematics data | Precise geolocation and consent | Exclude |

Our guide to [selling CRM data](https://sellmydatatoai.net/guides/sell-crm-data-for-ai-training) covers sales and BDC records, and [CRM and sales data](https://sellmydatatoai.net/buy-ai-training-data/crm-and-sales-data) sets out what buyers check.

## Who buys dealership data?

No buyer whose terms are public publishes a dealership price or program. [Handshake AI](https://sellmydatatoai.net/data-buyers/handshake-ai) lists retail among the industries it buys operational data from, and [micro1](https://sellmydatatoai.net/data-buyers/micro1) asks for CRM records and support tickets, requires 30 or more full-time staff and publishes tiers starting at $100,000 to $500,000.

micro1 also says several years of records across multiple systems is generally a stronger fit, which favors stores and dealer groups with long service histories. A [free data valuation](https://sellmydatatoai.net/data-valuation) tells you which records are in demand.

## Does GLBA apply to auto dealer data?

GLBA applies to auto dealers that arrange or provide consumer financing or leasing. The FTC's Privacy Rule, at 16 CFR 313.1(b), covers persons described in 12 U.S.C. section 5519 that are mainly engaged in selling, servicing or leasing motor vehicles, other than dealers that extend credit directly and do not routinely assign the contracts.

Under [16 CFR 313.10(a)(1)](https://www.law.cornell.edu/cfr/text/16/313.10), a covered dealer may not disclose a consumer's nonpublic personal information to a nonaffiliated third party unless it has given an initial notice and an opt-out notice, given a reasonable opportunity to opt out, and the consumer has not opted out. An AI buyer is a nonaffiliated third party.

## What does the Safeguards Rule require during a data sale?

The Safeguards Rule requires customer information to stay inside your information security program during a data sale. Its own example, at 16 CFR 314.2(h)(2)(ii), says a dealership that leases automobiles on a nonoperating basis for longer than 90 days as a usual part of its business is a financial institution for its leasing business.

The rule defines customer information as any record containing nonpublic personal information about a customer, in any form, handled by you or on your behalf. The FTC says breach notification requirements took effect in May 2024, requiring notice to the FTC no later than 30 days after discovering a breach involving at least 500 consumers' unencrypted information. Exports prepared for a buyer are customer information until they are properly [de-identified](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data).

## Is the FTC CARS Rule in force?

The FTC CARS Rule is not in force. The Fifth Circuit vacated the Combating Auto Retail Scams Rule on January 27, 2025 in National Automobile Dealers Association v. FTC, holding that the FTC had failed to issue an advance notice of proposed rulemaking. The FTC withdrew the rule in a final rule effective February 12, 2026.

The CARS Rule dealt with pricing and add-on practices rather than data sharing, so its withdrawal does not loosen any data rule. GLBA, the Safeguards Rule and state privacy laws still apply in full.

## What other dealer records need care?

Credit reports, DMV records and connected vehicle data need the most care. Under 15 U.S.C. section 1681b(f), a person may not use or obtain a consumer report for any purpose the FCRA does not permit. Under 18 U.S.C. section 2721(c), most authorized recipients of motor vehicle record information may resell or redisclose it only for a use the Driver's Privacy Protection Act permits.

Connected vehicle data has drawn FTC action. On January 14, 2026, the FTC finalized an order against GM and OnStar over allegations that they sold precise geolocation and driving behavior data without consent, requiring affirmative express consent before collecting, using or sharing connected vehicle data for 20 years. Leave telematics out of any package.

> **Start in the service lane** Repair orders, technician notes and procedures carry the expert value and far less financial data than the sales side. Remove names, contact details, VINs and plates by a documented method, then add de-identified sales process records only once the service package is clear.

## If you hold UK or EU data

UK dealers apply UK GDPR. Article 8A, fully in force from February 5, 2026, tests whether reusing customer data for a new purpose is compatible with the purpose it was collected for, weighing the link between purposes, the context of collection and the possible consequences for customers.

Telematics location data is an identifier under UK GDPR Article 4(1), so UK connected vehicle data should stay out as well.

## How do you sell dealership data through Sell My Data To AI?

You start with a consultation about your dealer management system, CRM, service history and stores. Sellers pay nothing to be assessed. We charge a success fee only when a deal completes, agreed in writing before we introduce you to any buyer.

Every buyer is verified for company identity, intended use, security and retention commitments and onward transfer limits before seeing a sample. You approve every buyer, every sample and every license term. [Book a consultation](https://sellmydatatoai.net/book-a-consultation?side=seller) to start.

## Frequently asked questions

### Can a car dealership sell customer data to AI companies?

A dealership that arranges financing should not license identifiable customer data. The FTC's Privacy Rule bars sharing nonpublic personal information with nonaffiliated third parties without notice and an opt-out, and the Safeguards Rule requires that information to stay inside your security program. Repair orders and procedures with customer details removed are the realistic asset. Take independent legal advice.

### Is the FTC CARS Rule still in effect?

No. The Fifth Circuit vacated the CARS Rule on January 27, 2025 in National Automobile Dealers Association v. FTC, because the FTC had not issued an advance notice of proposed rulemaking. The FTC withdrew the rule in a final rule effective February 12, 2026. GLBA, the Safeguards Rule and state privacy laws still apply.

### Are repair orders valuable to AI buyers?

Repair orders suit buyers building diagnostic and service agents, because each one records a concern, a diagnosis and a correction in a consistent structure. No buyer publishes a price for them. Volume, years of history and the quality of technician notes decide value. Remove customer names, contact details, VINs and plates before any sample.

### Can we include connected vehicle data?

Leave connected vehicle data out. In January 2026 the FTC finalized an order against GM and OnStar over alleged sales of precise geolocation and driving behavior data without consent, requiring affirmative express consent before collecting, using or sharing connected vehicle data. The CCPA also treats precise geolocation as sensitive personal information.

## Sources

- [16 CFR 313.1: purpose and scope (Privacy of Consumer Financial Information)](https://www.law.cornell.edu/cfr/text/16/313.1), Legal Information Institute, Cornell Law School, accessed November 2026
- [16 CFR 313.10: limits on disclosure of nonpublic personal information to nonaffiliated third parties](https://www.law.cornell.edu/cfr/text/16/313.10), Legal Information Institute, Cornell Law School, accessed November 2026
- [16 CFR 314.2: definitions (Standards for Safeguarding Customer Information)](https://www.law.cornell.edu/cfr/text/16/314.2), Legal Information Institute, Cornell Law School, accessed November 2026
- [FTC Safeguards Rule: what your business needs to know](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know), Federal Trade Commission, accessed November 2026
- [National Automobile Dealers Association v. Federal Trade Commission, No. 24-60013 (5th Cir. 2025)](https://law.justia.com/cases/federal/appellate-courts/ca5/24-60013/24-60013-2025-01-27.html), Justia (US Court of Appeals for the Fifth Circuit opinion), accessed November 2026
- [Revision of Negative Option Rule, withdrawal of CARS Rule and removal of Non-Compete Rule (91 FR, February 12, 2026)](https://www.govinfo.gov/content/pkg/FR-2026-02-12/html/2026-02866.htm), Federal Register (Federal Trade Commission), accessed November 2026
- [15 U.S. Code section 1681b: permissible purposes of consumer reports](https://www.law.cornell.edu/uscode/text/15/1681b), Legal Information Institute, Cornell Law School, accessed November 2026
- [18 U.S. Code section 2721: prohibition on release and use of certain personal information from state motor vehicle records](https://www.law.cornell.edu/uscode/text/18/2721), Legal Information Institute, Cornell Law School, accessed November 2026
- [FTC finalizes order settling allegations that GM and OnStar collected and sold geolocation data without consumers' informed consent](https://www.ftc.gov/news-events/news/press-releases/2026/01/ftc-finalizes-order-settling-allegations-gm-onstar-collected-sold-geolocation-data-without-consumers), Federal Trade Commission, accessed November 2026
- [California Civil Code section 1798.140: definitions (CCPA)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140.&lawCode=CIV), California Legislative Information, accessed November 2026
- [Data partnerships](https://joinhandshake.com/ai/data-partnerships/), Handshake, accessed November 2026
- [Data partnerships](https://www.micro1.ai/data-partnerships), micro1, accessed November 2026
- [UK GDPR Article 8A: purpose limitation, further processing](https://www.legislation.gov.uk/eur/2016/679/article/8A), legislation.gov.uk, accessed November 2026
- [UK GDPR Article 4: definitions](https://www.legislation.gov.uk/eur/2016/679/article/4), legislation.gov.uk, accessed November 2026

---

Book a free consultation: https://sellmydatatoai.net/book-a-consultation