The FTC 500-Consumer Notification: How the 30-Day Clock Works for Dealers

Since May 13, 2024, the FTC Safeguards Rule has included a breach reporting requirement. If a covered dealership discovers a notification event involving the information of at least 500 consumers, it must notify the FTC as soon as possible and no later than 30 days after discovery.

Thirty days sounds like plenty of time. In practice, the first week of an incident goes to containment, forensics, insurance calls, and keeping the store open. If nobody has thought about the FTC report in advance, the deadline arrives quickly. This post walks through how the requirement works and what to put in place before you need it.

As always, coverage depends on what your dealership does. Most stores that arrange financing or lease vehicles are treated as financial institutions under the rule, but confirm your situation with counsel.

What counts as a notification event

The rule defines a notification event in 16 CFR 314.2 as the acquisition of unencrypted customer information without the authorization of the person it belongs to. Three details matter:

• Encryption has a catch. Customer information counts as unencrypted if the encryption key was accessed by an unauthorized person. Encrypted data with a stolen key is treated like plain data.
• Access is presumed to be acquisition. If someone gained unauthorized access to unencrypted customer information, the rule presumes they acquired it, unless you have reliable evidence showing they did not or could not have.
• Customer information is broad. It covers nonpublic personal information about your customers in any form: credit applications, deal jackets, Social Security numbers, driver's license details, bank account information.

That presumption is why logging matters. If an attacker was inside your DMS or file server and you have no logs showing what they touched, you probably cannot produce reliable evidence that they did not take customer data.

When the clock starts

Under 314.4(j)(2), a notification event is treated as discovered on the first day it is known to you. And you are deemed to know if any employee, officer, or other agent knows, other than the person committing the breach.

Read that carefully. The clock does not start when the dealer principal hears about it, or when the forensics report comes back. It can start when a salesperson notices something wrong, or when your IT provider sees the alert. That is a strong reason to make sure staff and vendors report suspicious activity immediately and that someone records the date.

What the report includes

The notice goes to the FTC electronically through an online form on the FTC's website. Under 314.4(j)(1), it must include:

1. The name and contact information of the dealership
2. A description of the types of information involved
3. The date or date range of the event, if it can be determined
4. The number of consumers affected or potentially affected
5. A general description of the event
6. Whether a law enforcement official has provided a written determination that public notice would impede a criminal investigation or damage national security, and how the FTC can contact that official

The FTC's guidance says that if you do not yet know some details, report what you know and submit an update later. It also notes that your report may be made public, for example in a public listing or in response to a records request.

Law enforcement delay

If law enforcement determines in writing that public disclosure would impede a criminal investigation, the rule allows an initial delay of up to 30 days after notice is provided to the FTC, which can be extended in writing for up to 60 more days, with further delay only if FTC staff agrees. That is a delay of public disclosure, not a reason to skip the report.

This is separate from other notices

The FTC report is one obligation. State breach notification laws, including Ohio's, may separately require notice to affected individuals and sometimes to state officials, on their own timelines. Your lender partners, your insurer, and your contracts may add more. Your counsel coordinates those. Your job is to make sure the facts they need are available fast.

What to build before it happens

The rule already requires a written incident response plan under 314.4(h) for institutions with information on 5,000 or more consumers. Put the FTC notification step into it explicitly:

• Name who decides. Identify who determines whether an event is a notification event, usually with counsel and the Qualified Individual.
• Record the discovery date. Make it a standard first step in any incident: write down when and how the event was first known, and by whom.
• Know your counts. You should be able to estimate how many consumers' records sit in each system. Your data inventory under 314.4(c)(2) is where that number comes from.
• Keep logs you can use. Monitoring and logging of authorized user activity is already required by 314.4(c)(8). Make sure logs are retained long enough and stored where an attacker cannot erase them.
• Know what is encrypted. If a stolen laptop or backup was encrypted and the key was not exposed, that changes the analysis. Document where encryption is in place and where keys live.
• Pre-stage contacts. Your insurer's breach line, outside counsel, forensics firm, and the FTC reporting form link belong in the plan.

Practice the decision

A tabletop exercise is the best way to find out whether this works. Walk through a realistic scenario, such as a compromised F&I email account with credit applications in the mailbox, and ask: When did we discover it? How many customers are involved? Was any of it encrypted? Who files the FTC report, and by when? The gaps you find in a conference room are much cheaper than the ones you find during an incident.

How we help

TRNSFRM works with Ohio dealerships on Safeguards programs, including incident response plans and the logging that makes the 30-day decision possible. See our FTC Safeguards overview and automotive page. For the full text of the rule's guidance, the FTC's Safeguards Rule business guide is the best primary source.

To check where your store stands, use the free compliance checklist, or book a free 45-minute Compliance Gap Audit.