A customer data request should not send the GM through four vendor contracts, three privacy policies and an OEM support queue. This nine-rule policy identifies who has the data, why the store holds it and who handles deletion requests.
A customer emailed the dealership:
“Under California law, delete my connected-car location data from your systems.”
The store had no clean answer.
Four vendors had access to different customer and vehicle data. Nobody had a consent record. The CRM showed the VIN but not the connected-service enrollment. The OEM held data the dealership did not control.
The first request took 11 hours.
Most of those hours went into identifying which companies had which information. After the dealership built a vendor map, request procedure and retention schedule, monthly compliance work fell by six hours.
Connected-car data includes more than a VIN and phone number. A vehicle or related service might collect precise location, speed, braking, acceleration, diagnostic codes, charging history and service information.
California treats precise geolocation as sensitive personal information. The FTC has also taken action over connected-vehicle location and driving-behavior data collected and shared without adequate notice and consent.
The nine rules below give the GM one operating file instead of another privacy problem.
The Connected-Car Data Compliance Sheet
| # | Data Rule | Risk Without the Rule | Time Lost Without It | What the Rule Fixes | 30-Minute Action |
| 1 | Record consent and notice | Store cannot prove what the customer saw or accepted | 2.5 hours | Logs notice, choice, date and version | Add consent fields |
| 2 | Map every vendor and data stream | Staff cannot identify who holds the information | 1.8 hours | Lists vendor, data, purpose and legal role | Start a vendor register |
| 3 | Set purpose-based retention | Data stays longer than the business needs | 1.2 hours | Assigns owner and deletion event to each category | Build a retention table |
| 4 | Create a privacy-request SOP | Staff misses verification, routing or response steps | 2 hours | Provides intake, identity check and vendor workflow | Create two templates |
| 5 | Separate service use from marketing permission | Service data moves into an unrelated campaign | 1 hour | Keeps each purpose and contact consent separate | Split the choices |
| 6 | Restrict employee access | Too many employees view sensitive data | 0.9 hour | Uses role-based access and review logs | Audit user permissions |
| 7 | Give notice before dealership collection | Customer never sees what the store collects | 0.7 hour | Places notice at the collection point | Add approved notice |
| 8 | Ban unauthorized sale or sharing | Vendor or store uses data outside the stated purpose | 1.5 hours | Blocks resale and secondary advertising use | Update policy and contracts |
| 9 | Audit vendors and contract exits | Former vendor keeps data after termination | 1 hour yearly | Requires return, deletion and certification | Add contract language |
The dealership’s obligations depend on the data involved, the state, the store’s legal role and whether the dealership is covered by the applicable privacy law. The OEM, dealer and vendor might each control separate data.
#1: Record Who Agreed, What They Saw and When
A checkbox marked “accepted” does not prove informed consent.
The dealership needs the notice version, collection purpose and customer action tied to a time and system.
A useful log includes:
- Customer identifier
- VIN, when relevant
- Data categories described
- Stated purpose
- Consent or opt-out choice
- Date and time
- Collection screen or document version
- Source system
- Employee or automated process involved
- Withdrawal date, when applicable
Do not store an IP address or additional identifier without a defined need. A consent log should prove the transaction without creating another oversized data file.
California residents have rights involving access, deletion, correction, sale or sharing opt-out and limits on certain uses of sensitive personal information. Precise geolocation falls within the sensitive category. Covered businesses also need notice at or before collection. Source: California Attorney General CCPA guidance.
Consent is not the only lawful basis or operational requirement in every state. Some processing supports warranty, recall, security or a requested service. Your privacy attorney should map each purpose to the applicable law and contract.
Action: Add fields for notice version, choice, timestamp and purpose. Save the wording presented to the customer.
#2: Build a Vendor Access List Before a Request Arrives
The dealership’s first deletion request took hours because staff began with vendor emails:
“Do you have any location data for this customer?”
That question arrived too late.
A dealership might interact with an OEM connected-service platform, service scheduler, mobile application, CRM integration, marketing company or data warehouse. Each party might hold a different record.
Build a register:
| Vendor or Party | Data Received | Source | Purpose | Legal Role | Contract End | Request Contact |
| OEM platform | Location and diagnostics | Vehicle | Connected services | Determine with counsel | Ongoing | Privacy portal |
| Service integration | VIN and diagnostic alert | OEM feed | Schedule service | Determine with counsel | Dec. 2026 | Vendor privacy team |
| CRM | VIN and contact details | Dealer | Customer follow-up | Dealer-controlled record | Ongoing | CRM administrator |
| Marketing platform | Contact and campaign activity | CRM | Advertising | Determine with counsel | June 2027 | Compliance contact |
Do not assume every vendor receives precise location. Ask for a written data inventory and data-flow diagram.
Also identify whether the dealership controls the data. The OEM might operate as a separate business for its telematics program. The dealership might have no authority to delete the OEM’s independent record.
Your response should explain which records the dealership handled and where the customer needs to contact another party.
Action: Send each provider five questions: What data do you receive, why, from whom, for how long and how do you process a consumer request?
#3: Replace “Keep Forever” With Purpose-Based Retention
There is no universal federal rule requiring location deletion after 90 days or driving-behavior deletion after one year.
A fixed 90-day period might be too long for one use and too short for another. “Keep VIN forever” creates the same problem.
Set retention by purpose.
| Data Category | Business Purpose | Retention Trigger | Owner | Deletion Method |
| Precise location | Approved connected service | Purpose ends or account closes, subject to exceptions | Privacy lead | Vendor and system deletion |
| Driving behavior | Approved service or program | Program end plus defined legal period | Program owner | Automated deletion |
| Diagnostic alert | Service response | RO closure plus approved period | Service Director | System rule |
| Consent record | Prove notice and choice | Legal schedule set by counsel | Compliance | Controlled archive |
| VIN and transaction record | Sale, title, warranty and accounting | Applicable recordkeeping schedule | Controller | Records policy |
A deletion request does not always require deletion of every record. California lists exceptions involving transaction completion, warranty and recall work, security, legal obligations and legal claims.
Do not let a service advisor decide the exception. The request owner should document the category retained, the reason and the customer response.
Action: Create a one-page retention table. Give every data category an owner, trigger and approved exception.
#4: Use a 48-Hour Internal Acknowledgment, Not a Fake Legal Deadline
The brief says California requires a response within 48 hours.
California’s Attorney General states covered businesses generally have 45 calendar days to respond to requests to know or delete. An additional 45 days is available in some circumstances when the business notifies the consumer. Opt-out requests follow a different timeline. Source: California Attorney General request guidance.
A 48-hour acknowledgment is still a good dealership service rule.
Use this opening response:
“We received your privacy request on [date]. We are verifying your identity and identifying records held by the dealership and relevant service providers. We will respond within the period required by applicable law.”
Do not promise immediate deletion before verifying identity and checking exceptions.
The SOP should include:
- Date-stamp the request.
- Identify the right requested.
- Confirm which law and deadline apply.
- Verify identity using an approved method.
- Search dealership systems.
- Notify relevant service providers or contractors.
- Separate dealer-controlled records from OEM-controlled records.
- Review retention exceptions.
- Send the final response.
- Keep a request log.
Create a second vendor message:
“The dealership received a verified request involving [identifier]. Please confirm whether you hold dealer-provided personal information, complete the required action under our agreement and return written confirmation by [date].”
Action: Set a 48-hour internal acknowledgment target. Track the legal response deadline separately.
#5: Service Permission Does Not Authorize Sales Marketing
A customer agrees to receive a diagnostic alert after the vehicle reports a battery problem.
The dealership later places the same customer into a sales campaign based on driving or location data.
The original service purpose does not automatically cover the marketing use.
Create separate choices:
“Send service and safety updates related to my vehicle.”
“Send dealership marketing offers by text.”
Neither choice should be preselected.
If the dealership sends marketing calls or texts, TCPA and state communication rules might apply. Connected-data privacy and marketing-contact consent are related issues, but they are not the same legal test.
The FTC CARS Rule should not appear as the legal basis in a 2026 policy. The FTC withdrew the rule after a federal court decision. Existing privacy, advertising and communication laws still apply. Source: FTC withdrawal of the CARS Rule.
Action: Give service processing, connected-feature enrollment and marketing contact separate language and records.
#6: Give Location Access Only to Employees With a Job Need
Twenty-two dealership employees do not need access to precise customer location.
Most salespeople need customer contact details, vehicle interest and follow-up tasks. They do not need a map of where a customer drove.
Use role-based access:
| Role | Location Data | Diagnostic Alerts | Contact Data | Consent Log |
| Salesperson | No | No | Assigned customers | Limited |
| BDC rep | No | Limited task only | Assigned leads | Limited |
| Service advisor | Only when required for approved service | Yes | Service customers | Limited |
| Service Director | Approved service need | Yes | Yes | Review |
| Privacy or compliance lead | Request handling only | Request handling only | Yes | Full review |
The GM should not receive permanent access merely because of title. Grant access according to a documented business need.
Review access quarterly and after job changes. Remove access when an employee transfers or leaves.
Audit logs should record who viewed, exported or changed sensitive data. A permission rule without logs leaves no evidence after misuse.
Action: Export the current user-role report. Remove connected-data permissions from roles lacking a written purpose.
#7: Put the Notice Where the Dealer Collects the Data
Adding one sentence to a buyer’s order does not solve every telematics disclosure issue.
The right notice belongs at or before the dealership’s collection point. The OEM remains responsible for its own collection and enrollment process.
If the dealership collects connected data through a service-enrollment screen, mobile app or dealership form, the notice should identify:
- Categories collected
- Purpose
- Expected retention
- Sale or sharing practices, when applicable
- Parties receiving the data
- Link to the full privacy policy
- Method for exercising privacy rights
Use plain language:
“If you enroll in this dealership service, we collect your VIN and vehicle diagnostic alerts to contact you about requested maintenance. Review our privacy notice for retention, sharing and your choices.”
Do not claim the dealership collects live location when it does not. Overbroad wording confuses customers and weakens the data inventory.
The FTC’s connected-vehicle case against GM alleged inadequate notice and affirmative consent involving precise geolocation and driving-behavior data. Source: FTC action involving GM and OnStar.
Action: Map each dealership collection screen to an attorney-approved notice. Do not bury the only disclosure in the deal jacket.
#8: Ban Unauthorized Sale, Sharing and Secondary Use
The FTC alleged GM and OnStar collected and sold precise geolocation and driving-behavior data without adequate notice and affirmative consent. The data reportedly went to consumer reporting agencies and affected insurance decisions.
Your dealership policy should be direct:
“The dealership does not sell precise vehicle-location or driving-behavior data. Service providers must not sell, share for unrelated advertising or use dealer-provided data for their own purposes except where a written agreement and applicable law permit.”
Do not write “we never share data” if the store sends information to service providers. Privacy wording must match actual flows.
California also distinguishes between disclosure to a contracted service provider and sale or sharing under the CCPA. Counsel should classify each relationship.
The policy needs enforcement:
- Contract restriction
- Vendor due diligence
- Subprocessor list
- Breach-notification duty
- Audit right
- Deletion or return clause
- Written approval for new uses
Action: Search every connected-data agreement for “sell,” “share,” “advertising,” “analytics,” “improve services” and “subprocessor.”
#9: Audit Vendors and Delete Dealer Data After the Contract Ends
A vendor contract expires.
The login stops working. The vendor still holds four years of VIN, customer and diagnostic data.
The dealership needs written exit duties before termination.
Use contract language addressing:
- Return or deletion of dealer-provided data
- Time allowed for deletion
- Backup treatment
- Legal-retention exceptions
- Subprocessor deletion
- Written deletion certification
- Cooperation with consumer requests
- Post-termination confidentiality
- Audit or evidence rights
“Delete within 30 days” is a dealership contract target, not a universal legal deadline. Some backup systems follow longer controlled deletion cycles. The agreement should identify those limits before signing.
Audit high-risk vendors annually. Lower-risk providers might follow a different schedule based on the dealership’s written risk assessment.
The annual review should compare the contract with reality. A vendor approved for VIN and diagnostic codes should not begin receiving precise location without a new review.
Action: Add a data-return and deletion exhibit to each connected-data agreement. Name the person responsible for collecting the deletion certificate.
Compliance Math: Where Six Hours Are Saved
Assume two privacy requests each month.
Before the SOP:
2 requests × 5.5 hours = 11 hours
After the workflow:
2 requests × 1.5 hours = 3 hours
Gross time difference:
11 hours − 3 hours = 8 hours
The dealership still spends about two hours each month maintaining the vendor list, reviewing exceptions and checking request logs.
Net monthly saving:
8 hours − 2 maintenance hours = 6 hours
Annual saving:
6 hours × 12 = 72 hours
Do not value the program only through avoided penalties. Faster response, smaller data inventories and tighter access reduce the cost of investigations, vendor changes and customer complaints.
The One-Page Connected-Car Data Policy
Your policy should answer nine questions:
- Which connected data does the dealership receive?
- Which systems and vendors hold each category?
- Why does the store use the data?
- What notice or choice did the customer receive?
- Who has employee access?
- How long does each category remain?
- Who handles access, deletion, correction and opt-out requests?
- Which records belong to the OEM or another independent business?
- What happens to data when a vendor contract ends?
Review the policy with privacy counsel in every state where the dealership operates or serves covered residents. A California template does not replace a multistate review.
Related Reading
6 AI Agent Approval Rules That Prevent 10 Dealer Pricing Errors a Month
9 OEM Incentive Changes That Protect $600 in Dealer Gross
Sponsored by Gas.net — powering dealership growth through intelligent data.
Alt text: “Gas.net connects franchise dealers with integrated analytics and marketing tools.”