More than two decades ago, the Federal Trade Commission compiled common questions and answers to help dealerships adhere to its Privacy Rule.

Ignite Dealer Compliance Group recently said it is getting more questions about privacy notices, which firm experts explained as “an obligation from your dealership to your customers.”

In its online Q&A, the FTC maintained that its Privacy Rule applies to dealers who might:

—Extend credit to someone (for example, through a retail installment contract) in connection with the purchase of a car for personal, family, or household use

—Arrange for someone to finance or lease a car for personal, family, or household use

—Provide financial advice or counseling to individuals

“Your privacy notice isn’t harmless ‘boilerplate,’” Ignite Dealer Compliance Group said in a recent industry message. “It is a commitment you make to (customers) as well as every regulator that oversees your business, and it presents hidden risk if it is wrong.”

Firm experts said they have reviewed privacy notices from a variety of operators, spotting multiple issues.

“Sometimes the notice says the dealer doesn’t share personal information when it actually does. Or maybe the dealer’s practices require it to give the consumer an opt out right, but that right is missing from the notice,” Ignite said.

“In some instances, the dealer didn’t realize it had a continuing obligation to provide annual updates. On one occasion we even found that the representations made in the notice given at the time of sale differed from the notice posted on the dealership’s website,” the firm continued.

The FTC also pointed out that unless your customer purchased a vehicle for cash and did not need financing, privacy notices are in play because third parties could be involved in the process.

“Often, our clients ask us, ‘Is our privacy notice right?’ Our answer is usually, ‘It depends,’ because we can’t know the answer unless we study the underlying practices and information-sharing arrangements the dealer has made to determine whether the document is accurate,” Ignite said.

“We only know what the document in front of us says. We work together with our client to ensure the privacy notice truly reflects their actual practices and any relationships they may have with third parties,” experts continued.

“That chasm between what the notice says and what your dealership actually does is filled with risk. Plaintiffs’ lawyers will call it a deceptive act or practice and pursue claims that can cost the dealership significantly. Regulators are quick to punish this kind of behavior,” Ignite went on to say.

“Don’t take this issue for granted. Put in the work and compare your notice to your practices and dissect any relationships involving customer information to make sure your conclusions are correct,” the firm added.

For more information and assistance, send a message to Ignite at [email protected].