AI Compliance Checklist for Car Dealerships

Automation does not change the rules. It changes how fast you can break them, and how many customers are affected before anyone notices.

Almost nothing on this page is a new law. Consent requirements for automated messaging, recording consent, fair lending, advertising substantiation and data security obligations all existed long before a dealership could ask software to write a follow up text.

What changed is scale and speed. A salesperson working a list by hand makes mistakes one customer at a time and usually notices. A system running a cadence across nine thousand records makes the same mistake nine thousand times before anyone reads a complaint. The exposure is not that the software is careless. It is that the software is obedient, and it will do exactly what you configured at three in the morning without ever asking whether it should.

So the discipline shifts from training people to reviewing configuration. Every automated sequence is effectively a policy decision, and it deserves the same scrutiny you would give a printed advertisement. The stores that get in trouble here are rarely the ones that decided to cut a corner. They are the ones where nobody could say who turned a campaign on, what audience it was pointed at, or what it said.

One necessary caveat before the checklist. This is operational guidance written by a software vendor, not legal advice. Rules vary by state and change, and your counsel is the one who signs off.

The first item is the one that generates the litigation. Automated or mass text and call programs sit under consent rules, and the practical questions to answer for every audience you contact are simple to state and frequently unanswerable in real stores.

Where did this contact come from? What did the person agree to at the moment they gave you their number, and can you produce that record with a date attached? Is the consent for the specific type of contact you are about to send, or are you stretching a service reminder permission into a sales campaign? Has anything happened since that should have removed them from the list?

Then the mechanical requirement: honoring opt outs immediately, everywhere, without exception. This is where multi vendor stacks fail. A customer replies stop to a message from one system, and a different system with its own database texts them again next week. Keeping opt out status in one place is not merely tidy, it is the whole control.

LeadLocate keeps a blacklist with import, honors opt outs across the messaging tools, and holds customer consent state on the customer profile. SecureWebX adds a compliance module with versioned consent, so you can show which version of a disclosure a customer actually agreed to rather than which version is live today. Our page on consent management goes further into record keeping.

Several states have moved toward requiring disclosure when a consumer is interacting with automated software rather than a person, and the direction of travel across regulators has been consistent even where a specific statute has not landed yet. Beyond the legal question there is a commercial one. Customers find out eventually, and finding out late feels like being tricked.

The workable standard is plain and early. If an assistant sends the first text, the message identifies the store and makes clear the customer can reach a person. If an interactive voice system answers, the caller learns quickly how to get to a human and is not trapped in a loop. Nobody at your store should ever be instructed to let a customer believe software is a named employee.

Practically, write your disclosure once, store it as a template rather than as something each user types, and version it. When it changes, you want to know which customers saw which wording. That is exactly the problem versioned consent solves, and it is the difference between answering a complaint in ten minutes and spending a week reconstructing history from screenshots.

Call recording is enormously useful for coaching and dispute resolution, and it is regulated differently depending on where the parties are. Some states require only one party to consent, others require all parties, and a dealership near a state line, or any store taking calls from out of market shoppers, cannot assume the caller is local.

The safe operating posture most stores land on is to announce recording at the start of every call, on every line, inbound and outbound, without trying to be clever about jurisdiction. Announcements can live in the interactive voice response greeting so they are not left to whoever picks up.

Then treat the recordings themselves as sensitive records. Decide who can listen, decide how long you keep them, and write both down. Call transcription makes review far more practical, since a manager can read a twelve minute call in half a minute, but a searchable transcript of a customer reading their address and employment details out loud is also a data asset you now have to protect. Access control and retention are not optional extras once transcripts exist.

This one catches marketing people by surprise, because ad platforms make it easy to do the wrong thing in three clicks.

Financing related campaigns run under fair lending rules. That means an audience for credit related advertising may not be narrowed by age, gender, income, marital status, household size, education, language or ZIP code. The ZIP restriction is the one dealers trip over most, because geographic targeting feels obviously reasonable and is exactly what the rules are designed to prevent in a credit context.

The correct approach is to keep credit related messaging broad and let the consumer self select, rather than trying to guess who is subprime and speak to them differently. Our subprime leads page explains how this works on the lead side, where campaigns run under those constraints deliberately.

The same care applies to what the message says. Payment claims, approval language and rate examples all carry advertising substantiation obligations. Never let automated copy promise approval, and never let a template imply a result the customer controls. If a sequence needs a disclosure, the disclosure belongs in the template, not in a manager's memory.

Every dealership handles nonpublic personal information, which brings the safeguards obligations that already apply to your credit applications and your customer files. Adding automation does not create a new category of data, but it usually increases how much of it moves around.

Work through four questions for any tool you are considering. What customer data does it receive? Where is that data stored and for how long? Who inside your store can see it, and can you prove that after the fact? And does the vendor send data anywhere else, including to a subprocessor, as part of how the product works?

On our side: personally identifiable information on the customer profile is stored encrypted, user management is role based so access is granted rather than assumed, and there is a login log, which matters more than most stores think until the week a salesperson leaves for a competitor and somebody asks what they could reach. Credit application intake, identity verification at intake and document collection live in SecureWebX rather than in a shared email inbox, which is where this data most often ends up in stores that never made a decision about it. See safeguards rule compliance for the wider program.

Automation should handle volume, not judgment. The line worth drawing is that software may initiate, remind, route and inform, while a person handles anything involving a number, a commitment or a complaint.

Three rules hold up well in practice. First, any customer expressing frustration or asking a question the sequence was not built for goes to a person immediately, and the sequence stops. Second, no automated message quotes a payment, an approval, a trade value or a delivery promise. Third, someone reviews what went out, weekly, by reading actual sent messages rather than a summary count.

That last one is where most stores are weakest, and it takes about twenty minutes. Pull a sample of what your automations sent, read it as a customer would, and check that a person picked up where the software stopped. Activity reporting, call transcription and the deal visit log make that a reading exercise rather than an investigation.

Your compliance exposure includes your vendors, and answers given verbally in a demo have a way of evaporating. Ask these and keep the responses.

What exactly does your system say to my customers, and can I see and edit every template? How do you record consent, and can you show me the version a specific customer agreed to? How are opt outs handled, and do they propagate everywhere within seconds? What data do you hold, where, and for how long? Who at your company can access my customer records? What happens to my data if I leave, in what format, and how quickly? Do you carry insurance relevant to a data incident, and what is your notification process?

Then a practical one people forget. If your automation makes a mistake on my customers, how do I find out, and how do I stop it at two in the morning? Every vendor should have an answer. Not all of them do. Our compliance document management page covers where the paperwork itself should live.

Print this and work it once a quarter with your general manager and whoever owns marketing.

1. Every automated audience has a documented consent basis with a date, and you can produce it.
2. Opt outs are honored instantly across every system that can contact a customer, with one shared list.
3. Automated conversations disclose that they are automated and offer a fast path to a person.
4. Recording is announced on every line, and transcripts are access controlled with a written retention period.
5. No credit related audience is narrowed by a protected characteristic, and that includes ZIP code.
6. No automated message promises approval, payment, trade value or any outcome the customer controls.
7. Disclosures live in versioned templates, not in individual users' habits.
8. A named person reads a sample of outbound automated messages weekly.
9. Access to customer data is role based, logged and reviewed when staff leave.
10. Every vendor has answered the due diligence questions in writing, and you know how to shut their automation off yourself.

None of this makes a store slower once it is set up. It makes the store defensible, which is a different thing, and the whole program costs less attention than one complaint handled badly. If you want to see how consent, opt outs, templates and review look inside the platform, contact us and we will walk it. Pricing is on the pricing page, month to month, no long term contract.

Is this legal advice?

No. It is operational guidance from a software vendor, written to help you ask better questions. Rules vary by state and change over time, so your own counsel or compliance officer makes the final call on every item here.

Do we have to tell customers they are texting with software?

Disclosure requirements are moving in that direction and several states have acted. Beyond the legal question, customers find out eventually, so the practical standard is to identify the store, make the automated nature clear, and offer a fast path to a person.

How are opt outs handled across multiple systems?

Badly, unless you consolidate. The control that actually works is one shared opt out list honored everywhere. Inside LeadLocate that is the blacklist plus consent state on the customer profile, applied across messaging and campaigns.

Can we target subprime shoppers with a financing campaign?

Not by narrowing an audience on protected characteristics, and that includes age, income, marital status, language and ZIP code. Keep credit related messaging broad and let consumers self select. That is how our financing campaigns are built.

Does call transcription create a compliance problem?

It creates a data protection responsibility. Transcripts are extremely useful for coaching and dispute resolution, and they also contain sensitive customer detail, so set access control and a retention period before you turn review loose on the whole team.

What should we ask a vendor before signing?

How consent is recorded and versioned, how fast opt outs propagate, what data they hold and where, who on their side can see it, what you can export if you leave, and how you personally stop their automation at two in the morning.

We will show you where consent is recorded, how opt outs propagate, and how a manager reviews what automation actually sent. Month to month, no long term contract.