Can our dealer management system history be licensed to AI companies, and how do we get it out?
Only with care. Dealers that arrange financing are covered by the Federal Trade Commission's (FTC's) Safeguards Rule and Privacy Rule, and, according to CDK's 2021 annual report, access to DMS data had been the subject of lawsuits, an FTC inquiry and new state laws. Vendors such as CDK and Dealertrack route outside access through their own approved programs, so check your DMS contract before any export or connection.
What lives in a DMS, and why might buyers value it?
A dealer management system (DMS) such as CDK, Reynolds and Reynolds or Dealertrack runs a dealership's core records: vehicle sales and deal files, F&I (finance and insurance) products, service repair orders, parts, inventory, accounting and customer records.
Buyers building automotive tools may value service history most: the customer's complaint, the technician's diagnosis, the repair performed, and the parts and labor used. Deal and financing records are far more sensitive and are usually the least licensable part.
Usually in scope
- Work conversations about operations
- Tickets, tasks and project histories
- Process documents and SOPs
- Orders, invoices and workflow records, de-identified
- Code repositories you own outright
Commonly left out
- HR, payroll and personnel files
- Board, legal and M&A material
- Direct messages and private channels
- Data you hold for customers under contract
- Health, financial-account or other regulated personal data
Why has DMS data access been disputed?
In its annual report for the year ended June 30, 2021, CDK described several lawsuits alleging anticompetitive agreements between CDK and Reynolds and Reynolds over control of DMS access; CDK said it believed the cases were without merit. The same report described a civil investigative demand (a formal request for documents and information) that the FTC sent CDK in June 2017 about those agreements, and laws passed in 2020 in Arizona, Montana, North Carolina and Oregon requiring certain DMS access. This page does not track what has happened since.
The practical lesson: do not assume you can hand a buyer DMS credentials or let it pull data with an unapproved tool. Your DMS contract likely says how third parties may connect.
How do exports and connections work?
As of October 2026, the vendors' public pages describe integration programs rather than self-serve bulk exports:
- CDK: third-party apps connect through the Fortellis Marketplace after certification. An authorized signer at the dealership activates and consents to each app using ConnectCDK credentials, and any limits the dealership has set on who may agree to third-party apps carry over.
- Dealertrack: its 2020 Opentrack information sheet says the platform connects the DMS with outside vendors through two-way integrations, and some partners carry a Dealertrack Certified Provider designation.
- Reynolds and Reynolds: no public Reynolds documentation on export or third-party access was found for this page. Ask your Reynolds representative.
What does the FTC Safeguards Rule mean here?
The FTC's auto dealer FAQ says dealers that finance or help arrange financing for consumers, or lease vehicles for more than 90 days, are financial institutions under its Safeguards Rule. Protected customer information includes financing and lease applications, lists of financed customers and their financial details. The FTC also says names and addresses of all buyers, aggregate sales data and service records are not covered on their own, unless combined with financing information.
Separately, the Privacy Rule requires covered dealers to give privacy notices and, unless an exception applies, an opt-out before sharing nonpublic personal information with unaffiliated companies. Service records falling outside these rules does not make them free to license; state privacy laws may still apply. Talk to your lawyer.
What should stay out?
- Credit applications, credit reports, Social Security and driver's license numbers.
- Loan and lease terms, bank details and F&I product contracts.
- Customer names, contact details, and VINs (vehicle identification numbers) linked to identifiable owners.
- Salesperson and technician pay plans.
- Manufacturer data your franchise agreement restricts.
Where should a dealership start?
Read your DMS contract and your manufacturer agreements before contacting buyers. Ask your DMS vendor in writing what export options you have and how an approved third party could access service history. Keep financing data out from the start. Our auto dealerships page has more.
Common questions
Can we give a buyer our DMS login?
Don't. DMS vendors run approved access programs, and your contract may prohibit sharing credentials. Ask your vendor how an approved third party could connect.
Are service records covered by the Safeguards Rule?
The FTC says service records alone are not customer information under the Rule, unless combined with financing information. Other privacy laws may still apply.
Does the Safeguards Rule apply to every dealer?
The FTC says it covers dealers that finance or arrange financing, or lease vehicles for more than 90 days. Check whether your dealership does either.
Can we license deal files?
Generally not. They contain financing information protected by the FTC's rules and are best excluded.
Sources
- Automobile Dealers and the FTC's Safeguards Rule: Frequently Asked Questions | FTC, accessed 2026-10-16
- FTC Safeguards Rule: What Your Business Needs to Know | FTC, accessed 2026-10-16
- CDK Global, Inc. Form 10-K for fiscal year ended June 30, 2021 | SEC, accessed 2026-10-16
- Innovative Solutions for Automotive Industry Integration | Fortellis (CDK), accessed 2026-10-16
- DMS Opentrack Info Sheet | Dealertrack, accessed 2026-10-16
General information, not legal, tax or financial advice.