Skip to main content
a promotional graphic telling you that PCI Compliance is no longer an annual exercise and that continuous monitory must be built in
California CARS Act Compliance for Auto DealersRetention & Scheduling
5 min readFor Records Managers

California CARS Act Compliance for Auto Dealers

Scope

This guide outlines the recordkeeping requirements under California's Combating Auto Retail Scams Act (Civil Code §1784.1 et seq.), effective October 1, 2026. It's designed for records managers and compliance officers at motor vehicle dealerships licensed in California, as well as out-of-state dealers marketing to California buyers.

You'll learn about the specific record types you must retain, applicable retention periods, enforcement details, and technical requirements for preserving dynamic web content. If your dealership operates outside California but markets vehicles to California residents, consult legal counsel to determine if you meet the Vehicle Code's definition of "dealer."

Key Concepts and Definitions

Record creation date: The CARS Act's two-year retention period begins when a record is created, not when a vehicle is sold. For example, a vehicle detail page (VDP) captured on October 1, 2026, must be retained until September 30, 2028, even if the vehicle remains unsold.

Total price: Dealers must display a total price in advertisements and listings for specific vehicles. This requirement is central to inquiries and enforcement actions.

Written communication: Includes emails, text messages, and any written response to a consumer's price inquiry about a specific vehicle. You must respond in writing, retain the communication for two years, and provide a copy upon request.

Add-on documentation: Records must show that an add-on benefits the buyer. Charging for add-ons that offer no benefit, like oil changes for an electric vehicle, is prohibited.

Defensible web record: A complete capture of a web page as it appeared on a specific date, including page source, interactive elements, timestamp, and a cryptographic hash to prove the file's integrity.

Requirements Breakdown

Mandatory Record Types and Retention Periods

Record Type What It Includes SB 766 Retention Longer Rules That May Apply
Advertisements and listings Online ads, VDPs, and listings referencing a specific vehicle, including the total price shown 2 years from creation SB 766 only
First written price communications External emails, texts, and written replies to a consumer's price inquiry about a specific vehicle 2 years from creation SB 766 only
Purchase, finance, and lease documents Signed contracts and related disclosures 2 years from creation Financed sale contracts: 7 years or more under Civil Code §2984.5
Add-on documentation Records showing the add-on benefits the buyer, and the disclosures given 2 years from creation SB 766 only
Cancellation records Cancellation requests, refund evidence, and returned trade-in records 2 years from creation SB 766 only
Complaints and inquiries Written complaints and inquiries about add-ons and vehicles, and the dealer's responses 2 years from creation SB 766 only

Overlapping Retention Obligations

The CARS Act doesn't override existing retention requirements. Civil Code §2984.5 mandates retaining documents for financed sales for seven years or more. Your Records Control Schedule should assign each record the longest applicable retention period.

Enforcement Landscape

The Act has multiple enforcers: city attorneys, county district attorneys, the California Attorney General, and the Department of Motor Vehicles. Consumers can't sue directly under the Act but can use California's Unfair Competition Law and Consumers Legal Remedies Act. Typically, the first request in an investigation is for the dealer's records.

Violations can result in civil penalties of up to $2,500 per violation. Additional penalties apply if affected buyers are seniors, disabled persons, service members, or veterans. Penalties are counted per violation, so a missing total price on one VDP template can multiply across listings.

Implementation Guidance

Web Accessioning Requirements

A screenshot captures the page image but omits the page source, interactive elements, and evidence linking the image to a specific time. It won't stand up in an enforcement action.

A defensible advertising record requires:

  1. Complete page capture: Full page source, not just a rendered image.
  2. Timestamp: Verifiable record of when the page was captured.
  3. Cryptographic hash: SHA-256 or equivalent, proving the file hasn't been altered.
  4. Replay capability: The record must replay the page with all original dropdowns, calculators, and disclosures intact.
  5. WORM storage: Write Once, Read Many storage prevents post-capture modification.

Schedule-Based Capture

VDP prices, incentives, payment calculators, and disclosures can change frequently. Manual spot-checks can't keep pace. Set a capture schedule that balances your inventory changes against storage costs. Daily captures work for most dealerships; high-volume operations may need more frequent intervals.

Three-Day Cancellation Records

Buyers or lessees of used cars priced at $50,000 or less can cancel the transaction within three days. Retain records of each cancellation, including the request, refund evidence, and records of any trade-in returned to the buyer. Although the law doesn't specify how to document the vehicle's condition at delivery, that record often determines if the returned vehicle was in the same condition.

Lender Requirements

The FTC Holder Rule states that any claims a buyer has against the dealer also apply to the lender holding the contract. If you can't produce the advertisement or price communication for a contested sale, that gap becomes the lender's liability. Some California credit unions now require dealer partners to certify they retain SB 766 records for two years.

Common Pitfalls

Treating the sale date as the retention trigger: The two-year period starts when a record is made, not when a car is sold. A VDP for a vehicle that never sells still requires two years of retention from the date it was created.

Relying on screenshots: A screenshot won't replay interactive elements or prove it matches what appeared on a specific date. You need the full page source and a cryptographic hash.

Ignoring template-level errors: A missing total price on one VDP template repeats across every listing that uses it. Penalties are counted per violation, and courts weigh how many violations occurred and how long they went on.

Failing to monitor for compliance: As inventory grows and pages change daily, manual spot-checks become impractical. Automated monitoring can review captured pages against the rules you set and alert you when a page is missing a required element.

Overlooking longer retention periods: The CARS Act adds a two-year requirement on top of existing obligations. Civil Code §2984.5 requires seven years or more for financed sale contracts. Your Records Control Schedule must reflect the longest applicable period.

Quick Reference Table

If you receive... You must produce... Within...
Request for specific VDP Complete page capture with timestamp and hash Timeline set by requesting party or counsel
Inquiry about advertised price VDP as it appeared on the date in question, with interactive elements intact Timeline set by requesting party or counsel
Written price inquiry from consumer Copy of your written response Upon written request from consumer
Complaint about add-on Documentation showing the add-on benefits the buyer, plus disclosures given Timeline set by requesting party or counsel
Cancellation request Request, refund evidence, and trade-in return records Timeline set by requesting party or counsel

When a request arrives, involve counsel immediately. A dealer that can show what each listing displayed, and when, can limit an inquiry to the listings at issue. A dealer without those records has no way to show the error was isolated or corrected.

California Attorney General California's Unfair Competition Law

a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.

You Might Also Like