Customer Data Your Shop Keeps. And the Law

The records question most shops get wrong

Every auto shop accumulates customer data. Names, phone numbers, email addresses, VINs, service history, sometimes photos of the inside of cars, sometimes stored credit card numbers. Most shops treat it casually. Data stays in the system until the system is replaced, at which point it gets migrated or lost.

That casual approach was fine 10 years ago. It's not fine today. Several US states now regulate consumer data, and the rules matter for independent auto shops. Not just for big tech.

Here's a practical guide to what you actually have to worry about.

What you're legally required to keep

Federal and state requirements vary, but for most US shops:

• Transaction records — 3-7 years depending on state, for tax/audit purposes.
• Employee records — typically 4 years for tax purposes, longer for specific safety-related records.
• Vehicle inspection records — if you do state inspections, requirements vary but typically 1-3 years.
• Repair orders with customer signatures — most states require you keep these 1-2 years minimum for consumer protection compliance.

Beyond those, there's no specific federal requirement to retain customer data.

What's changing in 2026

Several states passed or updated consumer privacy laws that affect small businesses:

• California (CCPA/CPRA): Consumers have the right to know what data you have, request deletion, and opt out of data sales. Applies if your shop has $25M+ revenue OR handles data on 100k+ consumers OR derives 50%+ revenue from selling data. Most single-location shops are exempt by revenue. But if you're a regional multi-shop, you may fall into scope. Full thresholds and obligations at the California Attorney General CCPA page.

• Virginia, Colorado, Connecticut, Utah, Texas: Similar consumer rights laws with varying thresholds. Most single-shop auto repair operations are below the revenue thresholds that trigger full compliance. The IAPP US State Privacy Legislation Tracker keeps an up-to-date map of who's covered where.

• FTC Safeguards Rule: This one applies broadly. Any business that handles "customer information" (names + financial data, like credit card numbers) has obligations around information security. This captures most auto shops that accept credit card payments. See the FTC's Safeguards Rule compliance guidance for what's actually required.

Your practical exposure as a single-shop operator is usually:

1. FTC Safeguards — you have to maintain reasonable security around customer data, especially payment data.
2. State-level data breach notification laws — you have to notify customers if their data is breached.
3. Contractual obligations — if you accept credit cards, Stripe/Visa/MC have rules you must follow (PCI-DSS).

The practical playbook

1. Don't store credit card numbers. Seriously. Don't. Use Stripe, Square, or whatever your processor is, and let them store the card data. Your system should only have the last 4 digits and a token. If you're writing credit card numbers on paper repair orders, stop immediately.

2. Keep customer records only as long as useful. For active customers (visited in last 3 years), keep everything. It helps retention. For inactive customers (5+ years no visit), you can safely purge all but basic transaction records for tax purposes.

3. Limit who has access. Techs don't need access to credit card data. Your service writer doesn't need access to payroll info. Role-based access isn't just good practice; it's a safeguards requirement if you're under FTC rules.

4. Have a data breach plan. If a laptop gets stolen or your email gets compromised, you need to know:

• Who to call (usually: local police, your insurance carrier, state AG office if regulated)
• Who to notify (usually: affected customers, within specific timeframes)
• What to do (usually: reset credentials, notify, document)

Write this down. Keep it accessible. Review annually.

5. Know what data you're collecting from DVIs. Digital vehicle inspections often collect photos. Some of those photos accidentally include license plates, personal items in cars, or reflections of people. Train techs to frame shots that show the vehicle part, not the interior of the car. Delete incidental personal info.

What customer rights to actually expect

Even if you're below the threshold of state privacy laws, customers occasionally ask:

• "Can you delete my data?" — Say yes. Delete their customer record (or anonymize it if you need transaction history for tax purposes). It's usually 5 minutes of work and it's good customer service.

• "What data do you have on me?" — Send a summary: contact info, visit dates, vehicles, service history. Don't include detailed payment data; refer to their own records for that.

• "Don't text/email me anymore." — Honor the request within 10 days. This is TCPA and CAN-SPAM required regardless of state law.

Common mistakes to avoid

• Keeping credit card numbers on paper ROs in a filing cabinet. This is a data breach waiting to happen. Shred old paper ROs that have credit card data.

• Sharing customer lists with "partners." If someone offers you a referral deal in exchange for customer data, think hard. In most states this is now regulated.

• Storing data indefinitely. A 10-year-old inactive customer record has no value to you and is a liability. Purge.

• Using customer data for non-service marketing. If you want to market to customers beyond service reminders, you need clear consent. CAN-SPAM and TCPA both regulate this.

The SMS piece

If you text customers, TCPA and A2P 10DLC carrier rules apply. Specifically:

• Get affirmative consent before texting for marketing.
• Honor STOP requests within 24 hours.
• Include opt-out language in marketing messages.
• Use a carrier-registered number (A2P 10DLC).

Fines are $500-$1,500 per unauthorized message. A shop that texts 500 customers with a promotional blast and ignores 10 STOP requests could face $5k-$15k in fines.

See the full SMS compliance guide for specifics.

What to do this week

1. Audit where credit card data lives. Stop storing it anywhere manual.
2. Set up role-based access in your shop software. Techs shouldn't see payment data.
3. Write a one-page data breach plan. Save it where you'll find it.
4. Set a calendar reminder to annually review customer data retention. Delete truly inactive records.
5. Make sure your text messaging is A2P 10DLC registered.

That's the 80/20. Do those five things and you're ahead of most independent shops on data handling.

How Pitlane helps

Pitlane handles PCI-compliant payment tokenization (we never store card numbers), role-based access, TCPA-compliant SMS with carrier registration, and one-click customer data deletion. One system, the compliance pieces handled.

See how the data model works →