On February 12, 2026, the Federal Trade Commission formally withdrew the CARS Rule via Federal Register notice. The rule that had loomed over dealer advertising compliance discussions for two and a half years is officially off the books, following the Fifth Circuit’s January 2025 decision to vacate it for procedural failure.
Most dealers reacted to the withdrawal the way they’d reacted to the 2025 court decision: relief, a quiet exhale at the regulatory desk, and a reasonable assumption that the worst of the advertising compliance pressure was behind them.
That assumption is wrong. The CARS Rule withdrawal didn’t make dealer advertising compliance easier. It made it more complicated, more fragmented, and in several jurisdictions, materially more dangerous than the federal rule would have been. Here’s the actual state of the 2026 dealer advertising compliance landscape, what changed beyond the headline, and what marketing teams need to be paying attention to right now.
What the FTC actually did after the rule died
The FTC didn’t stop caring about dealer advertising practices. They stopped relying on a single comprehensive rule and started running a more aggressive ad-hoc enforcement program built around existing authority.
In late 2025 and early 2026, the Commission sent warning letters to roughly 100 dealer groups regarding price-display deception and bait advertising. The letters reference specific practices — advertised prices that don’t include mandatory dealer fees, monthly-payment-led creative that obscures total cost, “available” inventory that isn’t actually on the lot, and online listings that fail to disclose material reconditioning history.
The signal isn’t subtle. The FTC is enforcing the spirit of what the CARS Rule would have codified, using Section 5 unfair-and-deceptive authority that doesn’t require the rule to exist. The advertising practices the rule would have prohibited are still risky. The dealers who treated the rule’s death as permission to relax those practices are the ones currently receiving the warning letters.
The Commission has also coordinated more closely with state attorneys general than it did under the prior leadership. Joint investigations into specific dealer groups have become more common, and the standard penalty structure on Section 5 settlements has hardened.
The state-level rules are filling the gap, and they’re stricter
The bigger story is at the state level, where four jurisdictions have moved aggressively to fill what they perceive as a federal gap.
California, New York, Massachusetts, and Washington each have active rulemaking processes underway in 2026 that mirror substantial portions of what the CARS Rule would have required, with state-specific twists that are generally more dealer-unfriendly than the federal version would have been.
California’s effort is the furthest along and the most expansive. The proposed rules would require advertised prices to include all mandatory dealer-added fees with limited exceptions, mandate written disclosure of all add-on products before any signing, require dealers to retain ad copy and the supporting backup documentation for three years, and create a private right of action for consumers — meaning California dealers wouldn’t just be defending against state regulators, they’d be defending against plaintiffs’ law firms.
New York’s draft rule has a similar shape but includes a stronger reconditioning-disclosure requirement and a broader definition of “advertised price.” Massachusetts and Washington are moving more slowly but in the same direction.
Dealers operating in any of those four states need to be tracking the rule-making process directly, not waiting for industry associations to issue guidance after the fact. The compliance window between rule adoption and enforcement is typically 90-180 days, which is not enough time to rebuild creative libraries, retrain BDC scripts, and audit website price displays.
The FTC Safeguards Rule is the actual 2026 priority
While dealers were focused on CARS Rule politics, the FTC quietly turned 2026 into the year the Safeguards Rule actually gets enforced.
The rule itself didn’t change. It’s been in effect since 2023. What changed is the Commission’s tolerance for incomplete compliance. The audit and enforcement actions against dealers in the first half of 2026 are running at a meaningfully higher pace than 2025, and the common failure patterns are consistent enough to be predictable.
The most common Safeguards Rule audit failures at dealerships:
No documented Written Information Security Program signed in the last twelve months. The rule requires a current WISP, not a 2023 template that’s been sitting in a folder.
Risk assessment hasn’t been performed, or was performed by someone who didn’t understand the dealership’s actual technology footprint. The DMS, the CRM, the inventory management system, the website, the BDC platform, the email system, the parts ordering system — each is a risk surface, and most dealership WISPs don’t acknowledge half of them.
Multi-factor authentication is not implemented across critical systems. This is the simplest fix on the list and the most common failure. MFA on email is table stakes. MFA on the DMS and CRM is often the gap.
Vendor risk management is undocumented. The rule requires dealerships to assess and document the security posture of their vendors. Almost nobody does this. The CDK ransomware event in mid-2024 should have made vendor risk management an obvious priority, and at most dealerships it still hasn’t been operationalized.
No incident response plan that’s been tested or updated. Having a plan in a binder is not the same as having a plan the team has rehearsed and can execute under stress.
No documented employee security awareness training. The rule requires it. Most dealerships either don’t run training, run it once and never refresh it, or run it without documenting completion.
Each of these gaps is straightforward to close. The cost of closing them is far smaller than the cost of being the dealership the FTC chooses to make an example of, and the enforcement pattern in 2026 suggests examples are being made on an accelerating schedule.
What dealer marketing teams should actually be doing
Three concrete priorities for the rest of 2026.
Audit current advertising practices against the practices the FTC warning letters call out. If advertised prices on the website don’t include mandatory dealer fees, fix that. If lead form creative emphasizes monthly payments without clear total-cost context, fix that. If listed inventory includes vehicles that aren’t physically available or in transit, fix that. None of these are CARS-Rule-specific; they’re enforced through Section 5 regardless of whether CARS exists.
For dealers in California, New York, Massachusetts, or Washington, assign someone — internal or external — to track the state rulemaking process and prepare a 90-day implementation plan for the most likely version of each state’s rule. Don’t wait. The implementation cycle is too short.
Run a Safeguards Rule readiness check. Document the WISP. Run a risk assessment. Implement MFA across all critical systems if it isn’t already. Stand up basic vendor risk management. Build and rehearse an incident response plan. Document employee training. None of this is glamorous and all of it is more important than whatever advertising creative project is currently consuming the marketing team’s attention.
The bigger frame
The CARS Rule withdrawal is the kind of regulatory event that’s easy to misread. The dealers who treat it as compliance relief are running into Section 5 enforcement, state-rule risk, and a Safeguards Rule audit environment that’s tighter than it was a year ago. The dealers who treat it as a moment to take advertising and data security compliance seriously — because the federal rule isn’t going to do that work for them — are positioned to come out of 2026 in a much better place.
For the advertising-side of the compliance question specifically, the operators who’ve been tracking dealer advertising practices closely have generally landed in the same position: the cleanest path is the one where the dealership’s ad creative, BDC scripts, and price displays would survive a state AG investigation without modification. The team at DealerSmart and others with deep dealer-marketing experience have been working through these compliance questions with their accounts since the original CARS proposal in 2023, which is the kind of institutional memory that matters when the regulatory environment is shifting underneath the marketing function.
The headline is true: the CARS Rule is dead. The compliance work isn’t. For most dealerships, 2026 is the year the implications of that distinction become expensive. The dealers who notice early have time to adjust. The ones who don’t are about to learn what the FTC’s Section 5 authority actually means when a rule isn’t in the way of using it. Worth a look at the broader picture DealerSmart has been documenting the practical implications across paid media accounts as enforcement patterns have become clearer.