Consumer Privacy

700Credit has confirmed a data breach involving dealer customer data copied without authorization between May and October 2025. 700Credit has committed to providing required federal, state, and consumer notifications on behalf of dealers, as well as credit monitoring services, unless a dealer opts out by December 5, 2025, at 5:00 PM ET.

New privacy laws in Kentucky, Indiana, Rhode Island, and updated rules in Oregon and California take effect on January 1, 2026.

Regulators in CA, CO, and CT announced a coordinated sweep of businesses that appear to be ignoring opt out preference signals, including GPC signals. For dealerships, this development is a signal that regulators are looking closely at the way businesses’ websites collect and use consumer data, and whether those practices line up with state privacy laws.

Montana recently amended the MCDPA, effective October 1, 2025, broadening its applicability with changes to applicability thresholds, the elimination of financial institution exemptions under the GLBA, and more.

The MODPA goes into effect on October 1, 2025, granting MD residents broad rights over their personal data, and imposing strict requirements on covered businesses, including data minimization and processing limits.

Businesses should be aware of recent public outreach in California – and other states with consumer privacy laws – signaling that increased enforcement activity is on the horizon.

By Mark Sanborn Senior Product and Regulatory Counsel As we detailed in a previous article, on July 1, 2025, California