Safety & Compliance

Federal And State Regulatory

DEOS Data Protection And Customer Engagement Compliance Summary

I REVLAB, INC. | DEOS
Prepared by: DEOS Engineering, Management, and Legal Departments
Last Updated: November 4, 2026

Automotive SaaS providers must comply with the federal and state requirements applicable to their access, use, protection, and disclosure of dealership customer information, including customer engagement by email, calls, SMS, websites, and AI-assisted interactions. They should maintain the records required to substantiate authorized processing, communication permissions, safeguards, and their response to consumer requests. I REVLAB, INC. maintains the DEOS compliance program around these obligations. This statement summarizes the principal requirements and how our policies and operating controls address them.

Applicability depends on the activity, information, jurisdiction, statutory thresholds, exemptions, and processing role. Some duties apply directly to DEOS; others apply to the dealership and are supported through our services and contracts. Related state requirements are grouped below to keep this summary concise; the applicable deployment requires jurisdiction-specific review. This statement accompanies our Privacy Policy, Subscription Terms, AI Governance Policy, TCPA Policy, and Dealership Data Safeguards.

01. GLBA Privacy Rule — Financial Customer Information

Authority: FTC GLBA resources; 16 CFR Part 313.

Covered financial institutions, including qualifying dealership financing activities, must address notices and restrictions on disclosure of nonpublic personal information. DEOS limits processing to authorized purposes, restricts provider use and onward disclosure, and supports dealership instructions. A DMS connection does not authorize unrestricted reuse, and not every dealership record is automatically GLBA-covered.

02. FTC Safeguards Rule — Information Security

Authority: FTC Safeguards Rule guidance, addressing 16 CFR Part 314.

Covered dealerships must maintain an appropriate security program and oversee relevant service providers. Our program addresses encryption, least-privilege access, protected credentials, dealer separation, risk review, provider restrictions, monitoring, and incident handling. We support customer diligence and required incident cooperation; a dealership's appointment of DEOS does not discharge its own oversight duties.

03. TCPA And FCC Rules — Calls, Texts, And AI Voices

Authority: 47 CFR § 64.1200; FCC AI-voice ruling.

Covered outreach requires appropriate permission, identification, timing, and opt-out controls. DEOS distinguishes informational requests from marketing, requires documented consent for the enabled use, treats AI voices as artificial voices, and applies suppression and execution checks. Our TCPA Policy specifies the controls, evidence, and responsibilities; platform access alone never supplies consumer marketing consent.

04. Telemarketing Sales Rule And Do-Not-Call Requirements

Authority: FTC TSR guidance; 16 CFR § 310.5, recordkeeping.

Covered telemarketing requires applicable disclosures, registry screening, seller-specific suppression, and records. DEOS requires approved campaign classifications, current screening where required, functioning opt-outs, and retained evidence. Applicable TSR records follow the five-year framework and record-specific starting dates. Customer and Company recordkeeping responsibilities must be allocated rather than assumed.

05. CAN-SPAM — Commercial Email

Authority: FTC CAN-SPAM compliance guide.

Commercial email requires truthful identification and subject lines, applicable advertising and address disclosures, and a working unsubscribe process. DEOS applies appropriate message classification and suppression controls and requires customers to supply accurate sender information. Marketing opt-outs must be honored within applicable deadlines; adding promotional content can change a message's treatment.

06. FTC Act And State Consumer-Protection Laws

Authority: Federal Trade Commission Act; FTC automotive pricing notice.

Unfair or deceptive conduct includes misleading offers and unsupported privacy, security, or AI claims. DEOS requires authorized source information, approved commercial limits, truthful disclosures, and escalation of exceptions. Dealerships control their offers; Company remains accountable for its own conduct. We prohibit misleading synthetic endorsements, fake reviews, and cross-dealer misuse of confidential intelligence. The FTC consumer-review rule also applies where triggered.

07. Financing And Lease Advertising — Regulations Z And M

Authorities: Truth in Lending Act/Regulation Z, § 1026.24; Consumer Leasing Act/Regulation M, § 1013.7.

Covered finance and lease promotions require accurate terms and applicable accompanying disclosures. DEOS requires dealership-approved inputs and templates, validated calculations, and required offer conditions before release. Agents must not invent payments, rates, eligibility, or omitted charges. Campaign review addresses the actual medium, including spoken and video offers.

08. Federal And State Recording And Interception Laws

Authority: 18 U.S.C. § 2511; Florida § 934.03, an illustrative state requirement.

Recording, transcription, monitoring, and certain session-capture technologies require assessment under the applicable federal and state rules. DEOS requires the relevant advance notices and permissions before affected processing and limits access and retention. Consent to receive a call is not automatically consent to record it, and a recording does not authorize voice cloning.

09. E-SIGN And State Electronic-Transactions Laws

Authority: 15 U.S.C. § 7001; Ohio's Uniform Electronic Transactions Act, an illustrative state enactment.

Electronic signatures and records must satisfy the requirements of the underlying transaction. DEOS requires attributable affirmative acceptance, accessible disclosures, versioned consent evidence, and appropriate retention. A prechecked box or general privacy acknowledgment is not substituted for required marketing consent. Additional consumer electronic-delivery requirements are assessed where applicable.

10. California CCPA/CPRA

Authority: California Attorney General CCPA guidance; approved CPPA regulations.

Where covered, processing requires appropriate notices, rights handling, purpose limits, security, and service-provider terms. DEOS restricts sale, cross-context advertising, and unauthorized combination or reuse; supports verified rights requests; and applies contractual downstream restrictions. GLBA exemptions are assessed by their actual scope, not assumed to cover an entire dealership database.

11. Other State Consumer Privacy Laws

Authorities include: Colorado Privacy Act; Virginia Consumer Data Protection Act.

Applicable state laws can require privacy notices, processor contracts, consumer rights, sensitive-data consent, opt-out mechanisms, and assessments. DEOS applies these requirements according to residence, processing, coverage, and effective date, including other states where triggered. We use role-specific agreements, data minimization, access restrictions, rights procedures, and use-case review rather than treating one state's compliance as universal.

12. State Data-Security And Breach-Notification Laws

Illustrative authorities: Florida § 501.171; California breach-notification guidance.

State laws impose security, disposal, and incident-notification duties according to the affected information and residents. DEOS maintains access and encryption safeguards, retention procedures, and an incident-response process addressing containment, investigation, customer cooperation, and required notices. Notification recipients, triggers, and deadlines are assessed separately; a contract does not replace statutory obligations.

13. State Telephone-Solicitation And “Mini-TCPA” Laws

Illustrative authorities: Florida § 501.059 and § 501.616; Maryland statutes, Commercial Law Title 14, Subtitle 45.

State requirements may add consent, calling-hour, frequency, registration, and identification restrictions. DEOS requires recipient-local scheduling, applicable narrower limits, supported jurisdiction checks, and documented exceptions. Federal permission alone is insufficient, and an area code is not conclusive evidence of a recipient's location. Unsupported or uncertain outreach is held for review.

14. Biometric Privacy And Likeness Rights

Authorities include: Illinois BIPA § 15; Texas biometric statute; Florida likeness rights, § 540.08.

Applicable laws regulate biometric collection, disclosure, retention, and use of a person's identity. DEOS requires valid likeness authority, legally required individual notices and releases, limited production uses, and the Privacy Policy's destruction schedule. An employer's instruction or ordinary customer call is not an unrestricted replica license. Entity and activity exemptions require assessment.

15. State AI And Automated-Decision Requirements

Authorities include: California ADMT regulations and phased dates; Colorado ADMT and chatbot requirements; Texas Business & Commerce Code Chapter 552.

Applicable AI requirements depend on the system and use. DEOS uses identified owners, bounded agent permissions, evaluations, human escalation, and restrictions on consequential decisions. New uses require assessment before activation. California's covered ADMT requirements and Colorado's replacement ADMT/chatbot legislation include January 1, 2027 compliance/effective dates; future requirements are tracked rather than described as already operative.

16. Accessibility And Customer Assistance

Authority: U.S. Department of Justice guidance on web accessibility and the ADA.

Covered customer-facing services must address applicable accessibility and effective-communication obligations. Our governance requirements include accessible interaction design, evaluation of barriers, and appropriate alternatives or human assistance. Accessibility is assessed for the actual deployed experience; we do not equate an automated tool or a design standard with a blanket legal certification.

17. FCRA — Consumer Reports, If Enabled

Authority: FTC Fair Credit Reporting Act resources.

Consumer-report access and use require a permissible purpose and other applicable safeguards and notices. Ordinary DEOS engagement does not authorize credit-bureau access, consumer-report sharing, or eligibility scoring. A proposed covered workflow requires separate legal review, defined permissions, and approved safeguards before activation.

18. ECOA And Regulation B — Credit Decisions, If Enabled

Authority: Regulation B, § 1002.9.

Covered credit decisions remain subject to nondiscrimination and applicable notification duties. DEOS does not obtain underwriting authority from a communication subscription. A proposed credit-decision use requires separate authorization, qualified decision ownership, and legally sufficient explanations and notices; AI-generated reasoning is not accepted as a substitute for the actual decision basis.

19. DPPA — State Motor-Vehicle Records, If Used

Authority: 18 U.S.C. § 2721, Driver's Privacy Protection Act.

Protected personal information from state motor-vehicle records has restricted permissible uses and redisclosures. DEOS requires source and purpose review before such information is enabled. A VIN or dealership record is not automatically a DMV record, and ordinary DMS access does not independently authorize DMV-derived marketing data.

20. COPPA — Children's Information, Where Applicable

Authority: FTC COPPA guidance and current-rule references.

COPPA applies to covered child-directed services and certain knowing collection from children under 13. DEOS is not designed as a child-directed service. Known child-data issues require restricted processing and appropriate deletion or other legally approved handling; an ordinary dealership consent flow does not replace required parental authorization.

Compliance Records And Ongoing Review

We maintain the applicable evidence of instructions, consent, suppression, access, processing, and material actions under documented retention requirements. Deployment-specific requirements, contracts, and legal changes require continuing review. These controls support compliance; this summary is not an independent certification or an exhaustive state-by-state legal register.

SOC 2 Type 1 work remains in progress. SOC 2, NIST frameworks, and carrier A2P registration are assurance frameworks or industry arrangements, not substitutes for the laws above. For detailed controls, consult the related DEOS policies or contact legal@deos1.com.