Updated
Car dealership security cameras and lot security systems
A dealership is three buildings' worth of security problems stacked on one parcel. The lot is an outdoor warehouse holding several million dollars of inventory with no walls. The showroom and F&I offices hold customer financial records that a federal rule now treats like a bank's. The service drive and parts room are an access control problem with keys, cores and a constant flow of strangers who have a legitimate reason to be there. Very few bidders price all three well, and the one who does will ask about your key cabinet.
The fact that sets the spec
The FTC Safeguards Rule names auto dealerships by example, and it reaches physical access, not just IT.
16 CFR Part 314 gives, as an example of a covered financial institution, an automobile dealership that as a usual part of its business leases automobiles on a nonoperating basis for terms of at least 90 days. The rule then requires a written information security program with administrative, technical and physical safeguards, and specifically requires implementing and periodically reviewing access controls, including technical and, as appropriate, physical controls, to permit access only to authorized users and to limit those users to the customer information they need. That is your deal jackets, your file room, your F&I offices and the workstations in them. There is a small-volume carve-out: § 314.6 exempts institutions that maintain customer information on fewer than 5,000 consumers from the written risk assessment, penetration testing and vulnerability scanning, incident response plan and annual board reporting requirements. It does not exempt them from the access control requirement.
The systems
What a auto dealerships security system needs
System by system, and why. Each links to the buying guide with the questions that separate a sound quote from a cheap one.
Lot coverage measured in pixels per foot, not in camera count
The common failure on a dealership is 40 cameras that collectively identify nobody. A camera watching a 200-foot row of inventory from the building corner records a shape. Coverage that works is layered: wide situational cameras for context, then identification-grade cameras at every point a person or vehicle has to pass through, meaning entrances, exits, the service drive, the parts dock and the corners where the fence is weakest. Ask each bidder for pixels per foot at those choke points on a site plan, and ask what the design assumes about lighting at 2 a.m., because most lot cameras are sold on daytime demos.
Video Surveillance & CCTV guideKey cabinet, parts room, service drive gate, and the file room
An electronic key cabinet with a per-user audit log is the highest-value access control purchase a dealership makes, because it answers who had that key, when, and whether it came back. After that: the parts room, the F&I and file room, the cashier, the server room, and the gate on the service drive so that overnight drop-off and after-hours pickup do not mean an open lot. Specify audit log retention and self-service export, and specify a credential revocation process that works on the day someone leaves, since dealership turnover is high.
Access Control Systems guidePerimeter detection on the lot, not just contacts on the doors
The building alarm protects the building. The inventory is outside it. Outdoor detection on a lot means some combination of thermal cameras with analytics, radar, and beam or fence detection along the weak boundary, tuned so that a cat, a plastic bag and a passing headlight do not trip it. Expect a tuning period after install and negotiate it into the contract. Solar and cellular camera units are worth pricing for far corners and satellite lots where trenching power and fiber would cost more than the corner is worth.
Commercial Alarm Systems guideVideo-verified monitoring, priced against what a guard costs
The real comparison at a dealership is a monitoring service that watches outdoor analytics events and can talk down an intruder over a speaker, against a guard on site. Get both priced across the same hours. Ask the monitoring provider for their talk-down procedure, their dispatch criteria, and what happens on a night with 30 weather-driven events. Also ask your local police about verified response policy, because in some jurisdictions a video-verified alarm gets a materially different response than an unverified one.
Business Alarm Monitoring guideService bays and parts storage change the fire scope
A dealership is not an office. Service bays, a paint or body shop, flammable liquid storage, battery and EV charging areas, and a parts mezzanine all affect fire alarm and detection design, and the AHJ will treat them differently from the showroom. If you are adding EV charging or expanding a body shop, get the fire alarm scope reviewed at the same time as the security scope rather than after.
Commercial Fire Alarm guide
The rules
The rules that set the spec for auto dealerships
Every claim below was checked against a named source on the date shown. Rules change and vary by jurisdiction, so confirm the current version with the regulator or your AHJ before you sign a scope.
FTC Safeguards Rule: dealerships are financial institutions, and access control is required
16 CFR § 314.2(h) illustrates a covered financial institution with an automobile dealership that, as a usual part of its business, leases automobiles on a nonoperating basis where the initial lease term is at least 90 days. Section 314.3 requires a written information security program containing administrative, technical and physical safeguards. Section 314.4(c)(1) requires implementing and periodically reviewing access controls, including technical and, as appropriate, physical controls, to authenticate and permit access only to authorized users, and to limit authorized users to the customer information they need for their duties.
What it does to the spec. Physical access to customer data becomes part of a written program you can be asked to produce. In practice that is a controlled door and audit log on the file room and the F&I corridor, a camera covering the approach rather than the desks, and a documented review of who holds those credentials. Do not let a bidder tell you the Safeguards Rule is an IT matter.
Source:16 CFR Part 314, Standards for Safeguarding Customer Information (eCFR)· checked 2026-09-18
The 30-day FTC notification clock, live since May 2024
Section 314.4(j) of the Safeguards Rule became effective on 13 May 2024 under § 314.5. It requires notification to the FTC as soon as possible and no later than 30 days after discovery of a security event involving the unencrypted customer information of 500 or more consumers.
What it does to the spec. The clock starts at discovery, which means your detection matters as much as your prevention. A break-in at the file room that nobody noticed for six weeks is a worse problem than the break-in. Door position monitoring and forced-door alarms on records areas, plus a camera that lets you establish what was actually taken, are what turn an unknown into a dated, documented event.
Source:16 CFR §§ 314.4(j) and 314.5 (eCFR)· checked 2026-09-18
Small-volume carve-out: fewer than 5,000 consumers
16 CFR § 314.6 provides that § 314.4(b)(1), (d)(2), (h) and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers. Those are the written risk assessment requirement, the continuous monitoring or annual penetration testing and semi-annual vulnerability assessment requirement, the written incident response plan, and the annual written report to the board or senior officer.
What it does to the spec. A single-point used lot may sit under that threshold and should not be sold a compliance package built for a 15-store group. Count your consumers before you buy. The access control obligation in § 314.4(c)(1) is not in the carve-out, so the file room door still matters.
Source:16 CFR § 314.6, Exceptions (eCFR)· checked 2026-09-18
License plate recognition is regulated in California, and the rules are a good default anywhere
California Civil Code § 1798.90.51, added by SB 34 in 2015, requires any ALPR operator to maintain reasonable security procedures and practices, including operational, administrative, technical and physical safeguards, and to implement a publicly available written usage and privacy policy, posted conspicuously on the operator's website if it has one. The policy must state the authorized purposes for collection, which job titles may access the system and their training requirements, how the system is monitored, restrictions on sale or sharing, the custodian responsible, accuracy measures, and how long ALPR information is retained and how it is destroyed. Section 1798.90.54 lets an individual harmed by a violation sue the person who knowingly caused the harm for actual damages or liquidated damages of at least $2,500, plus punitive damages, attorney's fees and costs.
What it does to the spec. If you are putting plate capture at the entrance and exit, decide the retention period and write the policy before go-live, not after an incident. Ask the vendor where plate data is stored, whether it is shared with any third-party network by default, and how to turn that sharing off. Verify the current rule with your own state, since ALPR statutes are moving quickly.
Source:Cal. Civ. Code § 1798.90.51 (SB 34), California Legislative Information· checked 2026-09-18
California SB 553: dealerships need a workplace violence prevention plan too
California Labor Code § 6401.9 applies to all employers, employees and places of employment except a short list that does not include vehicle dealers. It requires a written workplace violence prevention plan, a violent incident log, training, and correction of workplace violence hazards. The statute defines Type 1 violence as violence by a person with no legitimate business at the worksite, which is exactly the after-hours lot intruder, and Type 2 as violence directed at employees by customers.
What it does to the spec. The plan has to identify hazards and say how you corrected them, which turns lot lighting, a controlled cashier window, a duress button at the desk and the after-hours procedure for the service drive into documented controls rather than optional upgrades. Verify current requirements with Cal/OSHA, and check whether your own state has adopted something similar.
Source:Cal. Labor Code § 6401.9 (SB 553), California Legislative Information· checked 2026-09-18
Reference
US motor vehicle theft, most recent reported figures
| Measure | Figure |
|---|---|
| Vehicles stolen nationally, 2025 | About 659,900 |
| Change from 2024 | Down 22.4 percent, a second consecutive year below one million |
| Change from the 2023 peak | Down 35.4 percent |
| Most stolen model, 2025 | Hyundai Elantra, 21,732 thefts |
National figures, not dealership-specific. They matter to a dealer for two reasons: theft is falling nationally, so an insurer or a lender who priced your risk on 2023 numbers may be persuadable, and the most-stolen list tells you which rows of your used inventory deserve the identification-grade camera rather than the wide shot.
Source:Insurance Information Institute, citing NICB and FBI Crime Data Explorer· checked 2026-09-18
Ballpark pricing
What a auto dealerships security system costs
Labeled ballparks for planning, not quotes. Three things move a dealership number more than camera count. Outdoor pathways: trenching and boring across a paved lot is civil work, and a single run to a far corner can cost more than the camera on the end of it, which is why solar and cellular units earn their price at satellite corners. Lighting: an outdoor analytics design that works depends on light levels you may not currently have, so get the lighting assessed as part of the bid. And monitoring: video-verified outdoor monitoring is the recurring line that actually varies, so get it quoted against the cost of a guard across the same hours before you decide.
| Building | Typical scope | Installed | Recurring |
|---|---|---|---|
| Single-point used lot | 1 to 3 acres · 12 to 24 cameras including 2 to 4 plate capture · 2 to 4 controlled doors · outdoor detection on the weak boundary · key cabinet | $25,000 – $75,000 | $200 – $900/mo |
| Franchised dealership | Showroom, service bays, parts room and 2 to 6 acres of lot · 40 to 90 cameras · 15 to 30 controlled doors · service drive gate · file room and F&I access control · perimeter analytics | $90,000 – $300,000 | $700 – $2,500/mo |
| Multi-rooftop group | 5 to 15 stores on one video and access platform · central monitoring view · shared plate capture policy · group-level credential and audit reporting | $500,000 – $2,500,000 | $3,000 – $15,000/mo |
Labeled ballparks for planning, built from the site’s per-system cost guides. A quote comes from a contractor who has walked the building.
Before you sign
What to ask a auto dealerships security bidder
The questions that are specific to this building type. A bidder who has done this work before will have answers; one who has not will have a brochure.
- 01
Show me pixels per foot at the entrance, the exit, the service drive and the far fence line.
Not an average across the lot. Four specific numbers on a site plan, at night, with the lighting you actually have. This single question separates a designed system from a camera count.
- 02
How many false alarms will the outdoor detection generate in the first month, and who tunes it?
Every outdoor analytics or radar install has a tuning period. Ask what it typically looks like, who does the tuning, whether it is included, and how long you have to get it right. Then ask what the monitoring center does with events during that period, because that is where an ugly first invoice comes from.
- 03
Does the key cabinet produce an audit log I can export myself?
Key control is where test-drive fraud and internal loss are actually caught. Ask for per-key, per-user, timestamped logs, self-service export, and how the cabinet behaves when the network is down. Ask how it ties to your DMS, if at all.
- 04
Where does plate capture data live, how long is it kept, and is it shared by default?
Some plate recognition products enroll your reads into a shared network unless you opt out. Get retention, storage location and sharing in writing. In California an ALPR operator owes a published usage and privacy policy stating retention, and the statute carries liquidated damages of at least $2,500 per harmed individual.
- 05
Price video-verified monitoring against a guard across the same hours.
Get both on one page: monitoring cost per month with talk-down included, versus guard hours at your actual overnight window. Ask the monitoring provider about their dispatch criteria and whether your local police give verified alarms a different response.
- 06
What does this design cover in the service bays and the parts room, and who can see it?
Service and parts are where internal loss and comeback disputes live. Ask for coverage of the parts counter, the parts dock, each bay's work area and the cashier, and then ask who inside the dealership can view those cameras. A camera your service manager cannot review is an expense, not a control.
Straight answers
Auto Dealerships security, FAQ
How much does a car dealership security camera system cost?
For planning: a single-point used lot runs about $25,000 to $75,000 installed, a franchised dealership about $90,000 to $300,000, and a multi-rooftop group $500,000 and up. Monthly costs run roughly $200 to $900 for a small lot and $700 to $2,500 for a franchise store, driven mostly by whether you buy video-verified outdoor monitoring. The cost drivers that surprise people are outdoor cable pathways across a paved lot and the lighting required to make night analytics work, not the cameras themselves.
How many cameras does a car dealership need?
Fewer than most proposals show, placed better. A single-point used lot of one to three acres is typically 12 to 24 cameras, a franchised store with a service department 40 to 90. The count matters less than where identification-grade coverage sits: every entrance and exit, the service drive, the parts dock, the cashier, and the boundary points where someone can get a vehicle off the lot. Everything else can be wide situational coverage. Ask for pixels per foot at the choke points rather than a camera count.
Does the FTC Safeguards Rule apply to car dealerships?
Yes, for most dealers. 16 CFR Part 314 gives as an example of a covered financial institution an automobile dealership that, as a usual part of its business, leases automobiles on a nonoperating basis for an initial term of at least 90 days. The rule requires a written information security program with administrative, technical and physical safeguards, and requires access controls including, as appropriate, physical controls limiting who can reach customer information. There is a narrower obligation for institutions holding information on fewer than 5,000 consumers, but the access control requirement still applies. Confirm your own position with counsel.
How do you secure a car lot at night?
In layers, because a fence alone is a delay and cameras alone are a record. The working pattern is: light the lot to a level your cameras can actually use, put identification-grade cameras on every exit path, add outdoor detection along the weak boundary using thermal analytics, radar or beams, connect that detection to a monitoring center that can see the event and talk down over a speaker, and gate the service drive. Then test it at 2 a.m. rather than at a lunchtime demo. Guards and video-verified monitoring are the real alternatives to compare, so price them across the same hours.
Is license plate recognition worth it at a dealership?
At entrances and exits, usually yes, because it turns a grainy after-hours clip into a searchable record and it dates a test drive. It comes with obligations. In California, an ALPR operator must maintain reasonable security safeguards and publish a usage and privacy policy that states retention and sharing, and an individual harmed by a violation can recover liquidated damages of at least $2,500. Decide the retention window before go-live, and find out whether the product shares your reads into a wider network by default.
How do dealerships prevent test-drive theft and fraud?
Key control and identity capture, in that order. An electronic key cabinet with a per-user audit log means the key that left with a vehicle is attributable to a person and a timestamp, which is the record you need for both a police report and an insurance claim. Pair it with a documented ID capture process at the desk, a camera that clearly reads faces at the sales desk and the exit, and plate capture on the driveway. The technology only helps if the process is followed every time, so ask how the cabinet enforces it rather than how it reports on it.
Is vehicle theft still rising?
No. Nationally it has fallen sharply. The Insurance Information Institute, citing NICB, reports about 659,900 vehicles stolen in the United States in 2025, down 22.4 percent from 2024 and 35.4 percent below the 2023 peak, the second consecutive year below one million. That is a national figure and says nothing about your lot, but it is a useful number to raise with an insurer or a lender whose pricing still reflects 2023.
Other building types
The systems are the same. The rules they operate under are not.
Cost guides
Dated, sourced ranges for each system, with per-unit prices.
What commercial security systems cost in 2026Get your auto dealerships priced.
One short form, contractors who already work under your rules, and pricing you can compare line for line. No obligation, no fee.