The rule, which actually took effect Nov. 1, 2008, requires businesses handling credit, like dealerships, to adopt written plans to identify, detect, monitor and respond to potential instances of identity theft.
But the FTC has delayed enforcing the rule four times -- first to May 1, 2009; then to Aug. 1, 2009; then to Nov. 1, 2009; and finally, to June 1, 2010.
I've talked to dealers, vendors, trade association executives and lawyers who aren't really sure the latest enforcement deadline will stick.
But one thing is certain: Dealers better comply with the law.
The rule has been in place for 18 months, and the businesses it regulates must be up-to-speed on new identity-theft schemes. When the FTC gets around to policing the law, the agency is unlikely to accept ignorance as an excuse for noncompliance.