Before the Internet became a car sales tool, compliance with the Fair Credit Reporting Act was clear cut: With the customer in the showroom, getting written authorization to pull a credit report is a no-brainer.

That’s not true today. Finance managers and sales managers might run a credit report without formal, written authorization if customers are connecting with the store online.

“Ideally, the dealer should obtain tangible evidence of authorization,” writes dealer lawyer Mike Charapp, co-author of the just-released book, Auto Dealer Law.

If the dealership is challenged later, you’ll need to prove the store ran the report in connection with a business transaction initiated by the consumer, Charapp says.

His book offers some dos and don’ts for dealerships accepting credit applications online:

1. Adopt clear, written policies for taking online credit applications.
2. Set the Web site to provide click-through authorization before the customer can proceed with online credit application.
3. Use encryption technology to make sure transmission of the credit application is secure.
4. Never let dealership employees ask customers to submit credit applications or other personal information over unsecure media such as e-mail.
5. Never share credit information with customers until they arrive at the dealership and present proof of their identity.
6. Have customers complete and sign a hard copy of a credit application in person even after they give authorization online. At the time they complete the application, provide them with a copy of the dealership’s privacy policy.
7. Mail a copy of the dealership’s privacy policy to consumers who decided not to buy a vehicle.
8. Mail an adverse action notice to consumers if the dealership can’t obtain financing for them.
9. Mail customers a credit score disclosure within two days after pulling the credit report to comply with the federal Risk-Based Pricing Rule. Be sure to mail the disclosure to the current address shown on the credit report, rather than the unverified address on the credit application.
10. Don’t mail the credit score disclosure if customers clearly withdraw their credit application.