What's Actually the Same on the I-9 Form

It's Monday morning in the service department, and your HR coordinator flags you down with a question that's probably kept her up over the weekend. "Are we still doing I-9s the same way, or did something change?" You pause. Good question. And frankly, if you're running a multi-location operation, you've got compliance obligations that go way beyond the form itself these days.

The I-9 hasn't fundamentally changed since the last major revision in 2017. The form itself still requires identity verification, employment authorization documents, and employer certification. What has changed, though, is the ecosystem of compliance requirements sitting around it. Privacy regulations are tightening. The FTC is actively cracking down on data breaches. Your dealer license is at stake if you're found knowingly employing unauthorized workers. And if you're storing I-9 documentation improperly, you're exposed to legal risk that extends far beyond a simple payroll audit.

What's Actually the Same on the I-9 Form

Let's start with what dealership HR teams can stop worrying about: the form structure itself. The I-9 still has three sections. Section 1 is employee information and attestation, filled out on the employee's first day. Section 2 is employer verification of identity and employment eligibility documents (List A, or combinations from Lists B and C). Section 3 is re-verification for employees who have employment authorization that expires.

The document requirements haven't shifted. You still accept the same categories of identification. Passport? Still good. Driver's license with state-issued ID? Still the standard. The real tension isn't in what documents you're accepting. It's in what you do with them after you've verified them.

And here's a hot take: most dealerships are probably overthinking the form mechanics and underthinking the data security piece. The form itself is straightforward. What's killing dealerships in audits isn't the I-9 checklist. It's the storage, retention, and eventual destruction protocols around those documents.

The Privacy and Data Security Shift

This is where the real compliance landscape has moved, and it's worth understanding because it directly affects your dealer license and legal exposure.

The FTC updated its Safeguards Rule in 2023. That rule applies to companies handling personal information of consumers and employees. If your dealership is collecting I-9 documents, you're collecting sensitive personal data: Social Security numbers, passport numbers, state ID information. Under the updated Safeguards Rule, you're now required to implement administrative, technical, and physical safeguards to protect that information.

What does that mean in practice?

• Physical safeguards: I-9 documents shouldn't be sitting in an unlocked filing cabinet in the HR office. They need to be stored securely. Many dealerships are shifting to locked cabinets, restricted access rooms, or digital storage with encryption.
• Technical safeguards: If you're storing I-9 images or data digitally (which most multi-location operations are doing now), you need access controls, encryption, and audit trails. This is nonnegotiable if you're scanning documents into a system.
• Administrative safeguards: Your team needs written policies on who can access I-9 data, when, and why. You need to document your verification process. If an employee or contractor leaves, access gets revoked immediately.

The FTC's focus here isn't theoretical. They've issued enforcement actions against companies with weak data security practices. For a dealership, a breach that exposes employee personal information doesn't just create liability with affected employees. It can trigger regulatory scrutiny that jeopardizes your dealer license if the state's regulatory authority views it as a sign of inadequate operational controls.

The Employment Authorization Verification Piece

This is the part that hasn't fundamentally changed, but the stakes have gotten higher.

You still verify employment authorization through the I-9 process. What's changed is the environment around it. Immigration enforcement priorities shift with administrations. Some states have passed their own employment verification laws that layer on top of federal requirements. And dealership groups operating across multiple states now have to track different disclosure requirements for when they're using E-Verify or third-party verification services.

Consider a hypothetical regional dealership group with locations in Washington, Oregon, and California. Each state has different requirements around employer disclosure when using E-Verify. California requires specific disclosures in writing. Some states have different retention periods for I-9 documentation. If your HR team is operating on a single national template without state-by-state customization, you're accumulating compliance gaps across your rooftops.

And here's the operational reality: knowingly hiring someone without valid employment authorization doesn't just expose you to immigration penalties. It can trigger a review of your hiring practices generally, which can lead to regulatory action that affects your dealer license. State regulators take staffing and operational compliance seriously. If an audit reveals systematic hiring oversights, they're going to ask harder questions about your other operational controls.

Digital Storage and Disclosure Requirements

More dealerships are moving I-9 documentation to digital systems, which creates both efficiency and compliance opportunity.

If you're digitizing I-9s, you're subject to the E-Signature Act (ESIGN). That law says you can store I-9 forms electronically, but you have to maintain the records in a way that accurately reproduces the original. You can't just scan a document and delete the original without legal exposure. You have to preserve both the signed original (or certified copy) and the supporting identification documents in a way that's accessible and verifiable.

The disclosure piece is critical too. When you're collecting I-9 information, especially if you're using a third-party verification service or digital workflow platform, you need to disclose to the employee how their information will be used, stored, and protected. This gets wrapped into your privacy policies and employment agreements. Many states now require explicit consent before processing sensitive personal information, even for routine employment verification.

A growing number of dealership operations are consolidating I-9 management into unified platforms that handle both the form workflow and the compliance documentation automatically. This is exactly the kind of workflow systems like Dealer1 Solutions support through their multi-dealership infrastructure, where you can enforce consistent verification standards, track verification dates, and maintain audit trails across all your locations from a single backend. The benefit isn't just convenience. It's that you're reducing human error, creating a documented compliance trail, and making audits faster because your documentation is organized and searchable.

Retention and Destruction Protocols

This is where a lot of dealerships slip up.

The legal retention requirement for I-9s is straightforward: keep them for at least three years from the hire date or one year from termination, whichever is longer. But here's what dealerships often don't do: they don't have a documented destruction protocol.

When an I-9 hits its retention deadline, you can't just toss it in a dumpster. You need a secure destruction method that prevents recovery of the personal information on the form. That means shredding (if physical), secure deletion (if digital), or using a certified document destruction service. You need to document that destruction happened. You need to keep a record showing which employees' I-9s were destroyed and when.

Why? Because regulators and auditors look at this. If you can't prove you destroyed employee personal information when you were legally required to, you're in violation. You're also exposed to privacy liability if someone recovers a discarded I-9 with a Social Security number on it.

And honestly, most small and mid-size dealerships don't have this documented. They assume it's happening, but they can't prove it during an audit. That's a gap worth closing right now.

Multi-Location Compliance and Dealer License Risk

If you're running multiple locations, I-9 inconsistency across rooftops is a real exposure.

Different HR coordinators at different stores might be handling verification documents differently. One location might be storing I-9s securely. Another might have them in a shared folder on a desktop computer. One store's manager understands the re-verification requirement for expiring work permits. Another doesn't. Over time, these gaps compound, and they become visible during a state regulatory audit or an immigration enforcement action at any of your locations.

Regulators view multi-location operations as having a higher standard of operational consistency. If one of your stores is out of compliance, the question becomes: why? What systems did management fail to implement to ensure consistent compliance across the group? Your dealer license is tied to your operational competence, and employment compliance is a core operational function.

The fix is standardization. Written policies on I-9 verification, storage, retention, and destruction. Quarterly compliance audits across locations. Central HR oversight or at minimum, documentation review from a single person who can flag inconsistencies. Training for every manager and HR coordinator on the process.

The Bottom Line

The I-9 form itself hasn't fundamentally changed, but the compliance environment around it has. Privacy regulations are stricter. Data security expectations are higher. And regulatory scrutiny of employment practices is intensifying, especially for multi-location operations where inconsistency becomes visible.

The good news? Most of these gaps are fixable with clear policies, documented processes, and a little attention to how you're storing and managing the personal information you're collecting. The bad news? If you're not actively managing this, you're accumulating risk every time you hire someone new.