I'd suggest your friend find a dealer who's out of the local market area and price/buy from them. That, and use Worldpac.

I don't see any legal issue. Your friend gave the VIN freely, and with no restrictions. If they had a privacy agreement that would be an... Login to read more.