Dealers are reminded to take steps to fully understand the legal, regulatory and business risks under both federal and state law raised by the use of website “tracking” software or other tools, such as cookies or tracking pixels. 

First, remember that website “cookies” can be “non-public personal information” under the Gramm-Leach Bliley Act and the Privacy Rule.[1] Second, dealers should be aware that the Federal Trade Commission (FTC) has recently sent warnings[2], and pursued claims related to “pixel-tracking” without adequate consumer consent against companies under a number of theories, including pursuant to their Section 5 Unfair and Deceptive Practices “UDAP” authority. This may indicate the FTC’s interest in making this issue an enforcement priority in 2024. 

New Risk 

In recent months a new risk has emerged. Dealers (along with other businesses) have been the target of lawsuits under certain state laws related to online tracking technologies that are allegedly deployed on dealer websites. Plaintiffs in these cases generally assert that personal data was collected, shared with third parties, and monetized for targeted advertising, allegedly all without user consent. They are suing, generally seeking to represent a class, and generally under one or more of several novel legal theories under state law, including wiretapping, recording, anti-hacking or invasion of privacy laws. 

The issue under most of these recent state law claims is that certain pixels, cookies and other tools,[3] such as session replay tools, online chat modules, geotargeting or geofencing tools, call recording, or AI monitoring tools, are increasingly being deployed on websites (or elsewhere,) including dealer websites. It is alleged that by using these tools, dealers are tracking or recording interactions with consumers without adequate consent under various state laws.   

These lawsuits have not generally been widely publicized – for obvious reasons – and few have been adjudicated. However, dealers should be aware of these suits and the risks associated with the use of website tracking technologies and should consult with their legal counsel regarding either limiting their use, and/or obtaining more fulsome consent (through banners or other tools) from consumers who visit your website.

How Dealers Can Protect Themselves 

On a broader level, dealers should ensure that they fully understand what tools are in use on their websites, exactly what data those tools collect, where that data is stored, what protections are provided for that data, and ensure that strong, appropriate limitations on the use of that information by any third party are in place and enforced by contract and otherwise. 

This is sensitive, and often valuable data, and unfortunately, many of these tools are placed on dealer sites by third parties – sometimes without the dealer’s knowledge or consent. Even if a dealer is aware that the tools are on their website, they may not fully understand what information is being gathered and with whom it is being shared. This creates regulatory, legal and business risks for that dealer who must have full, transparent insight into the scope and use of all tools and attendant data.

Dealers, dealership “qualified individuals” (pursuant to the GLB Safeguards Rule) and dealer attorneys should consult with their website providers, OEMs and any other third-party associated with the website (qualification tools, lead providers, etc.) and must fully address this issue. 

Dealers should ensure that:

• they fully understand these issues, the tools in use, the data gathered, and how that data is used;
• they have full transparency and insight into any tracking tools being deployed on their websites or elsewhere;
• no tools are in use, and that no consumer data is being collected without adequate consumer consent;
• the dealer has consented to all such tools –the scope of the data collected, and how it is used;
• the dealer has ensured by contract that the information is limited to only those uses that the dealer has approved;
• that adequate data security measures are applied to any data collected.

This blog post is for general, informational purposes only and not is intended as legal advice as it may not address all federal, state or other legal issues raised by the subject matter it addresses. Individuals should consult their own attorney to obtain advice with respect to any legal matter. The information presented is also not intended to urge or suggest that dealers adopt any specific practices or policies for their dealerships, nor is it intended to encourage concerted action among competitors or any other action on the part of dealers that would in any manner fix or stabilize the price or any element of the price of any good or service.