Dealers rely on a wide range of automotive technology vendors, and many of those vendors place cookies, pixels, and other tracking technologies on dealer websites. The challenge is that traditional consent management platforms may not fully detect or control every third-party technology in use. That can leave a dealer with a consent banner that appears compliant but does not address what is actually loading behind the scenes.

This risk is becoming more urgent because of the California Invasion of Privacy Act, or CIPA. Originally written as a wiretapping statute, CIPA is now being applied to cookies and pixels that load before a visitor provides consent. Unlike many privacy claims, these cases do not require proof of harm, only an allegation of unauthorized interception.

And this is not just a California issue. A dealer’s location does not determine exposure; the visitor’s location does. Claims have already reached dealers in states including Texas, Ohio, Pennsylvania, and Florida. Serial litigants may also use automated testing tools, proxies, and VPNs to search for gaps in website consent controls.