The California Consumer Privacy Act (CCPA) has introduced a dedicated enforcement agency, the CPPA, which proactively conducts audits on businesses for compliance. This marks a shift in privacy regulation, necessitating continuous compliance efforts from dealerships and other businesses, beyond mere reaction to complaints.
Dealerships are facing an increasing number of lawsuits and demand letters alleging violations of CIPA due to website tracking tools. These claims highlight the evolving legal risks surrounding website privacy, emphasizing the need for compliance and proactive management strategies.
Another Surge in Website Tracking Tool Claims Targets Auto Dealers Read Post »
Why the state-law argument against pre-consent blocking misunderstands how notice, choice, intentional interaction, and third-party sharing work online. Some marketing
WHY “TRACK NOW, OPT OUT LATER” DOES NOT WORK Read Post »
The Federal Trade Commission announced on July 2, 2026, that travel-booking app Hopper has agreed to pay $35 million to resolve allegations that it charged consumers hidden fees despite marketing itself as a “no hidden fees” service. The settlement is the latest in a string of federal actions targeting so-called “junk fees” — charges that are omitted or buried until late in a transaction — and reinforces a regulatory throughline that now spans travel, ticketing, lodging, and auto sales.
On June 16, 2026, Vermont enacted VDPOSA, enhancing consumer privacy rights. Effective January 1, 2028, it mandates compliance from businesses handling significant consumer data, necessitating privacy program evaluations.
Vermont Enacts Comprehensive Privacy Law: What Auto Dealers Need to Know Read Post »
The 2025 amendments to Connecticut’s Data Privacy Act mandate dealership compliance by July 1, 2026, following significant changes in data processing regulations.
Connecticut’s Privacy Law Clearly Applies to All Dealerships – July 1, 2026 Deadline Read Post »
On March 30, 2026, the Federal Trade Commission (FTC) announced a settlement with OkCupid and its affiliate Match Group Americas over allegations that OkCupid deceived millions of users by sharing their personal data—including photographs, geolocation information, and other sensitive details—with an unauthorized third party in direct violation of the company’s own published privacy policy.
FTC v. OkCupid & Match Group: A Reminder That Your Privacy Policy Must Reflect Reality Read Post »
On March 20, 2026, Oklahoma became the 20th state to pass a comprehensive consumer privacy statute. The Oklahoma Consumer Data Privacy Act (“OKCDPA”) takes effect January 1, 2027.
Oklahoma Becomes 20th State With Comprehensive Consumer Privacy Law Read Post »
The FTC announced in December 2025 that Avast would pay more than $15.3 million to be distributed to over 103,000 consumers affected by Avast’s alleged deceptive and unfair practices.
