Dealership Website Tracking Pixels and Session Replay: What’s Running and Who’s Responsible

Dealership website tracking pixels are small pieces of code from ad platforms, analytics tools, chat and session replay vendors that record what shoppers do on your site and send it to those companies. The question worth asking is which ones are running on your site and who put them there.

That second part is the real issue. The pixels themselves are ordinary marketing tools. The trouble starts when nobody at the store owns the list, because then nobody checks what the code collects on the pages that matter, like the credit application.

Try something for me. Pull up your store’s website and count the companies you think are watching what shoppers do on it. The website provider, Google, probably Facebook. Then keep going.

You can’t get the full count by looking at the page. The FTC’s technology office says tracking pixels “can be hidden from sight,” and that’s by design.

I’m not writing this to scare anybody. Tracking is how your marketing team knows which ads sold cars last month, and I started on the dealership sales floor in the late ’90s, so I like knowing that too. But there’s a question I always ask myself when something feels off, and it fits here: what am I not doing? If nobody at your store is keeping track of the trackers, that’s the answer. This post is the website side of our guide to dealership privacy laws by state. That guide covers which laws apply to your rooftops. This one covers what’s actually running on your site.

Short version first. You can’t manage what you haven’t listed. Nobody can.

What Is Running on a Typical Dealership Website?

A dealership website can run tags from the website platform, Google, Meta, the store’s ad agency, a chat provider, a trade-in or digital retailing tool, a credit application vendor, and a session replay tool. Each one can send shopper activity to its own company.

The FTC’s Office of Technology put out a plain-English explainer on this in March 2023, “Lurking Beneath the Surface: Hidden Impacts of Pixel Tracking.” It’s short. Two lines in it are worth reading twice. Pixels “can track and send all sorts of personal data such as how a user interacts with a web page including specific items a user has purchased or information users have typed within a form while on the site.” And blocking third-party cookies “may not entirely prevent pixels from collecting and sharing information.” So the old answer, “we’ve got a cookie setting for that,” doesn’t cover it.

Here are the kinds of tools that can show up on a dealer site. Your list will differ. Pay attention to the third column, because it’s the one you may have to go find out.

Add a payment calculator from the captive lender, a review widget on the service pages, and whatever heat-map tool someone tried during the last website refresh. Then ask the GM to write the list from memory. I’ll wait.

Who Put It There, and Who Owns It Now?

Before Helion Technologies I spent five years selling CRM to dealers, so I know the vendor’s side of this. Vendors want to show their product is producing leads, and code on the dealer’s website is one way to measure that. Adding a tag is a request someone makes. Removing one when a contract ends may not be anybody’s assigned job. Nobody’s fault, really. That’s how a store can end up with a pixel from an agency it let go, still reporting homepage visits to an ad account no one at the dealership can log into.

The clutter isn’t what should bother a dealer most, though. The ad platforms’ own rules already say not to send them this kind of information. Google’s Analytics terms say you won’t pass Google information “that Google could use or recognize as personally identifiable information,” and Google’s help pages give “email addresses, personal mobile numbers, and social security numbers” as examples. Meta’s Business Tools Terms go further: the business promises not to share data that “includes or is based on, directly or otherwise, health information, financial information, consumer report information, or other categories of sensitive information.” A credit application is financial information, and a prequalification tool that does a soft credit pull is working with consumer report information. Neither belongs in an ad pixel.

So a pixel that sends a shopper’s details from your finance page isn’t only a privacy question. It can also put the store on the wrong side of terms someone accepted on the store’s behalf when the ad account was set up.

The Safeguards Rule already puts one person in charge of the security program. 16 CFR 314.4(a) calls for a Qualified Individual to oversee and implement it, and says that person “may be employed by you, an affiliate, or a service provider.” The tag list touches more departments than one person, though, so here’s how I’d split it up:

• The dealer principal or GM decides how much tracking the store is comfortable with, because it’s a decision about how you treat customers before it’s a technical one.
• Marketing keeps the list. At a single store that could be the internet sales manager or the agency; at a group, the marketing director.
• Your Qualified Individual under the FTC Safeguards Rule makes sure any vendor that can reach customer information gets reviewed like every other vendor.
• IT or the security provider checks what actually fires on each page.
• Your attorney tells you which state laws reach your shoppers and what your privacy notice has to say about all of it.

Five people, one list.

Where It Matters Most: Credit Applications and Chat

A pixel on your new inventory page and a pixel on your credit application are not the same thing, and this is where dealers are different from most retailers. Dealers have their own privacy rule under the Gramm-Leach-Bliley Act. The FTC’s version, 16 CFR part 313, covers financial institutions “predominantly engaged in the sale and servicing of motor vehicles, the leasing and servicing of motor vehicles, or both.” If that’s new to you, my post on GLBA vs the FTC Safeguards Rule walks through why.

That rule is specific about what counts. Very specific. Its definitions in 16 CFR 313.3 list “information a consumer provides to you on an application to obtain a loan,” “the fact that an individual is or has been one of your customers,” and “any information you collect through an Internet ‘cookie'” as personally identifiable financial information. Read those three together and think about a tag that fires on the page a shopper sees right after submitting a credit app. It can tell an outside company that this browser just reached the end of a credit application at your store. That’s the whole problem. I’m not a lawyer, and your attorney gets the final word on that, but it’s the first page I’d check.

Chat is the other one. A chat widget sees everything a shopper types, and shoppers type a lot. Trade payoff. Phone number. “My credit’s not great, can I still get approved?” If the chat vendor’s code or a session replay script records those messages, that conversation is sitting with an outside company for as long as its retention policy allows. Do you know how long that is? We covered the data side of chatbots in more depth in our AI chatbot security checklist for car dealerships.

Inventory pages are marketing. Credit and chat pages are customer information. Treat them differently.

Why the Lawsuits Keep Coming Up

You may have heard about wiretap suits over website chat and session replay in California. Here’s the context, kept short on purpose. Bear with me.

The suits are brought under section 631 of California’s Invasion of Privacy Act, known as CIPA. Plaintiffs argue that a third-party chat or session replay vendor recording a site visit is a form of interception. The money is why it matters: as Mayer Brown’s June 2025 summary puts it, “CIPA mandates statutory damages of $5,000 per violation.” The courts haven’t settled it. Not even close. Two days apart that June, the Ninth Circuit affirmed dismissal of a session replay claim against Papa John’s and reversed dismissal of a section 631 claim against Bloomingdale’s, letting that one go forward. Both were short memorandum decisions. Neither involved a dealership. Neither settled the question.

On the federal side, the FTC has used pixel cases to make the same point from a different angle. In February 2023 it announced a proposed order under which GoodRx would pay a $1.5 million civil penalty for failing to report its disclosure of consumers’ health information “to Facebook, Google, and other companies.” That case ran under the Health Breach Notification Rule. Different industry, different rule. Same lesson about knowing what your tags send.

I’d rather a dealer fix this because it’s the right way to treat a customer than because of a headline. The lawsuits are a reason to look. They’re not the reason to care.

Consent Banners and Privacy Notices: What They Can and Can’t Do

A cookie consent banner only helps if it actually holds the tags back until the shopper says yes. If the ad pixels load before the banner does, the shopper’s click doesn’t change what was already sent. Step 7 below shows how to check.

California adds a second test. If the California Consumer Privacy Act applies to your store, and your attorney can tell you whether it does, the regulations at 11 CCR 7025 say a business that sells or shares personal information “shall process any opt-out preference signal” as “a valid request to opt-out of sale/sharing.” Global Privacy Control, a setting available in some browsers and extensions, and it was at issue in the Sephora case. In August 2022 the state’s attorney general announced that Sephora would pay $1.2 million in penalties, partly because it “failed to process user requests to opt out of sale via user-enabled global privacy controls” while third-party trackers watched shoppers on its site. Sephora sells makeup, not cars. Fair enough. But the case was about third-party tracking on a retail website, the same category of tool this post is about.

Privacy notices drift too. Quietly. A notice written when the site launched can still name a chat tool the store dropped years ago and say nothing about a session replay script added since.

For the dealers whose compliance we manage, this is something we just take care of. If we’re running a store’s compliance program, the cookie and privacy statement banners are part of what we look after. It’s not something we sell on its own, and I wouldn’t want anybody to buy it that way. It’s one small piece of a much bigger job, which is keeping the store’s whole continuous compliance program for dealerships current.

The banner tells the shopper what happens. The site has to match.

How Do You Find Out What’s Running on Your Dealership Website?

Build one list of every tag on your site, check the credit application and chat pages first, and get each vendor’s answers in writing. A first pass doesn’t require new software, and it’s worth repeating whenever a vendor or campaign changes.

1. Ask your website provider for a list of every script and tag installed on the site and in its tag manager, with the date each was added.
2. Send the same question to your agency, chat vendor, trade-in tool, and credit app vendor. In writing. Not on a call.
3. Have IT or your security provider load the site in a clean browser and record every outside address it calls, then hold that up against the vendors’ lists.
4. Check three pages by hand: the credit application, the thank-you page right after it, and a vehicle page with chat open.
5. Pull the pixels nobody can explain. No owner, no pixel.
6. Add every vendor that can see customer information to your vendor list. A dealership IT vendor inventory worksheet is a fine place to keep it.
7. Test the consent banner by declining everything, reloading the page, and watching what still fires.
8. Put the next review on the calendar now, and do one any time you switch agencies.

Step 3 is the one that catches what the vendor lists leave out, like a tag from a vendor the store stopped paying that still loads on every page.

What Vendor Terms Should Say About Your Website Data

Once you know who’s on the site, read what they agreed to. The FTC Safeguards Rule defines a service provider as “any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution,” and 16 CFR 314.4(f) says you oversee them by selecting capable providers, “requiring your service providers by contract to implement and maintain such safeguards,” and “periodically assessing your service providers based on the risk they present.” A chat vendor that stores your customers’ conversations fits that description pretty cleanly. A credit app vendor certainly does. Your agency might. Check.

When you read a website vendor’s terms, check a few plain things. Does the vendor say what data its code collects? Can it use your shoppers’ data for its own purposes, like training a model or building audiences it sells to someone else? How long does it keep chat transcripts and recordings? Will it tell you if it has a breach? And can you get the data deleted when you leave?

If the answers aren’t in the contract, ask for them. A vendor that won’t put it in writing has told you something. Listen.

The same thinking applies to AI tools on your site, and we wrote up the questions for those in our AI vendor risk assessment for dealerships.

Contracts are boring. They’re also where a vendor’s promise becomes something you can hold it to.

Common Questions About Dealership Website Tracking

Know What’s on the Site Before Anyone Asks

A dealer website with a long tag list isn’t doing anything shady. It may just be carrying years of other people’s code that nobody has looked at in a while. That’s fixable. A shopper who types their income and employer into your credit app is trusting the name on your building, not the ad platform that happened to be loaded on the page.

We manage the technology so dealers can sell and service cars and heavy trucks. Across the 2,000-plus dealerships we support, knowing what’s running on the website is one small, unglamorous part of that. If you’d like an outside look at the rest of the picture, start with our complimentary IT and cybersecurity assessment. It reviews your technology setup, security posture, vendor spend, and where you stand against the FTC Safeguards Rule, and the findings come back in a written report.

That’s what peace of mind looks like here. A short list, an owner for every line, and nothing on the site you can’t explain.