Auto dealer groups
CCPA requirements for California auto dealers
Dealer websites run inventory feeds, chat widgets, credit apps, and retargeting pixels from several vendors at once. That stack is where opt-out mechanisms most often break.
Who is covered
The CCPA applies to for-profit businesses doing business in California that meet any one threshold: annual gross revenue above $26,625,000 (as adjusted by the CPPA), buying, selling, or sharing personal information of 100,000+ consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information. Many multi-rooftop dealer groups clear the revenue threshold.
What to check on a dealer site
Opt-out problems on dealer sites tend to come from third-party tools rather than the dealer's own code.
- A “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” link reachable from every page, including OEM-template pages (Civ. Code §1798.135).
- Retargeting and analytics tags that stop firing when a visitor sends a Global Privacy Control signal (11 CCR §7025).
- A privacy policy with a California rights section, updated at least every 12 months (Civ. Code §1798.130(a)(5)).
- Chat, trade-in, and credit-application vendors whose contracts include required purpose-limitation terms.
Why monthly evidence matters
Dealer sites change constantly — new specials pages, new vendors, platform migrations. A dated monthly record of what was tested, and what was found, shows the opt-out was maintained over time, not just on launch day.
Primary sources
- CCPA statute text (Civ. Code §1798.100 et seq.), effective Jan 1, 2026 — cppa.ca.gov
- CPPA — Updated Monetary Thresholds in CCPA (Civ. Code §1798.199.95(d))
- CPPA — California Consumer Privacy Act Regulations (Cal. Code Regs., tit. 11, §7000 et seq.)
Everproof provides compliance software and operations support. It is not a law firm and does not provide legal advice. Using Everproof does not guarantee compliance or prevent fines.