First-Party Data

In practice your contracts decide: what each vendor may do with the data, how you can export it, and what that costs. Read the data-use, export and termination clauses before you sign or renew, and test an export before you need one. A vendor holding the data does not move your duty: the FTC expects dealers to pick capable providers, require safeguards in contracts and check on them. Arizona's 2019 dealer data law bars third parties from blocking dealers' use of their own data, and a federal appeals court declined to stop it in 2021.

Sources: ftc.gov, njcar.org

A CRM runs leads and sales follow-up; a CDP joins DMS, CRM, website and service records into one profile per customer and sends segments to ad and messaging tools. In 2026, major DMS and CRM providers started building CDP features into their own platforms, so check what you already pay for. A CDP earns its cost only if someone owns the data and you have campaigns ready to use it, and dealers who have evaluated them warn they are not hands-off.

Sources: cdkglobal.com, cbtnews.com

Deterministic matching links records that share an exact identifier, such as the same email, phone number or VIN; it is precise but finds fewer matches. Probabilistic matching links records on likely signals, such as a shared device, IP address or similar name, which reaches more people but can merge two different customers. A match rate only tells you how many records were linked, not how many were linked correctly, so ask for accuracy as well and use exact matches for anything tied to a deal or repair history.

Sources: agilebrandguide.com

The rule applies to dealers that arrange financing or lease vehicles for more than 90 days, and it protects customer information: nonpublic data about people who financed or leased through you. FTC staff say a list of buyers' names and addresses with no financing details is not customer information, but a combined database that also holds financing data is covered and needs access controls. If your marketing database is fed from the DMS, assume it holds protected fields until someone confirms it does not. This is general information, not legal advice.

Sources: ftc.gov, ftc.gov

Under the Safeguards Rule, unauthorized acquisition of unencrypted information on 500 or more consumers must be reported to the FTC within 30 days of discovery, a requirement in effect since May 2024. After the late-2025 breach at a dealer credit vendor, affected dealers could rely on a consolidated FTC filing the agency accepted or opt out and make their own call, and state notice laws still applied. Keep a written incident plan that names who decides, who calls counsel and who speaks to customers.

Sources: ftc.gov, complyauto.com, cbtnews.com

Not in Chrome: Google said it will keep offering users its current third-party cookie choice and, in October 2025, retired most of its Privacy Sandbox replacement tools. Safari has blocked cross-site cookies by default since 2020, and it carried 46.38% of US mobile browsing in September 2026, so much of your mobile traffic is already out of reach for cookie-based tracking. Build audiences on what customers gave you directly: emails, phone numbers, addresses and deal history, matched to ad platforms with consent.

Sources: privacysandbox.google.com, webkit.org, gs.statcounter.com

Probably dirtier than it looks. In a 2023 dealer survey by PureCars, only 13% felt their DMS data was clean and 48% reported outdated email addresses; in a 2025 eLEND survey, 56% of dealers said CRM, DMS and F&I records disagree more than a quarter of the time. Clean and dedupe on a schedule (the 2023 survey's authors suggest monthly at minimum), and fix entry at the source with required fields and automatic call logging.

Sources: cbtnews.com, mediapost.com

You can upload customer lists, but ads that promote credit, such as auto loan offers, fall under extra US rules. Since January 2025, Meta has required its Financial Products and Services category for these ads, which removes ZIP code targeting, lookalikes and age or gender narrowing and requires at least a 15-mile radius; Google bars targeting consumer finance ads by age, gender, ZIP code, parental or marital status. Refresh uploaded lists too: Google Customer Match memberships expire after 540 days.

Sources: developers.facebook.com, jonloomer.com, support.google.com