#Fire the cheap-shot vendors
One Google search that does not show the store well. A screenshot. A note that 99.9% of the marketing is broken. Or one ugly chart with no questions about what changed on the site that week.
The point is to make you question every other vendor and open a door. Zero tolerance. Replace them. Every hour on those calls is an hour not spent on inventory, appointments, or campaigns that actually buy traffic.
Real partners check the tag, the consent state, the filter, the bot spike, the OEM page change, and the paused campaign before they send the alarm.
#A 70% drop is almost never the vendor
Rankings move. Paid efficiency moves. A model-year change or site migration can dent a channel. None of those erase most of a healthy franchise site overnight while the showroom still looks normal. If phones, CRM, and the lot match last month, the dashboard broke.
First reaction: measurement problem, not demand problem. Second: the compliance banner. Most tools have multiple modes. Stores inherit the most conservative one from a vendor, OEM template, or lawsuit fear, and nobody documents what it blocks.
The owner took the tool off on his own. Site averaged a little under 200 visits a day. Next day, tool fully off: more than 850. Same store, market, ads. Roughly three-quarters of the traffic had been invisible.
That is a consent gate in front of analytics and ad pixels, not a ranking collapse. If you cannot see most of your traffic, car dealer marketing and car dealer SEO reporting are flying blind.
#What you actually lose
- Retargeting and lookalikes only learn from people who accepted tracking. You keep paying to reach a slice and never learn from the rest.
- Personalization tools cannot recognize the return visitor, so most intent gets the default experience.
- Smart bidding trains on a conversion pixel that never fired.
- SEO and content decisions get made on pages that look dead only because the tag was blocked.
- Car dealer GEO needs clean evidence of which pages and offers earn the visit and the lead. If three-quarters of sessions never enter the dataset, you cannot tell an AI system (or your team) what is working.
Public numbers on strict opt-in banners:
- UK Information Commissioner’s Office, 2011: own site’s recorded analytics fell ~90% after a hard banner (FOI; >90% declined the analytics cookie).
- etracker-type benchmarks: ~60% average visit-data loss on legally strict banners.
- 2023 study of 1.2 million users: only 25.4% accepted all cookies at the first banner.
- Orbit Media GA4 vs cookieless: ~11% under-reporting without a banner, ~20% with one. Some consent-gated audiences held well under half the sessions.
- U.S. acceptance often cited 65–75% when reject is as easy as accept; Europe closer to 40–50%.
Our client’s jump (under 200 → over 850) sits at the harsh end. One rooftop, one cutover. It is the shape of the problem vendors call an SEO failure.
#What changed in 2026
California narrowed one lawsuit theory, left the others standing. Legislature passed SB 690 August 28, 2026. Newsom signed it September 30, 2026. For website/app conduct, private plaintiffs can no longer sue under CIPA pen-register / trap-and-trace (Penal Code § 638.51). Those claims go to the Attorney General. Described as applying to pending cases filed within two years of the operative date; takes effect January 1, 2027. Sections 631, 632, and 632.7 were not repealed. Appropriations Committee working assumption: roughly 4,000 pending CIPA actions, mostly pen-register. Reform CIPA coalition said the bill would fully relieve only a minority of organizations then in litigation. Summer 2026 Court of Appeal discussion in Variety Media treated the pen-register definition as capable of reaching internet communications. Pixel demand letters on that one theory get harder after the effective date. Chat, form, and session-replay theories under other sections are still live.
Three more privacy laws turned on January 1, 2026; four more enacted for later. Indiana, Kentucky, Rhode Island effective January 1, 2026. Oklahoma (signed March 20, 2026, effective Jan 1, 2027), Alabama (signed April 17, 2026, effective May 1, 2027), Louisiana (Act 502, signed May 29, 2026, effective Jan 1, 2027), Vermont (Act 145, signed June 16, 2026, effective Jan 1, 2028). Counting Florida’s narrower Digital Bill of Rights: ~20 in force, ~24 enacted.
Geolocation sale bans tightened. Virginia SB 338 (sale of precise geolocation) took effect July 1, 2026, replacing opt-in with a prohibition. Connecticut Public Act 26-64 (mostly Oct 1, 2026) bans sale of precise geolocation; data-broker registration follows January 1, 2027. Maryland, Oregon, and Virginia are now in the same camp. Matters on VDPs and direction clicks.
Connecticut covered more ordinary businesses; California tightened the opt-out interface. Connecticut amendments (July 1, 2026) dropped a key threshold from 100,000 to 35,000 consumers and can pull in a business that processes sensitive data or sells personal data even below that. CCPA regulations effective January 1, 2026 require covered businesses to display whether a universal opt-out signal was processed. Honda’s March 2025 CPPA settlement ($632,500; no admission of liability) is the OEM example: asymmetric cookie choices were part of the order.
Maryland’s October 1, 2026 surveillance-pricing ban targets large grocers, not showrooms.
#How to read the tables
Two different legal systems get mashed together in vendor emails.
Consumer privacy statutes are mostly opt-out: notice + a way to opt out of sale/sharing/targeted advertising. Twelve states require honoring a browser signal such as Global Privacy Control (California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas). They generally do not require European-style prior consent before analytics fires. Sensitive data and data about minors usually do. Thresholds mean a single rooftop may or may not be covered; a group with shared sites often is. Florida’s law is especially narrow ($1 billion revenue threshold).
Wiretap / all-party recording statutes are why chat, session replay, and some pixels became lawsuit targets. Plaintiffs have sued stores outside all-party states because the visitor was in one. A banner that claims tags are off while tags still fire is its own problem under both theories. Practical all-party list: California, Connecticut (phone), Florida, Illinois, Maryland, Massachusetts, Montana, Nevada (phone), New Hampshire, Oregon (in person), Pennsylvania, Washington. Delaware unsettled. Michigan’s statute reads broadly; courts have treated a participant recording as one-party.
Visitor location can matter more than the store’s address. A Texas rooftop with California shoppers is not a Texas-only privacy problem.
#States with a comprehensive privacy law in force
Thresholds, cure periods, and private-right rules differ. “Opt-out” means the statute is not a GDPR-style accept-before-cookies law. Wiretap risk is called out separately where the recording rule is all-party or mixed.
TABLE
States with a comprehensive privacy law in force
| State | Law and status | What dealers should know | Questions to research before any settings talk |
|---|---|---|---|
| California | CCPA/CPRA, in force since 2020, CPRA amendments 2023. Regs updated Jan 1, 2026. SB 690 signed Sept 30, 2026, pen-register private suits end for website conduct on the bill’s operative date. | Strictest enforcement state. Opt-out of sale/sharing, GPC required, symmetry if you ask for a choice. CIPA still reaches other theories. All-party recording state. Statutory CIPA damages often cited at $5,000 per violation. | Does the banner actually block non-essential tags until a choice, or only say it does? Is GPC honored and disclosed? Are chat and session replay treated differently from analytics? |
| Colorado | Colorado Privacy Act, July 1, 2023. GPC/UOOM since July 1, 2024. | Opt-out of sale, targeted ads, certain profiling. Sensitive data is opt-in. One-party recording state. | Is the targeted-ad opt-out wired, or only a cookie popup with no effect? |
| Connecticut | CTDPA, July 1, 2023. GPC since Jan 1, 2025. Threshold drop and minor-ad limits July 1, 2026. Precise-geolocation sale ban Oct 1, 2026. | Now reaches smaller controllers. Phone recording is all-party; in-person is one-party. | Does the site share precise location with ad platforms? Did the July 2026 threshold pull the store in? |
| Delaware | Personal Data Privacy Act, Jan 1, 2025. GPC since Jan 1, 2026. | Opt-out model. Recording statutes conflict; treat as unsettled, not as a free pass. | Which recording analysis counsel uses, and whether chat is in scope. |
| Florida | Digital Bill of Rights, July 1, 2024. | Often listed with comprehensive laws, but the $1 billion revenue line means most rooftops are outside it. All-party recording state, which is the more relevant banner issue for a typical store. | Do not assume “no Florida privacy law” means chat and replay are low risk. |
| Indiana | Consumer Data Protection Act, Jan 1, 2026. | New this year. Virginia-style opt-out. No statutory GPC duty. One-party recording. | Was the banner left on a national opt-in default after a law that does not require one? |
| Iowa | Consumer Data Protection Act, Jan 1, 2025. | Narrower opt-out. No standalone targeted-ad opt-out in the way later states wrote it. No GPC duty. One-party recording. | Which of the store’s pixels are “sales” under Iowa’s narrower list? |
| Kentucky | Consumer Data Protection Act, Jan 1, 2026. | New this year. Virginia-style. No GPC duty. One-party recording. | Same inherited-template question as Indiana. |
| Maryland | Online Data Privacy Act, Oct 1, 2025. GPC required. Sensitive-data amendment July 1, 2026. | Stricter data-minimization reputation than Virginia-model states. All-party recording. Geolocation sale already restricted. | Are inferred sensitive attributes being built from site behavior for ads? |
| Minnesota | Consumer Data Privacy Act, July 31, 2025. GPC required. | Opt-out, plus a right to know specific recipients that vendors sometimes cannot answer. One-party recording. | Can the tag vendor list who receives dealer site data? |
| Montana | Consumer Data Privacy Act, Oct 1, 2024. GPC required. | Small-state thresholds still catch groups. All-party recording. | Banner mode versus recording risk are separate questions. |
| Nebraska | Data Privacy Act, Jan 1, 2025. GPC required. | Broad “doing business” style coverage compared with high-threshold states. One-party recording. | Is GPC honored even if the rooftop assumed it was too small? |
| New Hampshire | Privacy Act, Jan 1, 2025. GPC required. | Opt-out privacy law plus all-party recording. | Chat and form vendors should be on the counsel list, not only the cookie tool. |
| New Jersey | Data Privacy Act, Jan 15, 2025. GPC required. | Opt-out, sensitive-data opt-in. One-party recording. | Preference center versus banner-only. |
| Oregon | Consumer Privacy Act, July 1, 2024. GPC since Jan 1, 2026. Precise-location sale restricted. | In-person recording is all-party; phone is one-party. | Location and chat get different analyses. |
| Rhode Island | Data Transparency and Privacy Protection Act, Jan 1, 2026. | New this year. Lower thresholds than Virginia (about 35,000 consumers, or 10,000 if sale revenue is significant). No GPC duty. One-party recording. | A single high-traffic rooftop can clear 35,000 consumers. |
| Tennessee | Information Protection Act, July 1, 2025. | Virginia-style. No GPC duty. One-party recording. | Template settings versus statute. |
| Texas | Data Privacy and Security Act, July 1, 2024. GPC since Jan 1, 2025. | Small-business exception is not a blanket dealer exemption. One-party recording. High out-of-state visitor volume. | California and Florida visitors still matter on a Texas site. |
| Utah | Consumer Privacy Act, Dec 31, 2023. | Narrower, more business-friendly opt-out. No GPC duty. One-party recording. | Do not copy a Utah setting onto a California visitor. |
| Virginia | VCDPA, Jan 1, 2023. Precise-geolocation sale ban July 1, 2026. | The template other states copied. No statutory GPC duty. One-party recording. | Sale of precise location is now a prohibition, not an opt-in, for covered activity. |
#Enacted, not yet in force
TABLE
Privacy laws enacted but not yet in force
| State | Law | Signed | Effective | Dealer note |
|---|---|---|---|---|
| Oklahoma | SB 546 | March 20, 2026 | January 1, 2027 | Virginia-style opt-out. One-party recording. Research coverage thresholds in 2026, not in December. |
| Louisiana | SB 386, Act 502 | May 29, 2026 | January 1, 2027 | Same planning window. One-party recording. |
| Alabama | HB 351 | April 17, 2026 | May 1, 2027 | Unanimous passage. Broader thresholds than some dealers expect, with exemptions counsel has to apply. One-party recording. |
| Vermont | S.71, Act 145 | June 16, 2026 | January 1, 2028 | Later date, more consumer-side reputation in summaries. One-party recording. Long runway is not the same as no project. |
#States without a comprehensive consumer privacy statute
No comprehensive law is not “no rules.” Privacy policies, FTC rules, the federal Video Privacy Protection Act on video pixels, OEM contracts, and wiretap statutes still apply. A filed bill is not a setting. As of this update the enacted pipeline on a calendar is Oklahoma, Louisiana, Alabama, and Vermont above.
TABLE
States without a comprehensive consumer privacy statute
| State | Comprehensive privacy law | Recording rule used in lawsuit theories | What to do with the banner conversation |
|---|---|---|---|
| Alaska | None in force | One-party | Do not install a global hard opt-in only because a template says every state needs one. Do not skip notice, VPPA, or out-of-state visitors. |
| Arizona | None in force | One-party | Same. Bills appear regularly and have not become a comprehensive statute. |
| Arkansas | None in force | One-party | Watch session-replay and chat even without a state privacy act. |
| Georgia | None in force | One-party | Large dealer state. Visitor-state law still travels with the shopper. |
| Hawaii | None in force | One-party | Same research questions. No statute here requires a specific dealer banner. |
| Idaho | None in force | One-party | Same. |
| Illinois | None in force | All-party | BIPA is a biometric law, not a cookie statute, but all-party recording is why chat and replay get demand letters. Research those tools specifically. |
| Kansas | None in force | One-party | No comprehensive law. Do not treat that as a tracking free-for-all on pages that collect leads. |
| Maine | None in force | One-party | Bills have circulated for years without a comprehensive enactment as of this update. |
| Massachusetts | None in force | All-party | No comprehensive act in force. Recording rule is the live issue for chat and replay. |
| Michigan | None in force | Statute reads broadly; courts have allowed a participant to record | Counsel should characterize Michigan. Do not let a vendor pick the label. |
| Mississippi | None in force | One-party | No comprehensive law. |
| Missouri | None in force | One-party, with a narrower oral-communication provision | Confirm which provision a demand letter is citing. |
| Nevada | No comprehensive act. Older opt-out-of-sale notice exists. | Phone is all-party; in-person is one-party | An existing sale opt-out is not the same thing as a CCPA banner. Research both. |
| New Mexico | None in force | One-party | Same baseline research. |
| New York | None in force. AG guidance has criticized broken decline buttons and dark patterns. | One-party | New York can enforce deceptive banner design without a comprehensive privacy statute. SHIELD Act still covers security. |
| North Carolina | None in force | One-party | High dealer density. Out-of-state visitors matter. |
| North Dakota | None in force | One-party | Same. |
| Ohio | None in force | One-party | Large market, no comprehensive act as of this update. |
| Pennsylvania | None in force | All-party | Recording rule is the item to research. Comprehensive bills have not landed. |
| South Carolina | None in force | One-party | Same baseline. |
| South Dakota | None in force | One-party | Same. |
| Washington | None in force. My Health My Data is a health-data law, not a general cookie act. | All-party | Do not let a vendor call MHMD a dealer CCPA. Do research chat, replay, and any health-adjacent forms. |
| West Virginia | None in force | One-party | Same baseline. |
| Wisconsin | None in force | One-party | Same. |
| Wyoming | None in force | One-party | Same. |
| District of Columbia | None in force | One-party | Federal VPPA and FTC rules still apply. |
Pull the same date range in analytics, the ad platforms, and the CRM. If leads and sold units did not move with the sessions, you are looking at tracking. Ask the banner installer in writing which tags fire before a choice, which honor Global Privacy Control, which states are on an opt-in rule and why, and whether chat, session replay, and ad pixels sit in a different bucket from analytics. Annotate the analytics property the day a banner is installed, updated, or removed.
Not legal advice. General information only. Do not remove a compliance banner, cookie tool, chat widget, or session-replay script, or change any settings, without research and privacy counsel. Those tools reduce liability. Laws summarized as of October 4, 2026.