A car dealer enquiry puts a buyer's email address into a customer relationship management system, the CRM, alongside a name and a phone number. Sales staff work from that record, and at the finance stage it is shared with lenders. Protecting the address means giving each dealer a separate alias instead of the real inbox address, so mail from one dealer stops without touching the real inbox. Before any finance or purchase paperwork is signed, the buyer moves to a permanent address.
Dealer enquiry records#
The minimum a dealer needs to answer a question about stock is a name, an email address and a phone number, and those three fields open the enquiry form. The form does not end with the person who replies. It becomes a record in the dealer's CRM, tracked from first contact through test drive, negotiation, sale and delivery, with every message in the lead's timeline. Dealix tracks enquiries across stages named New, Contacted, Test Drive Booked, Negotiating, Sold and Lost, and the owner, the manager, the sales team and the business development team all work from the same records.
MotorComplete describes its CRM as covering the full customer life cycle, from enquiry to order to renewal. A web form address is therefore not read once and forgotten; it is stored in a shared system. Dealer guidance on GDPR states that vehicle sales often involve sharing buyer data with finance companies, warranty providers, insurance brokers and vehicle history check services, and that a finance application leads to sharing with credit providers and credit checks. The buyer is supposed to be told this before the application is completed, not after, and the privacy notice on the enquiry form is where the statement appears.
Finance applications and the Safeguards Rule#
Finance is the stage that sets a car purchase apart from most online enquiries, because it changes the data the dealer holds: an enquiry asks for contact details, while a finance application also asks for identity and financial details. Under the US Federal Trade Commission's dealer FAQ on the Safeguards Rule, dealers who finance or lease vehicles count as financial institutions, because lending money is a financial activity. A finance application includes the customer's name, address, Social Security number and financial account information.
Since May 2024, a notification requirement has applied: a breach involving the unauthorised acquisition of at least 500 consumers' unencrypted information must be reported to the FTC within 30 days of discovery, as the FTC explained in its announcement of the rule change. The FTC's complaint against Franklin Toyota alleged that customer files for about 95,000 consumers, including names, Social Security numbers, addresses, dates of birth and driving licence numbers, reached a peer-to-peer network after the dealer failed to secure its systems. The complaint is published in full by the FTC.
The alias method stops at this stage. An alias forwards mail during the enquiry; it cannot stand in for the identity a lender requires. The buyer therefore gives the dealer a permanent address before signing finance or purchase paperwork, because the signed contract, the payment schedule, the statements and any fraud alerts all depend on an address the buyer still controls years later.
An alias is for the enquiry stage. Finance and purchase paperwork need a permanent address, because the signed contract is a record the dealer, the lender and the buyer rely on for years.
Enquiry follow-up and retention#
Dealer sales guidance treats an e-lead as live for months after first contact, and follow-up can continue after the buyer has lost interest. A study cited by Canadian Auto Dealer found that 68 per cent of e-lead prospects had not yet purchased after 30 days, while most dealerships mark an e-lead as dead after three or four replies. The same guidance gives dealerships up to six months to follow up a client who has made contact, contacting dormant enquiries once a month until the buyer purchases or asks to stop.
GDPR requires personal data to be kept only as long as necessary for its purpose, but no single fixed period governs dealer enquiries, so records can be kept after follow-up ends. One dealer guide sets out three months for unsuccessful enquiries, six months for enquiries that reached a test drive and six years for completed sales records; a second guide gives 12 to 24 months after last contact as typical for unconverted enquiries. The Information Commissioner's Office sets no exact period, so the ranges are reported rather than a single figure.
Under GDPR, marketing emails to someone who enquired six months ago without buying need explicit consent, according to dealer guidance on buyer enquiries and GDPR. Consent only helps when the buyer can separate marketing mail from service mail and identify the sender; a separate alias per dealer makes both facts visible. The same pattern appears in other high-contact enquiries, covered in the AliasFleet guides on contacting rental agents and getting insurance quotes.
Breach history in the automotive sector#
Buyer email addresses in the automotive sector have been exposed repeatedly. In December 2020, the dealership service provider DriveSure lost 26GB of data, downloaded and later shared on a hacking forum. The data included 3.6 million unique email addresses, names, phone numbers, physical addresses, vehicle makes, models, VIN numbers and odometer readings, according to Have I Been Pwned.
In June 2021, Volkswagen disclosed that a vendor had kept information gathered between 2014 and 2019 for sales and marketing in an unsecured file for years, and the breach affected 3.3 million people in North America. Phone numbers and email addresses were exposed, with vehicle leasing, purchase and purchase inquiry details in some cases. Sensitive data was also accessed for 90,000 Audi customers, including driver licence numbers, Social Security numbers, account or loan numbers, tax identification numbers and dates of birth, reported by Infosecurity Magazine.
In October 2022, Toyota disclosed that an access key had sat in source code mistakenly uploaded to GitHub from December 2017 to September 2022, exposing the email addresses and customer control numbers of 296,019 T-Connect telematics service users. Toyota said there was no evidence the data was accessed by a third party, but added that this could not be completely ruled out, according to Infosecurity Magazine.
In June 2024, ransomware attacks on CDK Global, a software provider for more than 15,000 dealership locations across North America, took dealer management systems offline and sent dealers back to pen and paper for days, as described by BlackFog. In October 2026, Recruit, operator of Japan's Carsensor used-car marketplace, said unauthorised access detected on 17 October 2026 may have leaked up to 3,709,551 personal-information records, including 3,210,421 records of users who sent enquiries to dealers, of which up to 447,670 may include a full street address. Recruit has not confirmed that data left its systems, so the figures are maximums, documented by Safeguard.
Also in October 2026, General Motors agreed to pay $220 million to settle claims from 35 states and the District of Columbia that it sold drivers' location and driving data to brokers whose customers included insurers, as reported by Motoring Chronicle. The Smart Driver programme ran from 2016 to 2024, and more than 370,000 drivers were told they were not enrolled when they were. These cases run from December 2020 to October 2026, and the DriveSure data alone included 3.6 million email addresses; a buyer with an exposed address can check it with the guide on how to check if an email was leaked.
One alias per dealer#
The method gives each dealer a different alias, or one alias for the whole search when only one dealer is involved. That alias goes on every enquiry form, test drive booking and email thread with the dealer. Quotes, availability answers and test drive confirmations still arrive at the real inbox through forwarding, and the dealer's CRM works as normal. Nothing about the purchase changes at the enquiry stage.
The benefit appears after the purchase, or after the buyer stops looking. Because each alias belongs to one dealer, the address a message arrives on names its source. Pausing or deleting the alias stops the mail, without touching the real inbox or any other dealer's alias, and without an unsubscribe form or a request to delete the record. The alias label names the dealer, so aliases stay distinguishable months later, and one alias is never shared across several dealers, because a shared alias cannot identify the sender. Aliases stay active until the purchase is complete and any warranty or delivery messages have arrived, then the ones for dealers who were not chosen are paused.
An alias hides the real inbox address, not the buyer's name, phone number or the car being sought, because the dealer needs those to answer. It does not stop the dealer from sharing the alias with a finance partner, nor does it protect data handed to the dealer directly, such as a driving licence shown at a test drive. Spam from other routes is also unaffected; the AliasFleet guide on how spammers get your email address lists those routes. The alias does one narrower thing: it gives the buyer a way to stop mail from one dealer without touching the real inbox or any other dealer's mail.
AliasFleet and dealer enquiries#
AliasFleet provides email aliases that forward to a verified destination inbox. A user creates an alias for a dealer, and mail to that alias arrives in the real inbox. The alias can be paused or deleted at any time, and mail to a paused or deleted alias stops. Two-way reply routing lets the user reply from the alias, so the dealer never sees the real address. The free plan includes 10 active aliases, enough for a search across several dealers. The product page is at AliasFleet.
Three things AliasFleet does not do in this case: it does not stop a dealer from keeping the alias on file after the buyer pauses it; it does not remove the buyer's data from a dealer's CRM; and it does not replace the permanent address needed at the finance and signing stage. The guide on whether email aliases are safe covers the general limits.
The change before signing#
Before signing finance or purchase paperwork, the buyer switches to a permanent address. The signed contract creates a record the dealer, the lender and the buyer all rely on for years, covering payment schedules, statements, warranty documents, recall notices and fraud alerts. Those messages must reach an address the buyer still controls in five years, and an alias tied to one purchase search is the wrong address for that job.
The order is an alias for the search and a permanent address for the contract. That order keeps the enquiry stage private and the signed stage reliable, and it matches the position that financial accounts always get a permanent address, never an alias.
