Customer complaints about AI agents surfacing personal phone numbers and addresses have jumped 400% in seven months, according to MIT Technology Review, and dealership leadership sits squarely in the blast radius.

Run your own name through an AI search engine and you may find more than a LinkedIn page: an old home address, a family member’s maiden name, a landline from a college apartment, even the address of the community center your kids swam at 20 years ago. It’s all stitched together in seconds from freely available sources.

To face this “internet is forever” reality, use the following checklist to find out where your management team stands and close the gaps before someone else finds them:

1. Understand Why Dealerships Are a Target.

☐ Consider the data trail your store generates every weekend. It starts with a credit application in the F&I office and stacks up with a trade-in title, a service ticket with a customer’s cell number and the make and model sitting in their driveway, and a sales manager’s direct line on a call-me-anytime business card.

☐ Know that a GM’s name and extension on your “Our Team” page, a dealer principal quoted at a ribbon-cutting, and a service director answering Google Reviews by name all build a public trail. While none of it reckless, any AI can now assemble this data into a full profile in under a minute.

☐ Confirm whether your providers — including DMS, CRM and lead gen — have shared customer data with generative AI developers. Confirm the contract addendums the FTC’s Safeguards Rule requires are in place to push cyberliability back onto the third-party DSP.

2. Know How Bad Actors Build the Profile.

☐ Understand the “investigative-style” prompting technique. A few pointed questions about a neighborhood, a former employer, or a spouse’s first name pulled from a Facebook post can return a home address, a purchase price and phone numbers for the whole family.  Open source ancestry sites are also disturbingly easy to exploit.

☐ Treat this as the same reconnaissance-to-attack pipeline behind phishing and spoofed DMS-vendor emails, just running on a faster, AI-turbocharged engine.

☐ Flag GMs and multirooftop leaders who are known faces in the community as higher risk for social engineering, wire-fraud attempts against the office manager, or physical security threats to a family member.

3. Accept That Takedown Requests Don’t Work.

☐ Don’t expect a request-a-manager button for AI training data; once a phone number or address is scraped into a model’s training set, there is no reliable process — not from the AI companies, not under California’s CCPA, not under the Safeguards Rule — to confirm it’s in there or get it removed.

☐ Understand that publicly available information, the kind sitting in a property record or a dealer bio page, generally falls outside what current privacy law even covers.

4. Run the “Carfax” on Your Own People.

☐ Search data broker sites, old forum posts, property records and social media for your GM, dealer principal, F&I leadership and anyone else whose name and face are the public front of the store. A quick Google search isn’t enough.

☐ Document what’s exposed today as your baseline before you try to fix anything. Provide the exec the profile as incentive.

5. Get Ahead of the Next Training Run.

☐ File removal requests through consumer-deletion portals, now offered in many states, to reduce what’s available for the next scrape. Utilize for-pay services. They are relatively cheap and reduce repeat scrapes.

☐ Repeat this regularly; data brokers refresh their listings and new AI models train on fresh scrapes constantly.

☐ Accept that proactive removal can’t undo what’s already baked into current LLMs, but it shrinks tomorrow’s exposure.

6. Treat Doxing as a 20 Group Problem, Not a One-Off Fix.

☐ Assign ongoing ownership to stay on top of the issue. This isn’t a Saturday afternoon project for one tech-savvy office manager.

☐ Establish an open-source intelligence (OSINT) methodology and monitoring tool set — the same discipline professional threat-intelligence teams use.

☐ Apply that discipline specifically to the executive management team signing your paychecks.

7. Monitor the Bigger Picture.

☐ Know that public internet data for AI training is running out, which is pushing developers harder toward data brokers and people-search sites to keep the pipeline full.

☐ Understand that every day that passes locks more of your leadership’s historical personal information into systems built to make it instantly findable, with no easy or available solution once it happens.

☐ Remember the real new exposure isn’t the consumer data sitting in your DMS; it’s what an upset customer with basic tech skills, or a black hat hacker, can now learn about your executive team with nothing more than a well-worded prompt and a few phone calls.

Jim Lawrence is a 25-year industry veteran and the founder of ImagineMyDreamCar.