Georgia resident Andy Morar is in the market for a BMW. So recently he sent a note to a showroom near Atlanta, using a form on the dealer's website to provide his name and contact information.

His note went to the dealership—but it also went, without his knowledge, to a company that tracks car shoppers online. In a flash, an analysis of the auto websites Mr. Morar had anonymously visited could be paired with his real name and studied by his local car dealer.

When...