How Do You Build a Vertical SaaS for Auto Dealers (Reynolds / CDK) Go-to-Market Motion in 2027?
You build the motion around the dealer management system (DMS) rather than around the dealer: get certified on the DMS your buyers run, sell to a small set of dealership roles through NADA channels, and be ready to answer data-security questions on day one. The Seventh Circuit described CDK as holding "over 40% of the market and Reynolds around 30%" in 2017, so most dealerships' data sits behind one of two gatekeepers. CDK's API terms make the developer complete certification "at its own cost," and fee amounts are not published.
The market is 16,991 franchised dealers, per NADA's 2026 mid-year report. The June 2024 outage, which the Anderson Economic Group estimated cost dealers about $1.02 billion, made resilience a buying criterion. Current market shares, Reynolds fees and typical deal sizes are not disclosed in the sources read, so this page does not guess them.
Start with the market you are selling into
NADA's 2026 mid-year report counts 16,991 franchised light-vehicle dealers that sold 7.9 million light-duty vehicles, with dealership sales above $640 billion, more than 136 million repair orders and nearly $83 billion in service and parts sales. Those figures matter for a vertical SaaS pitch because the revenue is not only vehicle sales: service and parts is a separate buying center with its own workflows.
NADA's count covers franchised dealers only. Independent used-car lots are a different segment, and no source read here sizes them, so this page does not either.
The gatekeepers: who controls dealer data
The Seventh Circuit's 2017 opinion in Authenticom v. CDK Global described CDK as holding over 40% of the market and Reynolds around 30%, with DealerTrack at about 17%. Those are 2017 figures from a court opinion, not current shares, and no current share figure was found. The Cox Automotive Dealertrack DMS is still in the market, but no current dealer count was found; its latest item read here is a Spyne integration announcement dated October 22, 2026.
Tekion is the challenger. WardsAuto reported on July 31, 2026 that Asbury Automotive is moving 158 dealerships from CDK to Tekion, 70% complete, with the rollout targeted to finish around October 2026. Tekion itself reports "over 60% ARC revenue growth in 2025" in its February 5, 2026 release, which is a vendor-stated figure; it gave no dealership count there.
The data gate: certification programs and what is disclosed
Third-party access is the central go-to-market constraint. The 2017 opinion recounts that Authenticom pulled data by "scraping" the DMS with log-in credentials that dealers supplied, that CDK's system allowed this until 2015 and that Reynolds's licenses prohibited it. It also describes a 2015 Data Exchange Agreement under which CDK agreed to help clients move to Reynolds's in-house integrator, the Reynolds Certified Interface (RCI), and both companies agreed not to help others access the other's system without permission.
Today the sanctioned route at CDK is the API program. CDK's API Licensing Terms require the developer to "complete Certification, at its own cost, prior to consumption of any API," to obtain an executed Enrollment Agreement from each joint client before using the APIs with that client, and to get consent from each data owner. Fees are due within thirty days of invoice, CDK may change them with at least 60 days notice, and the amounts sit in the Order, not on the page. Recertification is limited to once per calendar year per app.
For Reynolds, the only program description read is a February 7, 2011 release saying RCI "provides a standardized approach to handling dealership data." Reynolds's current program page returned an access error, so requirements and fees are not stated here. Plan for the integration step to be a gating item with unpublished pricing, and ask each DMS for terms in writing before you commit to a launch date.
Pricing, antitrust history and what integrators have paid
Integration pricing has been contested in court. In the 2017 opinion, the plaintiff's account is that Dominion Dealer Solutions paid Authenticom and another company $30 to $35 per month per dealer in 2011, while Reynolds charged $247 for similar services, which had risen to $893; AutoLoop paid CDK $160 per month before the 2015 agreement and $735 per month after. These are allegations recited by the court, not findings, and not a price list.
The litigation continued as MDL No. 2817 in the Northern District of Illinois. A dealership class settlement, per MOTOR, has CDK paying $100 million plus up to $250,000 for notice costs, covering dealerships that bought a Reynolds or CDK DMS from September 1, 2013 through August 15, 2024; a prior $29.5 million Reynolds settlement was finalized in 2019, and the settlement carries no admission of wrongdoing. The settlement site states the CDK settlement was approved on February 25, 2025. For a vendor, the practical point is that DMS-side integration fees have been a legal flashpoint, so document what you are charged and why.
Security is part of the sale: the FTC Safeguards Rule
The FTC's dealer FAQ, dated June 2025, says the Safeguards Rule "includes most automobile dealers who finance or lease automobiles," with leases over 90 days covered. Dealers must notify the FTC no later than 30 days after discovering a breach of unencrypted information on at least 500 consumers, a requirement in effect since May 2024, and must choose service providers that can maintain safeguards, require those safeguards by contract and assess providers periodically.
That makes you a service provider in your buyer's compliance file. The FAQ does not mention DMS vendors specifically, so how it applies to a given integration is a question for the dealer's counsel. The FTC's December 2024 guide adds that institutions holding information on fewer than five thousand consumers are exempt from certain provisions, which can matter for the smallest stores.
Why resilience now sells: the June 2024 CDK outage
Cybersecurity Dive reported on June 27, 2024 that CDK discovered the attack on June 19, that it serves more than 15,000 car dealer customers and that five major dealer groups (Sonic, Penske, AutoNation, Group 1 and Lithia) filed SEC cyber incident disclosures. TechCrunch reported that CDK confirmed a second incident and another shutdown of "most of our systems." CDK declined to answer questions about the nature of the attack.
The Anderson Economic Group estimated direct dealer losses of $1,020 million and about 56,200 lost new-vehicle sales across the three weeks that included June 19 through July 5. It is a modeled figure: direct losses only, with its own caveat that "actual damages will vary widely among dealers." The consequence shows in Asbury's switch: the company cited the 2024 outage and reported $1.2 million in Q2 pretax expenses for running two DMS platforms at once, plus a "break-in period of up to about six months." For you, the message is to publish uptime, backup and incident-response facts that a dealer can verify, and to avoid single-point dependence where you can.
Who buys, and where you reach them
No source read quantifies which dealership role signs for software, so this page does not rank them. NADA's 20 Group program is a useful map, because it organizes managers by function: it lists 15 group types, including Dealer / General Manager, Fixed Operations, Controller / Office Manager, Digital Marketing, Dealer Auto Group and Used Vehicle Manager. Noncompeting dealers meet three times per year, and NADA says its members are on average more profitable than non-members, which is NADA's own claim.
Cost to participate is published: Traditional membership is $480 per month per rooftop, Financial Composite Only is $245 per month and Analytics & Financial Composite is $335 per month. Whether vendors can present to groups depends on NADA's rules, which were not read, so confirm before planning it as a channel.
The big annual stage is the NADA Show. A third-party listing gives February 17-20, 2027 at the Orange County Convention Center in Orlando; NADA's own page read did not state the dates, so confirm before booking. Tekion used the 2026 show for its main product announcements, per its release, which shows how vendors use it.
Dealer groups are a distinct motion. The five groups that filed SEC disclosures after the outage, and Asbury with 158 dealerships, buy centrally and on longer horizons than single stores. No source read gives sales-cycle length or contract values for either, so none is stated.
A practical sequence (our reading of the sources)
- Pick the DMS first. Choose the system your first buyers run, since integration is gated by certification at CDK and by RCI at Reynolds, and the rest of the stack depends on that choice.
- Get terms in writing. CDK fee amounts and Reynolds RCI terms are unpublished in the sources read; confirm costs and timelines before promising launch dates.
- Lead with security evidence. Dealers face a 30-day FTC notice rule and must contract with and assess service providers, so ship a security packet with the first demo.
- Sell through peers. Use NADA 20 Group-style functional communities and the NADA Show to reach controllers, fixed operations and general managers.
- Plan for DMS switching. Asbury shows migrations are happening, at real cost; support more than one DMS so a customer switch is not a lost account.
Questions people ask
How many car dealerships are there in the U.S.?
NADA's 2026 mid-year report counts 16,991 franchised light-vehicle dealers. Independent dealers are not included in that figure.
Who owns dealer management system share?
A 2017 Seventh Circuit opinion described CDK at over 40% and Reynolds around 30%, with DealerTrack about 17%. No current share figure was found, so those are historical.
What does it cost to integrate with CDK?
CDK's API terms say certification is at the developer's own cost and fees are payable within thirty days of invoice, but the fee amounts are in the Order and are not published.
Does the FTC Safeguards Rule apply to car dealers?
The FTC's June 2025 FAQ says it includes most automobile dealers who finance or lease automobiles, with breach notice to the FTC within 30 days for events affecting at least 500 consumers.
How much did the 2024 CDK outage cost dealers?
Anderson Economic Group estimated direct dealer losses of about $1.02 billion and roughly 56,200 lost new-vehicle sales, a modeled estimate that excludes several loss categories.
Sources
- Seventh Circuit: Authenticom v. CDK Global (November 6, 2017) · Market share description, 2015 agreement, scraping, integration prices as alleged
- MOTOR: dealership class counsel settle with CDK for $100 million (September 24, 2024) · Settlement amount, class period, Reynolds settlement
- DMS Antitrust Settlement site · Final approval dates
- CDK API Licensing Terms · Certification at developer cost, enrollment agreements, fee terms
- Reynolds release on the Reynolds Certified Interface program (February 7, 2011) · Description of the RCI program
- FTC: Automobile Dealers and the Safeguards Rule FAQ (June 2025) · Coverage, breach notice, service provider duties
- FTC: Safeguards Rule guide (December 2024) · Exemption for fewer than five thousand consumers
- Cybersecurity Dive: CDK restores service for small group of car dealers (June 27, 2024) · Outage dates, dealer counts, SEC disclosures
- TechCrunch: CDK Global cyberattacks (June 20, 2024) · Second incident, 15,000 dealerships
- Anderson Economic Group: dealer losses from the CDK cyberattack (July 2024) · Loss estimate and caveats
- WardsAuto: Asbury DMS switch (July 31, 2026) · CDK to Tekion migration facts
- NADA Data 2026 mid-year report · Dealer count and sales figures
- NADA 20 Group · Group types, meeting cadence, published fees
- NADA Show 2027 listing · Show dates and venue (third party)
- Tekion release (February 5, 2026) · Vendor-stated revenue growth, NADA 2026 announcements
- Spyne announcement on Dealertrack DMS integration · Dealertrack DMS integration date
- Wikimedia Commons: A Hyundai auto dealership in Burlington, Vermont · Source of the page photo (CC BY 4.0, Harrison Keely)
Facts were read from the linked pages on November 2, 2026. Vendor claims are labeled vendor-stated, allegations are labeled as allegations, and anything a source did not disclose is said to be undisclosed rather than estimated. If a page here is out of date, tell us and we will correct it from a source.
Top photo: Harrison Keely / CC BY 4.0 via Wikimedia Commons