Toyota is now under the spotlight for a privacy fight that could hit a lot harder than a simple website complaint. A class action filed in Los Angeles County Superior Court says the company used “trap and trace” tactics on its website to collect personal information after visitors had already said no, then turned around and used that data for marketing and advertising.
At the center of the case is Brittany Conner, who says she declined tracking cookies on Toyota’s site but still had tracking technology installed on her device anyway. The lawsuit claims Toyota gathered details about her online behavior without consent, then used that information to push ads and marketing tied to her browsing activity and interests.
The complaint paints this as more than a technical glitch. It argues Toyota crossed a line by quietly following what people did online after they had clearly chosen not to be tracked, which is exactly the kind of thing privacy laws are supposed to stop.
This is not Toyota’s first trip into this kind of mess either. In January 2026, another lawsuit claimed the automaker sold driving data to insurance companies, adding to the growing pressure on the company over how it handles customer information.
What makes this case stand out is how common these disputes have become. Websites are getting hauled into court more often over data collection tools that many users never notice, even though those tools can sit quietly in the background and gather a lot more than people expect.
More than 800 claims were filed under the California Invasion of Privacy Act in 2025, and that number tells the story pretty plainly. The law’s “trap and trace” section was written decades ago to deal with old-school surveillance, but it has been pulled into the modern world of website tracking as lawyers argue that digital tools can do the same kind of hidden collecting.
The law itself says it is illegal to install a trap-and-trace device that captures information without someone’s knowledge unless a court order is in place first. Back when the statute was written in 1967, the focus was on wiretaps and hidden recording gear, not cookies and pixels, but the same basic privacy fight is now playing out on screens instead of phone lines.
Companies across different industries have already learned that this issue can get expensive fast. Google agreed to pay more than $425 million in 2025 after allegations that it collected phone data even when users opted out, and that case covered 98 million accounts.
Even people who never touched Google-branded devices or apps said they were still being tracked through Google software. That kind of reach is exactly why these lawsuits keep landing with a thud, because consumers do not expect their choices to be ignored in the background while companies quietly build profiles around them.
The Los Angeles Times also paid $3.85 million in March 2026 after being accused of tracking users without telling them, reportedly through three website trackers. Then Forbes agreed to a $10 million settlement in May 2026 after claims that it tracked, collected, and sold private data from visitors across its network of websites without permission.
That growing list of cases shows why companies are under such intense scrutiny right now. People may tolerate a little personalization, but they are far less forgiving when a site keeps watching after a decline button has already been clicked.
For Toyota, the lawsuit opens a fresh front in a broader battle over how much data car companies should be allowed to gather and what they can do with it once they have it. As more drivers and shoppers start paying attention to the fine print, the gap between what companies say they do and what users believe is happening is getting harder to hide.
