A new US lawsuit raises fresh questions about tracking on Toyota’s website

Toyota Motor North America faces a suit

You click “decline” on a cookie banner and expect the tracking to stop. A proposed lawsuit alleges that Toyota Motor North America allowed tracking tools on Toyota.com to continue operating even after a visitor selected a rejection option on the site’s consent banner.

The complaint alleges that outside parties received browsing and device-related information without valid consent. Toyota had not publicly answered the claims when they were first reported. The allegations remain unproven, and a court has not decided whether Toyota violated California law.

Toyota Motor North America is accused

The complaint says Toyota Motor North America presented visitors with choices to accept or decline cookies and similar tracking technologies. Conner claims she selected the rejection option, but the tracking code was still placed or activated on her device.

According to the lawsuit, third parties could then collect online identifiers, browsing activity, device details, and information useful for targeted advertising. These are the plaintiff’s claims, not facts. Toyota may challenge whether the tools operated as described, whether consent existed, and whether the collected information qualifies for legal protection.

Toyota Motor North America faces scrutiny

The complaint also describes the alleged tracking method as digital fingerprinting. Unlike a regular cookie, fingerprinting can combine multiple device and browser details to recognize a visitor or make them easier to distinguish.

Possible signals include screen size, browser settings, operating system, language, time zone, and installed features. Each detail may appear ordinary on its own, but the combined pattern can be unusually specific. The lawsuit says this identification continued after Conner rejected tracking.

A cookie choice should mean something

Cookie banners are meant to explain website data practices and collect a visitor’s preferences. Some cookies keep a site working, while others support analytics, advertising, personalization, or tracking across different websites and services.

The Toyota lawsuit focuses on what allegedly happened after a visitor chose “decline.” A banner alone may not protect a company when tracking scripts ignore or misread that choice. Privacy specialists say businesses must test whether every tag, vendor, and advertising tool actually follows the signal sent by the banner.

The case relies on a 1967 law

The complaint invokes the California Invasion of Privacy Act, commonly called CIPA. State lawmakers passed CIPA in 1967 to address wiretapping, eavesdropping, and devices used to record information about communications.

Nearly six decades later, plaintiffs are applying its wording to cookies, advertising pixels, chat tools, session replay software, and other website technologies. Courts have not always agreed on how the old law fits modern internet systems. That uncertainty has led to more lawsuits while making the outcomes of individual cases difficult to predict.

A consent banner is not enough

Businesses often install consent-management software to record whether visitors accepted or rejected optional tracking. Yet a visible banner can fail if advertising tags load too early, vendors receive the wrong signal, or privacy choices do not reach every system.

Privacy compliance company OneTrust says recent lawsuits increasingly examine how websites behave in practice, rather than just what their privacy notices say. That means companies must test data flows before and after a visitor opts out. A polished banner cannot fix tracking code that continues sending information behind the scenes.

More than 800 claims arrived in 2025

Toyota’s case is part of a broader wave of privacy litigation. Privacy compliance company OneTrust reported that more than 800 CIPA claims were filed during 2025, many involving tracking tools that plaintiffs compared to pen registers or trap-and-trace devices.

Those filings reached retailers, publishers, sports organizations, health companies, and other businesses with public websites. A large number of complaints does not mean every claim will succeed. Judges have dismissed some cases while allowing others to continue, creating a legal landscape that remains unsettled and expensive.

Little-known fact: A pen register traditionally records dialing or routing information rather than the actual content of a conversation.

California offers separate privacy rights

CIPA is not California’s only privacy law. The California Consumer Privacy Act gives eligible residents rights involving access, deletion, correction, and the sale or sharing of personal information, subject to legal exceptions.

Businesses covered by the law must provide ways for consumers to exercise those rights. They must also respect qualifying opt-out preference signals, such as Global Privacy Control, where the law applies, and the business is required to treat that signal as a do-not-sell-or-share request.

The Toyota complaint, however, focuses on CIPA claims tied to alleged tracking after rejection. Different privacy laws can overlap, but their legal standards and available remedies are not identical.

Device details can become identifiers

Many websites collect technical information needed for security, fraud prevention, page display, or basic performance. Trouble can arise when those same details are combined, stored, or shared for advertising and long-term identification without proper notice or consent.

A device fingerprint does not always reveal someone’s name. Still, it may help distinguish one browser from millions of others and connect repeated visits. Privacy lawsuits often debate whether that information identifies a person, counts as communication data, reaches a third party, or was collected with the visitor’s permission.

Toyota publishes its privacy practices

Toyota’s U.S. privacy notice explains that it may collect identifiers, internet activity, device information, preferences, and other personal data. It also describes advertising, analytics, legal, security, and business purposes for processing information.

Publishing a privacy notice does not decide the lawsuit. The key dispute is whether Toyota’s website followed the choice allegedly made through its consent banner. Courts may examine the banner’s wording, technical records, tracking requests, vendor roles, and what information was transmitted. Toyota can also dispute the plaintiff’s testing, interpretation, and legal claims.

Fun fact: Toyota’s U.S. privacy notice has separate sections explaining rights that vary by a consumer’s state of residence.

A lawsuit is not a final finding

The case was filed as a proposed class action, meaning Conner seeks to represent other visitors who allegedly experienced similar tracking. The court must decide whether the legal requirements for a class action are met before the case can proceed as a class action.

Toyota can seek dismissal, challenge class certification, dispute the technical evidence, negotiate a settlement, or defend the case through trial. Previous website privacy cases have produced mixed rulings, especially on consent and whether common questions apply equally to all visitors. A complaint represents one side’s allegations.

Website operators face a technical test

The Toyota dispute sends a warning to companies far beyond the auto industry. Businesses should know which tracking tools are running on their websites, which third parties receive data, and whether any optional scripts remain blocked until proper consent is recorded.

Regular audits can reveal tags that fire unexpectedly or return after a site update. Companies may also need to coordinate marketing, legal, security, and technology teams rather than leaving cookie compliance to a single department. Clear notices matter, but the website’s actual behavior is what visitors and courts can test.

For another California accountability update tied to climate rules, business costs, and legal scrutiny, see why the state’s pollution credit system is facing a major lawsuit.

Visitors can check their privacy choices

Consumers can review a website’s privacy notice, reject optional cookies, use browser controls, clear stored data, or enable Global Privacy Control where supported. These steps may reduce some tracking, but they cannot guarantee that every company or outside vendor behaves correctly.

The Toyota lawsuit will test allegations that a clear rejection was not honored. Its outcome could offer another clue about how older wiretap rules apply to modern advertising systems.

For another California climate update tied to clean-air rules, state authority, and federal pushback, see why the EPA fight is heading to court.

Do website visitors deserve stronger control when they reject online tracking? Share your thoughts and drop a comment.

This slideshow was made with AI assistance and human editing.

Read More From This Brand:

• California’s clean vehicle waiver fight is moving into a broader legal battle
• The push for blackout license plates advances in Ohio’s vehicle policy debate
• Trump’s rollback of California electric vehicle rules sets off a sweeping legal and policy showdown