Clicking “decline” on a cookie banner feels like closing a door. A new class action filed against Toyota argues that door never actually shut.
Deal Alert: Nowell Leather’s Hand-Stitched Wallets and EDC Gear Are Built Like a Well-Kept Ride
On July 15, lead plaintiff Brittany Conner filed a proposed class action against Toyota Motor Corporation in Los Angeles County Superior Court, accusing the automaker of continuing to identify and monitor visitors to Toyota.com even after they rejected tracking through the site’s own cookie consent banner. Conner is represented by Scott Ferrell and Victoria Knowles of Pacific Trial Attorneys, a Newport Beach firm that has built a specialty around website-tracking litigation.
According to the complaint, Toyota’s site uses a technique commonly called “fingerprinting” to piece together enough device and browsing details to identify an otherwise anonymous visitor, then hands that profile off to advertisers for cross-device targeting, so an ad based on your desktop browsing shows up later on your phone. Conner’s attorneys frame it as an “outrageous privacy ‘bait and switch’ scheme,” arguing the decline button gave users a false sense of control.
Cookies You Can Delete, Fingerprints You Can’t
The engineering distinction matters here. A cookie is a small file stored on your device that you can inspect, block, or delete, which is why regulators built consent banners around it in the first place. A fingerprint doesn’t need a stored file at all. It’s assembled from characteristics like your screen resolution, installed fonts, browser version, device type, and other configuration data that, combined, create a profile specific enough to re-identify you across visits and devices. Rejecting cookies does nothing to stop that kind of collection if it’s already running in background scripts on the page, which is exactly the theory Conner’s complaint is built on.
A 1967 Wiretap Law Finds a Second Life
The lawsuit isn’t built on a modern data-privacy statute. It leans on the California Invasion of Privacy Act, a law passed in 1967 to deal with phone taps and hidden recording equipment, long before anyone was thinking about browser scripts. Over the past few years, plaintiffs’ firms have applied a “trap and trace” theory under that same law to website tracking tools, treating an ad-tech script the same way the statute once treated an illegal wiretap. Privacy compliance firm OneTrust counted more than 800 of these CIPA claims filed in 2025 alone. Forbes Media settled a similar case for $10 million in May, the Los Angeles Times settled one for $3.85 million, and both DraftKings and the NFL have been sued under the same theory in recent months. Toyota isn’t being singled out so much as caught in a wave that’s hitting any company running sophisticated ad tech on a high-traffic site.
Why an Automaker’s Website Is a Juicy Target
Car shopping sites are dense with tracking infrastructure for a reason: a single vehicle purchase consideration can be worth tens of thousands of dollars in ad spend attribution, and manufacturers want to know exactly which configurator session, trim comparison, or dealer locator search eventually turned into a sale. That kind of granular, cross-device attribution is precisely what plaintiffs’ attorneys are targeting in this new category of lawsuit. It also lands at a moment when scrutiny of vehicle-related data collection is widening well beyond marketing pixels. Lawmakers are separately pushing to restrict connected-car technology over data concerns, which suggests the industry’s data practices, not just its hardware, are becoming a regulatory target.
What This Could Actually Cost Toyota
CIPA carries statutory damages of up to $5,000 per violation, and courts haven’t settled whether that applies per visitor, per session, or per some other unit, which is exactly the ambiguity that makes these cases so expensive to defend and so attractive to settle. Multiply any per-violation figure by a manufacturer site pulling in millions of monthly visitors, and the math explains why Forbes and the LA Times wrote checks rather than litigate to a verdict. None of that means Toyota is liable. The complaint is an allegation, not a finding, and neither Toyota nor its outside counsel has responded publicly. But the settlement pattern in comparable cases gives a reasonable sense of where this kind of dispute tends to land.
What Car Shoppers Can Do in the Meantime
If you’re researching a new Camry or Tacoma online, treat the cookie banner as a suggestion rather than a guarantee. Browser-level tools do more heavy lifting than a single click ever will: enabling a Global Privacy Control signal, which California law recognizes as a valid opt-out regardless of what a site’s own banner says, running a tracker-blocking extension, or simply doing configurator research in a private browsing window all limit what fingerprinting scripts have to work with. It won’t make you invisible, but it raises the cost of identifying you, which is really all privacy tools ever promise.
It’s been a mixed year for Toyota headlines that have nothing to do with horsepower. The brand has flagged paint and panel-fit warnings on its own US-built trucks while simultaneously pushing forward with ambitious projects like its hydrogen fuel cell Dakar Hilux program. A website tracking lawsuit doesn’t threaten factory quality control or a Dakar program, but it does threaten the increasingly fragile idea that clicking “decline” means what it says. That fight is just getting started, for Toyota and for whoever OneTrust counts next.
About the Author
