New Lawsuit Claims Toyota Illegally Tracked Customers Using Spyware

Most are now familiar with the consent authorization tools used by websites. When you visit a new site for the first time, you will typically be asked whether and what types of tracking you want to allow, allowing you to opt out of any non-essential data collection. The simplest assumption to make is that these sites note your choice and respect it. But a new lawsuit alleges that Toyota’s website ignores whether you choose “accept” or “decline” and uses tracking cookies instead. Worse, according to the suit, cookies allow third parties to “de-anonymize and track users’ online activities,” including browsing history, website interactions, user-entered data, demographic information, purchasing behaviors, device details and much more.

The lawsuit’s lead plaintiff, Brittany Conner, said she “chose to reject all third-party cookies” during multiple visits to Toyota’s website. To reiterate, she repeatedly rejected follow-up over multiple visits, which should have been the end of things. Despite this, the suit claims that Toyota “secretly installed tracking technology on the plaintiff’s device,” which allowed third parties to monitor her online activities. Of course, this practice is not new and is not exclusive to Toyota. This is called “digital fingerprinting” and it occurs in many applications, websites and services available on the Internet.

The Toyota lawsuit is a proposed class action, but because it is newer, details such as how and when you can join are not currently available. Conner is represented by Scott Ferrell and Victoria Knowles of Pacific Trial Attorneys in California.

There are official and unofficial uses of spyware monitoring tools to track people, and both have been spotted in the wild. New spyware for Android and iOS can, for example, track everything you do: once devices are infected, they begin to gather everything they can about you and your habits. Bad actors use this data for nefarious activities like identity theft or live surveillance.

The Toyota allegations are the latest example. Yet many companies and third parties use similar tools to collect your data, with or without consent. In the past, major companies like Target, Amazon, and Google have all been criticized for collecting user data without consent in various ways. Unfortunately, there is no comprehensive data collection or privacy law in the United States that protects everyone, but there are individual laws that depend on federal and state policies. California’s Invasion of Privacy Act (CIPA) deals with this sort of thing: it’s a law dating back to the 1960s that prohibits wiretapping and covert recordings. Many plaintiffs use the law to sue companies for illegal tracking under the “trap and trace” clause. OneTrust, a company dedicated to helping businesses navigate privacy laws, says more than 800 such CIPA claims have been filed in 2025. ForbesMedia, The Los Angeles Times and DraftKings are all companies affected or hit by lawsuits over website tracking.

Beyond websites, there are many everyday apps that track your activity, including Facebook, Instagram, LinkedIn, Amazon, many Google services, and more. You have granular control over some of them. You can prevent Instagram from using tracking data to sell or recommend products, which is always a good idea.

Toyota’s current lawsuit and similar cases raise concerns that companies might ignore your choices around tracking and data collection. There’s not much you can do in the short term, although filing a lawsuit is always a possibility. However, if you want to minimize some of this data collection here and now, there are steps you can take. Most involve following basic cybersecurity practices – strategies that would otherwise protect you and your data, even outside of tracking.

To start, only download software from official sources, like Google Play on Android or the App Store on your Mac. But remember that in rare cases these sources may also be affected, which means you’ll need tools to help you find potentially infected software. Fortunately, there are guides to help you find and remove spyware from Android or even Windows. Reliable anti-malware and spyware tools include Bitdefender Antivirus Plus, Webroot Essentials, and ESET Home Security. They often offer desktop and mobile apps that you can install on all devices, so run scans regularly and keep your devices as clean as possible.

Beyond that, you may want to use anti-tracking browsers like Tor, private search engines like DuckDuckGo, and browse behind a VPN. You can also create multiple accounts or profiles and swap between them for different browsing sessions so that your user data is fragmented. No single, blanket measure can protect you, but combining these strategies can certainly reduce behind-the-scenes monitoring.