New Lawsuit Claims Toyota Illegally Tracked Customers Using Spyware

Most are familiar by now with the consent authorization tools that websites use. When you first visit a new site, you're usually asked whether you want to allow tracking and what kinds, effectively making it so you can turn off all non-essential data collection. The easy assumption to make is that these sites note your choice and respect that. But a new lawsuit alleges that Toyota's website ignores whether you choose "accept" or "decline," and instead uses tracking cookies. Worse yet, the suit says, the cookies allow third parties to "de-anonymize and track users' online activities," including browsing history, website interactions, user input data, demographic information, shopping behaviors, device details, and much more.

The lead plaintiff for the suit, Brittany Conner, says that she "elected to reject all third-party cookies" across several visits to the Toyota website. To repeat for effect, she rejected tracking multiple times over the course of multiple visits, which should have been the end of things. Despite that, the suit claims Toyota "secretly installed tracking technology on [the] plaintiff's device," which allowed third parties to surveil her activities while online. This practice is nothing new, of course, and it's not exclusive to Toyota. It's referred to as "digital fingerprinting" and it happens across many apps, websites, and services available on the internet.

The Toyota suit is a proposed class action, but as it's more recent, details like how and when you can join aren't currently available. Conner is being represented by Scott Ferrell and Victoria Knowles of Pacific Trial Attorneys in California.

There are official and unofficial uses of spyware surveillance tools to track people, and both have been spotted in the wild. New spyware for Android and iOS can track everything you do, for example — once devices are infected, it begins gathering everything it can about you and your habits. Bad actors use that data for nefarious activities like identity theft or live surveillance.

The Toyota allegations are the latest example of such claims, yet many companies and third parties use similar tools to collect your data, with or without consent. In the past, big companies like Target, Amazon, and Google have all been hit for collecting user data without consent in various ways. Unfortunately, there is no comprehensive data collection or privacy law in the United States which protects everyone, but there are individual laws depending on federal and state policies. California's Invasion of Privacy Act (CIPA) is one that deals with this sort of thing — it's a 1960s era law that bans wiretaps and hidden recording. Many plaintiffs are using the law to file suits against companies for illegal tracking under the "trap-and-trace" clause. OneTrust, a company dedicated to helping businesses navigate privacy laws, says that over 800 such CIPA claims were filed in 2025. ForbesMedia, The Los Angeles Times, and DraftKings are all companies affected or hit by website tracking lawsuits.

Beyond websites, there are quite a few everyday apps that track your activity, namely Facebook, Instagram, LinkedIn, Amazon, many of Google's services, and so on. You do have granular control over some of them. You can stop Instagram from using tracking data to sell or recommend stuff, which is always a good idea.

The current Toyota suit and similar cases raise concerns that companies may ignore your choices regarding tracking and data collection. There's not much you can do about that in the short term, though filing a suit is always a possibility. However, if you're looking to minimize some of that data collection right here and now, there are some steps you can take. Most involve following basic cybersecurity practices — strategies that would otherwise protect you and your data even outside of tracking.

For starters, only download software from official sources, like Google Play on Android or the App Store on your Mac. But remember that in some rare cases, these sources can also be affected, which means you'll want tools to help find potentially infected software — thankfully, there are guides to help you find and remove spyware from Android or even Windows. Reliable malware and spyware tools include Bitdefender Antivirus Plus, Webroot Essentials, and ESET Home Security. They often have desktop and mobile apps you can install across devices, so run scans regularly and keep your devices as clean as possible.

Beyond that, you may want to use anti-tracking browsers like Tor, private search engines like DuckDuckGo, and browse from behind a VPN. You could also create multiple accounts or profiles and swap between them for different browsing sessions so that your user data is fragmented. There's no single, comprehensive action that can protect you, but combining these strategies can certainly cut down on tracking happening behind the scenes.