'Trap And Trace' Lawsuit Claims Toyota Illegally Tracked Customers

Toyota is the latest automaker accused of invading drivers' privacy — and then selling personal information. The popular Japanese carmaker is facing a class action lawsuit filed in Los Angeles County Superior Court over "trap and trace" claims, a kind of privacy breach that's becoming far more common. According to lead plaintiff Brittany Conner, Toyota is secretly tracking and selling personal information it gets on its official website, all without consent. 

When consumers head to Toyota's website, they will see a consent banner where they can choose to "accept" or "decline" tracking cookies. Conner found that Toyota installed tracking technology on her device without her knowledge — despite her declining — allowing the company to collect her online activity and then send her marketing and advertising it believes are related to her interests and the websites she visited. This isn't the first time that Toyota has been sued for collecting and selling driver data: In January 2026, a man claimed Toyota sold his driving data to insurance companies.

Website tracking has become a hot legal topic as of late, with more than 800 claims filed under the California Invasion of Privacy Act (CIPA) in 2025. This law includes a section on "trap and trace" tactics, stating that it's illegal to install a trap-and-trace device — which captures information without someone's knowledge — without first obtaining a court order. This originally referred to wiretaps and hidden recording equipment when it was written in 1967, but it's since been used for website tracking in recent years. And it has worked. 

In 2025, Google had to pay over $425 million for collecting users' phone data despite them opting out of the tracking. This lawsuit included 98 million Google accounts. But even those who didn't use Google-branded apps or devices found they were getting tracked by Google's software. In March 2026, the Los Angeles Times paid $3.85 million after violating California's privacy laws by tracking users' data without their knowledge. The lawsuit claimed the media outlet was using three website trackers. Forbes followed in May 2026, agreeing to a $10 million settlement after being accused of tracking, collecting, and selling private data from people who visited any websites owned by Forbes — without consent, of course.