Conner v. Toyota Motor Corporation
A CIPA class action claims Toyota.com kept tracking visitors — through fingerprinting — even after they clicked "Decline" on the cookie banner. It's the clearest test yet of a simple promise: that saying no actually stops the tracking. Here's the theory, why fingerprinting makes the "decline" button so dangerous, and what the case signals for every site running a consent banner.
What the case is about
Clicking "Decline" on a cookie banner feels like closing a door. In a proposed class action filed July 15, 2026 in Los Angeles County Superior Court, lead plaintiff Brittany Conner argues that on Toyota.com, the door never actually shut.[1] According to the complaint, Toyota's website greets visitors with the now-familiar consent banner — cookies notice, two buttons, "Accept" and "Decline" — and Conner says she visited several times over the years and "elected to reject all third-party cookies" every time. The company, she alleges, "nonetheless secretly installed tracking technology on plaintiff's device" and caused her to be "tracked and surveilled while using the internet."[1]
The complaint frames this as an "outrageous privacy 'bait and switch' scheme": a site that offers the appearance of a choice, then allegedly tracks the people who chose "no" anyway. The mechanism Conner points to is not ordinary cookies — it's fingerprinting, which she describes in the complaint as "spyware" that "collects as much data as it can about an otherwise anonymous visitor to the website and matches it with existing data acquired… about hundreds of millions of Americans to identify the user and tailor marketing and advertising."[1]
None of this has been decided. The case was just filed, Toyota has not answered, and the allegations are allegations. But the theory is what makes this one worth understanding — because it targets the exact thing a consent banner is supposed to guarantee.
Why "Decline" allegedly did nothing
The heart of the complaint is a technical distinction most consent banners quietly ignore. A cookie is a small file stored on your device — you can inspect it, block it, or delete it, which is exactly why regulators built consent banners around cookies in the first place. Decline the cookies, and the file isn't set. A fingerprint needs no stored file at all.
Fingerprinting identifies a visitor by reading signals the browser naturally exposes — device model, operating system, screen resolution, installed fonts, browser version, language settings, and behavioral quirks — and combining them into a profile distinctive enough to recognize the same person across visits and even across devices.[2] Because those signals are emitted by the browser just by loading the page, declining cookies does nothing to stop fingerprinting if the script collecting them is already running. That's the gap the complaint drives at: the banner governs cookies, but the alleged tracking didn't need cookies.
Fingerprinting is a technique that identifies and re-identifies a visitor by combining the many small configuration and behavioral signals a browser exposes — screen size, fonts, device and OS details, and more — into a stable, unique-enough profile. Unlike a cookie, it stores nothing on the device, so cookie controls and "decline" choices generally don't prevent it. That's what makes it both powerful for advertisers and legally fraught when a site has told the visitor they can opt out.
If the allegations are accurate, the result is a consent banner that manages one kind of tracking (cookies) while a second kind (fingerprinting) allegedly continues underneath it — collecting browsing history, device information, online identifiers, and geolocation, and sharing them with third parties for cross-device advertising.[1] To the plaintiff, that isn't a technicality; it's the "bait and switch."
The legal theory — CIPA's trap-and-trace provision
Like most of the 2026 website-tracking wave, the case doesn't rest on a modern data-privacy statute. It leans on the California Invasion of Privacy Act (CIPA) — specifically its "pen register / trap and trace" provision in Penal Code §638.51 — a 1967 wiretapping law written for telephone surveillance and repurposed for the web.[3]
The statute bars installing or using a "pen register or trap and trace device" — a device or process that captures the routing, addressing, or signaling information identifying the source of a communication — without a court order. Plaintiffs argue that tracking scripts which capture a visitor's device and network signals are the digital equivalent, and that each such capture is a violation. CIPA carries statutory damages commonly cited at $5,000 per violation under Penal Code §637.2.
The trap-and-trace theory is attractive to plaintiffs for a reason worth understanding. Unlike CIPA's §631 wiretapping theory — which requires showing a third party intercepted the contents of a communication in real time — the trap-and-trace theory only requires capture of routing and identifying data, a much lower bar that ordinary tracking scripts appear to clear.[3] Pair that with statutory damages and a site with millions of monthly visitors, and the math is what drives settlements: courts haven't settled whether $5,000 applies per visitor, per session, or per some other unit, and that ambiguity makes these cases expensive to defend and attractive to resolve.[2]
Where it stands (as of August 2026)
The case is newly filed and pending. It was lodged July 15, 2026 in Los Angeles County Superior Court by Pacific Trial Attorneys — Scott Ferrell and Victoria Knowles of Newport Beach, a firm behind many recent website-tracking suits.[1] Toyota had not responded publicly at the time of writing, and there has been no ruling on the merits. The specific docket number, the exact Toyota entity named, and the precise CIPA counts asserted were not yet confirmed in the public record at publication; most coverage names the defendant as Toyota Motor Corporation.[4]
The "decline button" wave of 2026
Conner isn't isolated — it's part of a distinct 2026 pattern in which plaintiffs allege that a site's opt-out did nothing. Reading the recent filings and settlements together shows how fast this specific theory is moving:
| Case / party | What's alleged or resolved | Status |
|---|---|---|
| Conner v. Toyota (this case) | Fingerprinting continued after visitors clicked "Decline"; cross-device ad tracking. | Filed Jul 2026 |
| Kimmons v. NFL Enterprises | 182 third-party trackers, session recording and canvas fingerprinting alleged to run after opt-out. | Filed Jul 2026 |
| Forbes Media | Settled a "trap and trace" class action. | ~$10M (May 2026) |
| Los Angeles Times | Settled a similar website-tracking claim. | $3.85M |
According to privacy-compliance firm OneTrust, more than 800 CIPA website-tracking claims were filed in 2025 alone, and the pace has continued into 2026.[1] What's new in this sub-wave is the narrative: not "you tracked me without asking," but "you asked, I said no, and you tracked me anyway." That's a more visceral story for a jury — and a harder one for a defendant to wave away.
Why this case matters for website operators
For any business running a consent banner, Conner lands on a specific, uncomfortable question: when a visitor clicks "Decline," does your site actually stop the tracking — all of it, including the scripts that don't rely on cookies? Most teams assume the banner handles this. The complaint's whole premise is that assumption is often wrong.
Two things make this exposure easy to miss:
- Banners frequently govern cookies, not scripts. A consent tool that blocks or clears cookies on "decline" may leave fingerprinting and other cookieless scripts running, because those were never cookie-dependent in the first place.
- Tag managers add trackers behind the scenes. Marketing teams add pixels and scripts through a tag manager without the web or compliance team re-checking whether "decline" truly suppresses them. The banner says one thing; the page does another.
The result is a gap between what the interface promises and what the site does — exactly the gap this litigation targets. And it's the gap plaintiff firms can demonstrate cheaply, because the mismatch is observable from the outside: load the page, click "decline," and watch what still fires.
What this means for your site
The durable lesson from Conner isn't about Toyota; it's about the integrity of your opt-out. A consent banner only protects you if "Decline" is enforced at the level of what actually loads and transmits — not just which cookies are set. If your banner is a front-end formality while trackers keep firing underneath it, you have the precise configuration this case is built around.
The reliable posture is the same regardless of how CIPA case law swings:
- Enforce "decline" technically. Non-essential third-party trackers — cookie-based and cookieless — must not load or transmit when a visitor opts out, or before they choose at all.
- Verify what actually fires. Test the page from the visitor's side: after clicking "decline," confirm nothing non-essential is still sending data.
- Keep the evidence. A timestamped record that consent was honored is the artifact that answers a "bait and switch" allegation before it becomes a settlement.
That's exactly what ConsentPixel is built to do — block third-party trackers at the browser level until a visitor genuinely consents, honor the opt-out when they decline, and log each decision as evidence — so your "Decline" button means what it says. This is general information, not legal advice; for your specific exposure, consult qualified counsel.
And because the mismatch is observable from the outside, the cheapest first step is simply seeing what your own site does after "decline" — before a plaintiff firm does it for you.
Does your "Decline" button actually stop the tracking?
Scan your site free in about 10 seconds to see every third-party tracker that fires — including the ones still running after a visitor opts out, the exact gap this case is built on. It's the same scan a plaintiff firm would run.
Scan your site free →No account needed · then start a 14-day free trial, no credit card, from $8.99/mo
Frequently asked questions
What is Conner v. Toyota about?
Why doesn't clicking "Decline" stop fingerprinting?
What law does the case rely on?
Does this ruling mean Toyota broke the law?
How do I know if my own site has this problem?
Sources
- Courthouse News Service — "Toyota broadsided by website tracking class action" (Jul. 16, 2026). Quotes the complaint directly, including the "bait and switch" and fingerprinting allegations, plaintiff's counsel, and the OneTrust 800-claims-in-2025 figure.
- Yahoo Finance — "Toyota Sued Over Claims Its Website Kept Tracking Visitors Who Clicked 'Decline'". Explains the cookie-vs-fingerprint distinction and the statutory-damages math.
- Captain Compliance — "Toyota Faces CIPA Class Action Over Alleged Website Tracking Without Consent". Summarises the CIPA trap-and-trace theory and the fingerprinting allegations.
- OpenClassActions — "Toyota Website Tracking Class Action Over Rejected Cookies". Notes the filing date and that the docket number, exact Toyota entity, and specific CIPA counts were not yet confirmed at publication.
- Fox Business — "Toyota hit with lawsuit alleging it secretly tracked drivers after they rejected website tracking cookies". First-reported coverage of the filing.
Sources accessed and summarised August 2026. This case is newly filed; all statements from the complaint are allegations, and status is current as of the publication date and may change as litigation proceeds.
Disclaimer: This page is for general informational purposes only and is not legal advice. Conner v. Toyota is a newly filed complaint; all allegations described are unproven, and nothing here should be read as a finding that Toyota violated any law. Case details are drawn from the complaint as reported in the legal and news coverage listed above. The $5,000-per-violation figure reflects statutory damages under California Penal Code §637.2. Status is stated as of August 2026 and litigation can change. ConsentPixel — Privacy · Verified is not a law firm and does not provide legal counsel. For advice on your specific situation, consult a qualified privacy attorney.