VIA EMAIL AND CERTIFIED MAIL—RETURN RECEIPT REQUESTED
CarGurus, Inc.
Attn: General Counsel
1001 Boylston Street, 16th Floor
Boston, MA 02115
legalnotices@cargurus.com
Re: Notice of Dispute Concerning Violations of the California Invasion of Privacy Act
To Whom It May Concern:
I hereby provide notice of my individual dispute with CarGurus, Inc., together with its subsidiaries, affiliates, vendors, partners, agents, service providers, and related entities (collectively, “CarGurus”), arising from my use of CarGurus.com and CarGurus’s use of code or similar software processes to (a) collect or transmit non-content routing, addressing, signaling, or similar information, and (b) intercept, disclose, use, procure, assist, or facilitate third-party access to information associated with my electronic communications with CarGurus and activity on CarGurus.com, without my prior informed consent or legal authorization.
Nature and Basis of Dispute
I personally used CarGurus.com while I was physically located in {answer_2}. I used cargurus.com to {answer_4}, or engage in other transaction- or account-related activity. To the best of my recollection, I did so during approximately the past {answer_3} before this Notice.
Based on technical investigation of CarGurus.com, and unbeknownst to me at the time, CarGurus configured CarGurus.com to invoke, deploy, or cause the execution of TikTok-related code, including the _ttp cookie and related software processes (collectively, the “TikTok Tracking Tools”). When I accessed or interacted with CarGurus.com, CarGurus’s website code caused the TikTok Tracking Tools to load, execute, set or read identifiers, and transmit network requests from my browser or device. Those tools caused my browser or device to collect, record, capture, transmit, disclose, or make available to TikTok, ByteDance, and/or related third parties non-content routing, addressing, signaling, source-identifying, device-identifying, session-identifying, cookie-identifying, timestamp, IP address, user-agent, browser/device, PageView, and event-metadata information associated with my CarGurus.com communications and activity (the “Non-Content Tracking Data”). Separately, and in the alternative, some information captured, transmitted, disclosed, or made available through the TikTok Tracking Tools also included or revealed the contents, substance, or meaning of my communications and activity on CarGurus.com, including page URLs, referrers, search or ZIP-code parameters, vehicle-listing activity, click events, and “Get Prequalified” interactions, to the extent those data points reflected what I searched, viewed, selected, clicked, or communicated while using CarGurus.com (the “Content-Revealing Data”). I refer to the Non-Content Tracking Data and the Content-Revealing Data together as my “CarGurus Communications and Tracking Data.”
The TikTok Tracking Tools were not limited to a single page or isolated interaction. Technical testing showed that they loaded across multiple tested portions of CarGurus.com, including the homepage, a reload of the homepage, vehicle-category pages, vehicle-listing pages, and search-results pages.
This information matters because my activity on CarGurus.com reflected vehicle-shopping communications and intent, not random web traffic. It could reveal the vehicles or types of vehicles I searched for, viewed, compared, selected, or clicked; the ZIP codes or locations where I was shopping; the pages or listings I interacted with; the timing and sequence of my activity; and whether I engaged with financing-related features, including the “Get Prequalified” interaction. Combined with TikTok cookie identifiers, IP address information, user-agent/browser/device information, timestamps, URLs, referrers, and event data, this information could allow TikTok, ByteDance, or related third parties to recognize, distinguish, associate, profile, or retarget my browser, device, session, location, vehicle interests, and financing-interest signals.
To the extent CarGurus contends that its terms of use, privacy notice, cookie disclosures, banners, or other notices authorized this conduct, I dispute that. My ordinary use of CarGurus.com was not informed, prior, or specific consent for CarGurus to install, embed, deploy, configure, use, or cause the operation of the TikTok Tracking Tools on my browser or device as a pen register, trap-and-trace device, or similar software process. Nor was my ordinary use of CarGurus.com informed, prior, specific, or all-party consent for CarGurus to permit, assist, facilitate, or cause TikTok, ByteDance, or any related third-party vendor to receive, intercept, read, attempt to learn, disclose, use, or make available the contents, substance, or meaning of my communications with CarGurus.com.
As a result of CarGurus’s conduct, I lost control over information concerning me and was deprived of the ability to make an informed privacy choice. This supports claims under federal and state privacy, electronic-surveillance, and anti-wiretapping laws, including the California Invasion of Privacy Act, Penal Code §§ 638.51, 631(a), and 637.2. The same conduct also supports claims under applicable consumer-protection laws, including laws prohibiting unfair, unlawful, or deceptive acts or practices, as well as statutory and common-law privacy remedies available under applicable law.
Relief Sought
I seek a good-faith informal resolution of my individual dispute. My requested relief includes all statutory, actual, equitable, injunctive, declaratory, restitutionary, disgorgement, and other relief available under federal and state law.
For purposes of informal resolution, my good-faith calculation is at least $5,000 under California Penal Code § 637.2 for CarGurus’s violation of CIPA § 638.51, subject to supplementation based on records showing additional violations or separate actionable conduct. To the extent CarGurus’s conduct also violated CIPA § 631(a), including by causing, permitting, assisting, or facilitating TikTok, ByteDance, or related third parties in receiving, learning, using, or obtaining Content-Revealing Data, I seek all statutory damages available under § 637.2 for those violations as well. Because the precise number of violations depends on records in CarGurus’s, TikTok’s, ByteDance’s, and related vendors’ possession, I reserve the right to supplement this demand and damages calculation after those records are provided. I also seek disgorgement, restitution, or other monetary relief to the extent available; and appropriate injunctive and equitable relief requiring CarGurus to stop any unlawful interception, pen-register, trap-and-trace, TikTok pixel, cookie, or similar tracking practices as to me, and to delete and refrain from using, selling, sharing, disclosing, or retaining any unlawfully collected CarGurus Communications and Tracking Data associated with me, except to the extent preservation is required for this dispute or by law.
I ask that CarGurus preserve all records relevant to my claim and provide sufficient information for my counsel and me to evaluate an informal resolution. I authorize CarGurus to communicate with my counsel identified below regarding this dispute and to disclose to my counsel records and information concerning my account or associated with my use of CarGurus.com that are reasonably necessary to identify my relevant interactions, determine what tracking technologies were active during those interactions, evaluate what information was collected or transmitted, calculate relief, and discuss informal resolution.
Request for Informal / Pre-Arbitration Resolution
I am providing this Notice in good faith before initiating formal proceedings to afford CarGurus an opportunity to discuss an informal resolution of my dispute. If this dispute is not resolved informally within 60 days after this Notice is received, I intend to pursue my rights in any available forum and through any available procedure, including individual arbitration before the American Arbitration Association. (CarGurus, Inc., Terms and Conditions of Use (last updated Apr. 10, 2026), https://www.cargurus.com/about/terms-of-use.) In doing so, I expressly reserve all arguments and objections to the validity, enforceability, applicability, interpretation, effect, or satisfaction of any CarGurus arbitration, waiver, limitation, forum, governing-law, mass-arbitration, public-injunction, unilateral-modification, informal-resolution, condition-precedent, or dispute-resolution provision, including objections concerning formation, assent, notice, scope, delegation, unconscionability, waiver, fees, costs, limitations periods, venue, arbitral rules, public injunctive relief, representative relief, and consistency with applicable law. I also reject, and do not consent to, any unilateral modification of CarGurus’s terms, privacy policy, or any other purportedly applicable terms unless I affirmatively agree in a separate signed writing.
This Notice is not a complete statement of all facts, claims, legal theories, damages, remedies, defenses, responses, objections, or grounds. I reserve the right to amend, supplement, refine, or expand this Notice and my requested relief based on additional information, CarGurus’s records, vendor records, arbitration, litigation, discovery, motion practice, expert analysis, or further investigation. I reserve all rights, claims, remedies, arguments, and objections.
This Notice concerns only my individual dispute with CarGurus. I have personally reviewed this claim and, based on my current understanding and the information available to me, believe it is factually supported, not frivolous, and not duplicative.
Please confirm receipt of this Notice and direct all communications regarding this dispute to my counsel listed below.
Sincerely,