Session replay lawsuits, explained for site owners

Since 2022, law firms that sue companies on behalf of consumers have filed thousands of lawsuits arguing that recording a visitor's session — their clicks, scrolls, and keystrokes — without asking first is wiretapping. The main weapon is the California Invasion of Privacy Act (CIPA), a 1967 statute meant for phone lines, which courts have since applied to websites. The suits target ordinary sites running ordinary tools: session replay, analytics pixels, chat widgets. The tools themselves are legal. What triggers a claim is timing — a script that starts recording before the visitor has agreed to anything. If your consent banner and your tracking scripts load in the wrong order, you have the exact setup these firms scan for.

Treat this as a map of the territory, not legal advice — it should make the conversation with an actual lawyer shorter.

CIPA section 631 makes it illegal to intercept a communication without the consent of all parties. For fifty years that meant phone calls. In May 2022, the Ninth Circuit ruled in Javier v. Assurance IQ that it also covers website interactions — and, critically, that consent has to come before the recording starts. In that case, a session replay tool captured a visitor's answers to an insurance questionnaire, and only afterwards did the site present a button implying agreement. The court said consent given after the fact doesn't count.

That single ruling opened the floodgates. One litigation tracker counts 1,853 wiretapping and pen-register cases filed in federal and state courts between February 2022 and March 2025, 83% of them in California. By the end of July 2026 the same tracker showed 3,968 tracked cases in California, 811 in Florida, and 108 in Illinois. Defense firms describe most filings as the product of automated scanning: firms run tools that visit websites, watch which scripts fire before the consent banner is answered, and send demand letters to the ones that fail.

The stakes per case are real but fuzzy. The statute sets damages at $5,000 per violation, and courts haven't settled what one 'violation' is — per visitor, per session, per page load. Multiply any of those by a site's California traffic and the theoretical number gets large, which is exactly what makes demand letters effective. Most resolve confidentially. The one big public data point: the Los Angeles Times paid $3.85 million in June 2026 to settle claims over three ad trackers on its site, covering visitors from January 2023 to December 2025, without admitting wrongdoing.

The newer theory is stranger. CIPA section 638.51 bans installing a 'pen register' — a device that records what numbers a phone dials — without a court order. The people suing now argue that an analytics script collecting IP addresses, device identifiers, and page URLs is a pen register. The law firm Zwillgen reports that these claims surged from roughly 600 filings to over 4,000 in a single legislative session and now make up around two-thirds of active California privacy litigation.

Courts are split. Several California judges have dismissed pen-register claims outright, ruling the statute means telephones, not websites; a federal judge in the Politico case threw one out in late 2025 because collecting generic metadata didn't injure anyone concretely. But the LA Times settlement was a pen-register case, so the theory has already produced a multimillion-dollar outcome. Appeals that could settle the question are pending, and so is a California bill (SB 690) that would narrow these claims — it has stalled once already. For now, uncertainty is the point: it's cheaper to settle than to litigate an unsettled question.

Eleven states require all parties to consent to a recording, and several have produced their own cases. Pennsylvania matters most: in Popa v. Harriet Carter Gifts (2022), the Third Circuit ruled that under Pennsylvania's wiretap law a website can't excuse itself as a 'party' to the conversation — everyone has to consent, including the visitor being recorded. Florida's equivalent statute has driven 811 tracked cases. Illinois has an active docket too.

One court has pushed the other way. Massachusetts' highest court ruled in Vita v. New England Baptist Hospital (October 2024) that the state's 1968 wiretap law was written for secretly recorded conversations between people, and doesn't stretch to pixels tracking your browsing. That ruling killed pixel claims in Massachusetts — though it addressed tracking pixels, not session replay, so even there the door isn't fully closed.

The law firm Loeb & Loeb gave 2026's dominant claim pattern a name: the millisecond problem. A visitor lands on a page. The consent banner starts loading. In the few hundred milliseconds before it renders, the Meta Pixel, an analytics tag, or a replay script has already fired and sent data. The visitor then clicks Accept — but the recording started first, and under Javier, consent that arrives after the interception doesn't cure it.

This is almost never a deliberate choice. It happens when a tag manager fires scripts without waiting for the consent signal, when a consent platform collects the choice but never passes it to the tags, or when a third-party script ignores the site's consent settings entirely. The site owner believes they're covered because a banner exists. The scanning tools that feed these lawsuits measure what actually happens on the network, and the network doesn't lie about ordering.

No. Every law firm publication in the research behind this post says a version of the same thing: the tools are lawful, and the liability comes from how they're deployed. Hotjar, FullStory, Microsoft Clarity, and the rest appear throughout these complaints as the technology involved, but the defendant is the website that ran them before getting consent. ConsentPixel puts it bluntly: the tool isn't under enforcement — the common way of deploying it is what violates California law.

Recording with prior consent is a defensible position. Recording first and asking second is the thing the entire lawsuit wave is built on.

Compiled from defense-firm guidance (Spencer Fane, Loeb & Loeb, Lokker, and the compliance trackers behind this post). A lawyer should review your specifics; this is the checklist they'll start from.

Fire nothing before consent. The consent banner loads first, and analytics, replay, pixels, and chat widgets stay silent until the visitor makes a choice. Your consent platform should log the timestamp of the choice, and the tags should verifiably fire after it. If you can't prove the order, assume it's wrong: open your browser's network tab on a fresh visit and watch what fires before you click anything.

Mask inputs in replay tools. Passwords, payment fields, and personal data should never appear in a recording; how session replay actually works covers what masking does. Fair warning from the case law: no court has ruled that masking alone is a complete defense — the claims are about the recording happening at all, not only about what it captured. Masking shrinks the damage, and consent timing removes the trigger.

Fix the vendor contract. A line of cases starting with Graham v. Noom (2021) holds that a replay vendor contractually restricted to processing data only on your behalf is your tool — a tape recorder — rather than a third party doing its own intercepting. That defense depends on the contract actually saying so: the vendor can't use your visitors' data for its own advertising, benchmarking, or model training. Vague 'product improvement' clauses weaken it.

Treat California visitors as opt-in. Many sites show a strict consent banner to EU visitors and nothing to Americans. The last four years of litigation say that's backwards risk management: California is where 83% of these cases get filed. Defense firms now recommend gating non-essential tracking behind an explicit opt-in for California traffic, the way you already do for the EU.

Say what you do in the privacy policy. Naming the tools you run and what they capture won't satisfy CIPA by itself — disclosure isn't consent — but a policy that contradicts your actual setup makes every other claim against you look better.

The lawsuit wave is real, and it's automated, which means small sites get letters too — you don't need to be the LA Times. The right response is an afternoon of verification rather than panic-deleting your analytics: watch your own site load, confirm nothing fires pre-consent, check the masking settings in your replay tool, and read the data-use clause in your vendor agreement. Sites that pass those checks are exactly the ones the scanning tools skip.

This post explains the litigation landscape for educational purposes. It isn't legal advice, and the law here is moving quickly — pending appeals and legislation could change the picture. For decisions about your own site, talk to a privacy lawyer.