Session replay and pixel lawsuits: what website owners should know

CIPA dates from 1967 and was written for telephone taps. Its wiretapping section, Penal Code section 631, makes it unlawful to read or learn the contents of a communication while it is in transit without the consent of all parties. Plaintiffs argue that a website visit is a communication between the visitor and the site, and that a third-party script recording keystrokes, clicks or chat messages lets the script's vendor listen in.

What makes these claims attractive is the remedy. Penal Code section 637.2 lets anyone injured by a violation sue for the greater of $5,000 per violation or three times their actual damages, and they don't have to show actual harm. Multiplied across a class of visitors, the exposure gets large quickly.

Courts have not settled the question. A June 2026 analysis by the law firm Skadden described the California courts as "flooded with CIPA actions", with conflicting decisions, and noted that many claims never reach a public court record because they end in pre-suit letters or arbitration. Outcomes tend to turn on facts such as what the vendor may do with the data and whether visitors agreed before the script ran.

On 30 September 2026, Governor Newsom signed SB 690. From 1 January 2027, claims under the pen register and trap-and-trace part of CIPA that arise from conduct on a website or app can only be brought by the Attorney General, not by private plaintiffs. According to a Covington analysis, it reaches back to pending cases filed since 1 January 2025.

It does not change private claims under the wiretapping provision, section 631, which is where most session replay and chat claims sit. An earlier draft would have exempted tracking done for a "commercial business purpose". That exemption was dropped before the bill passed. The Governor asked the Legislature to look at the rest of CIPA next year, so expect further change.

Global Privacy Control (GPC) is a signal a browser or extension sends with every request to say the visitor opts out of the sale or sharing of their personal information. Several US state privacy laws require businesses to treat it as a valid opt-out. In mid-2025 the IAPP listed 12 such states: California, Colorado, Connecticut, Montana, Nebraska, New Hampshire and Texas, with Delaware, Maryland, Minnesota, New Jersey and Oregon to follow within a year.

GPC and CIPA are different laws, but they meet on the same scripts. When a replay tool or pixel sends visitor data to a third party that may use it for advertising, a site covered by these laws generally has to stop that for visitors who send GPC. Whether a given state law covers your business depends on thresholds such as revenue and the number of residents whose data you handle.

None of this makes session replay, chat or pixels unlawful in themselves. Plenty of sites use them carefully. The suits mostly target setups where the visitor wasn't told, didn't agree, or where the vendor could use the data for its own ends. The steps lawyers usually discuss are the same ones good practice suggests anyway:

Session replay shows what visitors did: where they scrolled, what they clicked, where they stopped. It cannot tell you why. Someone who scrolls back up a pricing page might be comparing plans or looking for a missing answer, and you are left guessing.

A question gets the reason in the visitor's own words, from the visitors who choose to answer. The two collect very different things:

You can also use both: replay on a few flows they study closely, with consent, and a short question on the pages where they mostly want to know what's missing.

Asklet is the asking side. The widget is an iframe on our domain, so it cannot see or record anything on your page: no clicks, scrolls, keystrokes or page content outside the widget. It collects what the reader types or picks in the survey, the page path it was shown on, and the time.

To be clear about our own site: the Asklet marketing pages run Google Analytics and Microsoft Clarity, which includes session recording. Neither runs in the widget, the dashboard or the sign-in pages.

Using Asklet doesn't make your site compliant with any law. You are still the controller of the feedback you collect, so mention it in your privacy notice, and review your other scripts on their own merits.