Your Website Might Be Wiretapping Visitors: Session Replay, Chat Widgets, and CIPA Lawsuits

If you have ever opened a CIPA demand letter, you know the pattern. A law firm claims the company's website "wiretapped" a California visitor, cites a statute written in 1967, and asks for a settlement to make it go away. The natural first reaction is that it must be a scam, because all they did was install a chat widget and a heatmap tool their marketing team liked.

It is not a scam, exactly. It is a real legal theory that plaintiffs' firms have pushed hard against ordinary business websites, and it is aimed at the same tools most marketing teams install without a second thought: session replay, chat widgets, and tracking pixels. This post explains the risk in plain words, what changed in California this fall, and the audit I run when a client asks whether their site is exposed. It ends with the reason I keep pushing clients toward offline conversion tracking instead of piling more pixels onto the page.

One note before we start. I run growth and tracking for companies, I am not a lawyer, and this is not legal advice. If you have a demand letter or a lawsuit, call privacy counsel. What I can do is tell you what your website is actually doing, because that is the part most legal teams cannot see.

What Is a CIPA Website Lawsuit?

A CIPA website lawsuit is a claim that a business let a third party record or intercept a California visitor's communications on its website without consent. CIPA is the California Invasion of Privacy Act, a set of Penal Code sections written for phone taps and recording devices. Plaintiffs argue that modern website code does the same thing.

Two sections show up most often in website cases.

Section 631: the wiretapping claim

Penal Code 631(a) covers anyone who, "without the consent of all parties to the communication," reads or tries "to learn the contents or meaning of any message" while it is in transit. It also covers anyone who "aids, agrees with, employs, or conspires with" someone else to do it. That last part is why the website owner gets sued, not just the software vendor. The theory is that you invited a third party into the conversation between your site and your visitor.

Section 638.51: the pen register and trap and trace claim

Penal Code 638.51 says a person may not install or use a "pen register" or "trap and trace device" without a court order. Those terms were built for phone records, meaning who called whom, not what was said. Plaintiffs argue that tracking pixels and SDKs that capture IP addresses, device data, and similar "addressing" information are modern pen registers. A federal court in Greenley v. Kochava (S.D. Cal. 2023) refused to dismiss that kind of claim against an SDK maker, reasoning that the statute's "device or process" language could cover software. That was a pleading-stage ruling, not a finding of liability, but it helped launch a wave of copycat pixel claims.

Why the numbers get scary

CIPA's private right of action, Penal Code 637.2, lets an injured person sue for the greater of $5,000 per violation or three times actual damages, and says the plaintiff does not need to show actual damages. Multiply $5,000 by a class of website visitors and you understand why these letters get written, and why a lot of businesses settle rather than fight.

The Three Tools Plaintiffs Target Most

Most website CIPA claims point at one of three categories. Your marketing team probably installed at least two of them.

Session replay tools

Session replay software records how visitors move through your site, including clicks, scrolls, mouse movement, and sometimes what they type into fields. Then it rebuilds the visit like a video. It is genuinely useful for conversion work. It is also the textbook "recording" in a session replay compliance complaint, because a third party's script is capturing the visitor's activity in real time.

Javier v. Assurance IQ is the case everyone cites. A visitor filled out a life insurance quote form, and a tool called TrustedForm recorded his session. The site showed a privacy policy notice only at the end. In a 2022 unpublished memorandum, the Ninth Circuit held that Section 631(a) requires prior consent from all parties, and that agreeing to a privacy policy after the recording already happened did not count. The lesson for marketers is simple: consent that arrives after the script fires is not consent.

Chat widgets

A chat widget wiretapping lawsuit argues that the chat vendor, not just your company, is reading the conversation. Visitors type real questions into chat, sometimes with names, health details, or account numbers, and the vendor's servers process those messages.

In Jones v. Peloton (S.D. Cal. 2024), the court denied Peloton's motion to dismiss. The complaint alleged that Drift, the chat provider, intercepted chats and used the data to improve its own AI and software. The court found that was enough, at the pleading stage, to treat Drift as a possible third-party eavesdropper rather than a mere tool of Peloton. The vendor's own use of your visitors' data is the hinge.

The other side of the ledger matters too. In Gutierrez v. Converse (9th Cir. 2025, unpublished), the court affirmed summary judgment for Converse on a chat claim involving Salesforce, because there was no evidence Salesforce actually read the messages. The court said the evidence showed, at best, that Salesforce "could read" them. So these cases are winnable, but winning took years of litigation. Most businesses would rather not be the test case.

Tracking pixels

A tracking pixel lawsuit usually alleges that ad pixels (Meta, TikTok, LinkedIn, Google, and so on) send visitor data to the ad platform as the page loads. Depending on the facts, plaintiffs plead it as a 631 wiretap, a 638.51 pen register, or both. Pixels are also the tool most likely to fire before a consent banner does anything, which I will come back to in the audit.

What Changed in 2026: SB 690

California did act this year, but the fix is narrower than a lot of early commentary suggested. SB 690 was approved by the Governor on September 30, 2026 (Chapter 976, Statutes of 2026). It amends Section 637.2 so that a 638.51 pen register or trap and trace claim against a private business, arising from conduct on a website, online application, or mobile app, can be brought only by the Attorney General. It applies retroactively to pending claims in actions commenced within two years before its operative date.

Here is what it does not do. An earlier version would have exempted a broad "commercial business purpose" from the wiretap and pen register sections. That language did not survive. As Shumaker's analysis points out, private plaintiffs can still bring Section 631 wiretapping claims and other CIPA theories, and the bill does not make website tracking "legal." Shumaker also notes that, as a non-urgency bill, it takes effect January 1, 2027, and that a demand letter is not an "action commenced."

My read as an operator: the pixel-only pen register letters lose most of their leverage. The session replay and chat claims, which are mostly pleaded under 631, do not. Expect plaintiffs' firms to lean harder on 631, which means the tools that capture what visitors type and say are now the bigger exposure.

The Courts Are Split, and That Is Not Comfort

You will hear that these cases are losing. Some are. In Popa v. Microsoft (9th Cir. 2025), a published opinion, the court affirmed dismissal of a session replay suit over Microsoft Clarity on a Pet Supplies Plus website. The plaintiff lacked Article III standing because tracking her ordinary browsing did not resemble the kind of highly offensive privacy harm the common law protects.

Read that carefully. Popa is about standing in federal court. It did not decide that session replay is lawful, and it turned on what was recorded (routine shopping behavior). A form where someone types medical history, financial details, or a private question into chat is a very different set of facts. Federal standing rules also do not govern California state courts. So I treat Popa as a helpful defense argument, not a reason to leave every tool running.

A Practical Audit: What Your Website Records and Shares

This is the checklist I run. None of it requires a lawyer to start, and all of it gives your lawyer something real to work with. If you are buying a company, add it to diligence. It belongs next to the checks in our marketing due diligence guide.

1. Inventory every script on the site

Do not trust the tag manager alone. Hard-coded scripts, plugins, and old agency installs hide outside it. Load your key pages (home, pricing, contact, quote forms, checkout, logged-in areas) with browser developer tools open and list every third-party domain that receives a request. For each one, write down the vendor, what the tool does, who installed it, and who owns it today. It is common to find at least one tool nobody can explain.

2. Classify what each vendor actually captures

The risk is very different between a tool that counts page views and one that records keystrokes. For each vendor, note whether it captures form field inputs, chat text, full URLs with query strings (which can carry emails or search terms), or replay video. Check whether input masking is on by default in your session replay tool, and whether someone turned it off to debug a form and never turned it back on.

3. Test what your consent banner really blocks

This is where I find the most problems. Many banners look compliant and block nothing. Open the site in a clean browser, do not click the banner, and watch the network tab. If pixels and replay scripts fire on page load, your banner is decoration. Then click "reject" and check again. A banner that only stops cookies but still lets scripts send data is a common gap. Remember Javier: consent has to come before the recording, not after it.

4. Fix chat disclosures

Put a short, clear notice at the start of the chat, before the visitor types, saying the conversation is recorded and processed by a named service provider. Link to your privacy policy. Do not bury it in the footer. If your chat tool uses AI or a vendor that trains on transcripts, find out exactly what the vendor does with your visitors' messages, because that is the fact Jones v. Peloton turned on.

5. Read the contracts and DPAs

Pull the terms and data processing agreement for every vendor that touches visitor data. The question that matters is whether the vendor acts only as your service provider, or reserves rights to use the data for its own products, model training, or advertising. The more a vendor can use your data for itself, the more it looks like a third-party eavesdropper in a 631 complaint. While you are in there, look at your agency agreement too. Who owns the tag manager and the pixel accounts? I covered that in marketing agency contract red flags.

6. Put tag governance in writing

Most exposure comes from drift, not decisions. A freelancer adds a heatmap tool for a test. A new chat vendor goes live during a redesign. Fix the process:

• One owner for the tag manager, with publish rights limited to a few people.
• An approval step before any new vendor script goes live, including a quick look at what it captures and its terms.
• A quarterly scan of every page template to catch hard-coded scripts and leftovers.
• Sensitive page rules, meaning no replay, chat transcription to outside vendors, or ad pixels on pages that collect health, financial, or account information. If you are in healthcare, read our HIPAA marketing pixels checklist, because the stakes there are higher.
• Removal of anything nobody uses. The safest script is the one that is not on the page.

If you have been through an acquisition or roll-up, tag sprawl is usually worse than anyone thinks. Our martech consolidation guide covers how to clean it up without breaking reporting.

Why Offline Conversion Tracking Is the Better Answer

Here is the part where my compliance advice and my growth advice turn out to be the same advice. Most of the pixels on a typical lead gen site exist to tell Google and Meta that a conversion happened. The pixel fires in the visitor's browser, sends data to the platform, and reports a form fill. That is exactly the browser-side, third-party data flow that CIPA complaints describe.

Offline conversion tracking flips that. You capture the lead in your own systems, the CRM verifies what happened (qualified, booked, closed, with a value), and you send that outcome server-side to the ad platforms. Google supports this with offline conversion imports, and Meta supports it through the Conversions API for CRM integration.

Why I think this is almost always better:

• Fewer third parties in the conversation. When the visitor is on your site, the data goes to you. You decide later what to share, under your consent rules and your contracts.
• You control the payload. You can send only what the platform needs to match and optimize, and leave out form contents, chat text, and anything sensitive.
• Better data for bidding. A pixel knows someone submitted a form. Your CRM knows whether they became a customer. Optimizing to real outcomes beats optimizing to form fills, which I argued at length in fix your tracking before you scale ad spend and our cookieless measurement stack guide.

Server-side is not a free pass. You still need a lawful basis and honest notice for what you share, and sending data server-side without consent can create its own problems. But a clean offline conversion setup is easier to explain, easier to govern, and easier to defend than a dozen browser scripts nobody remembers installing. It also only works if your team follows up on leads, which is why I pair it with a real speed to lead process.

What to Do This Month

1. Run the script inventory and consent test above on your top ten pages.
2. Turn on input masking in any session replay tool, or remove the tool from forms and checkout.
3. Add a pre-chat disclosure and confirm what your chat vendor does with transcripts.
4. Remove unused pixels and tools. Then move your main conversion signals to offline conversions.
5. Bring the inventory to privacy counsel and ask them to review your banner, policy, and vendor terms together.

If you want help with the technical half, that is what our marketing compliance work covers, and you can see how it fits other regulated marketing issues in marketing compliance for regulated industries. Lead gen teams should also check their texting consent against our TCPA consent guide, since the same forms often carry both risks. More posts are on the Impaxium blog.

FAQ

What is a CIPA website lawsuit?

A CIPA website lawsuit claims a business let a third party intercept or record a California visitor's website communications without consent, usually under Penal Code 631 or 638.51. The tools at issue are typically session replay, chat widgets, and tracking pixels.

Can session replay software get my business sued?

Yes, session replay is one of the most common targets because it records visitor activity through a third party's script. Courts have reached mixed results, so the practical move is to mask inputs, get consent before recording, and keep replay off sensitive pages.

Is a chat widget really wiretapping?

A chat widget can be alleged as wiretapping when the vendor reads or uses chat messages for its own purposes. Jones v. Peloton survived a motion to dismiss on that theory, while Gutierrez v. Converse ended in summary judgment for Converse because there was no evidence the vendor read the chats.

Did SB 690 end tracking pixel lawsuits in California?

No, SB 690 only limits private 638.51 pen register and trap and trace claims based on website and app conduct, reserving those for the Attorney General. Private Section 631 wiretapping claims remain available, so pixel, replay, and chat claims can still be filed under that theory.

Does a cookie banner protect me from CIPA claims?

A cookie banner only helps if it actually blocks scripts until the visitor consents. Many banners load pixels and replay tools on page load, and the Ninth Circuit's Javier memorandum held that consent given after recording starts does not satisfy Section 631(a).

Is offline conversion tracking safer than pixels?

Offline conversion tracking generally reduces risk because the visitor's data goes to your systems first, and you choose what verified outcome to share with ad platforms. You still need proper notice and consent, but there are fewer third parties watching the session in real time.

Is this legal advice?

No, this is an operator's view of how website tracking works and where the risk sits. If you have a demand letter or lawsuit, talk to privacy counsel before responding or settling.