Session replay and heatmap tools are some of the most useful instruments a conversion optimization program has. They are also, as of 2026, the subject of a fast-growing wave of lawsuits arguing that recording a visitor's clicks and scrolls without prior consent amounts to illegal wiretapping. This is not a theoretical risk anymore. Settlements are landing in the tens of millions of dollars, and the underlying law was written decades before anyone recorded a mouse cursor.
California's Invasion of Privacy Act, known as CIPA, is being used to sue businesses over session replay tools, tracking pixels and chat widgets that capture visitor activity before consent is given. At least 46 documented lawsuits have targeted these tools by August 2026, with over 153 million dollars in disclosed settlements. The fix is gating these scripts behind real consent, not removing them.
What CIPA actually is and why it applies to a heatmap tool
The California Invasion of Privacy Act dates back to 1967 and was written to stop unauthorized recording of telephone calls. Courts have since read its language broadly enough to cover digital communications, and in 2022 the Ninth Circuit's ruling in Javier v. Assurance IQ made the connection explicit for websites: recording a visitor's on-page activity with session replay software before they had seen a privacy policy or made a consent choice was treated as unlawful interception under CIPA. That single ruling opened the door to a wave of copycat filings against ordinary marketing and analytics tools that had nothing to do with phone calls.
Plaintiffs' firms have since extended the same theory to tracking pixels, live chat widgets, and other scripts that capture user interaction or form input before a visitor has made an informed choice about tracking. The common thread across nearly every case is timing: the alleged harm is not that tracking happened, it is that it happened before consent.
How big is this in 2026
Litigation trackers following CIPA website cases reported at least 46 documented lawsuits specifically naming session replay tools, tracking pixels and analytics scripts as of August 2026, with disclosed settlements totaling more than 153 million dollars. California remains the center of gravity for filings, with a much smaller but growing volume of similar cases in Florida and Illinois under their own state wiretapping and privacy statutes.
Two settlements from mid-2026 show the range of exposure. A federal judge approved a 3.85 million dollar class settlement against the Los Angeles Times on June 26, 2026, tied to website tracking practices. Separately, Flo Health agreed to pay 59.5 million dollars to resolve claims that its tracking tools shared sensitive user data with third parties without proper consent. The dollar figures vary enormously by case, but the pattern across nearly all of them is the same: tracking that started before the visitor had a real chance to decline it.
Which CRO tools actually carry the risk
Not every analytics tool carries equal exposure. The risk scales with how much of a visitor's raw behavior a tool captures and how it is configured.
| Tool type | Examples | Relative risk |
|---|---|---|
| Session replay and screen recording | Hotjar, FullStory, Microsoft Clarity, Mouseflow | High, records granular interaction by design |
| Live chat and support widgets | Intercom, Drift, custom chat scripts | Moderate to high if capturing input pre-consent |
| Marketing and ad pixels | Meta Pixel, various third-party trackers | Moderate, depends on data captured and timing |
| Aggregate web analytics | Google Analytics, standard event tracking | Lower, but not zero if configured to log free text or PII |
The common failure mode across all of these is the same: a script fires the moment the page loads, before the visitor has answered a consent prompt, or fires regardless of what they answer. That gap between "banner shown" and "script actually gated" is where most of the legal exposure lives.
Audit your tag manager for anything that fires before a consent decision is recorded, not just anything that fires without a banner at all. A visible cookie banner sitting on top of scripts that load regardless of the answer is the exact pattern these lawsuits target, and it is also the most common thing we find when we inherit someone else's tracking setup.
Does this mean you should stop testing?
No, and that would be an overcorrection with a real cost. Session replay remains one of the highest-value tools for understanding why a page underperforms, well beyond what an aggregate conversion number can tell you. The fix is almost always configuration rather than removal: gate the recording script so it only initializes after explicit consent, mask sensitive form fields such as payment and health information at the source rather than relying on the vendor's default redaction, and review your tool vendor's data processing agreement to confirm what they actually do with recorded sessions rather than assuming reasonable defaults. Our broader guide to cookie consent and website privacy compliance covers the banner and consent-flow side of this in more detail.
This is part of a broader pattern of litigation risk moving into everyday CRO and marketing tooling, alongside the wave of ADA lawsuits we covered in our piece on Shopify accessibility overlay lawsuits. Neither problem is solved by a $30 a month plugin. Both require actually changing how the site behaves before the visitor has made a choice.
Frequently asked questions
What is CIPA and why does it apply to session replay tools?
CIPA, the California Invasion of Privacy Act, is a wiretapping law originally written for telephone calls. In 2022 the Ninth Circuit ruled in Javier v. Assurance IQ that recording a visitor's on-site activity with session replay software before they had seen a privacy policy counted as unlawful interception under CIPA. Courts have since applied that logic to tracking pixels, chat widgets and analytics scripts as well.
How many CIPA lawsuits target website tracking tools in 2026?
Trackers following CIPA litigation reported at least 46 documented lawsuits specifically targeting session replay tools, tracking pixels and analytics scripts as of August 2026, with more than 153 million dollars in disclosed settlements. California accounts for the large majority of filings, with smaller but growing volumes in Florida and Illinois under similar state laws.
Which CRO and testing tools carry the most CIPA risk?
Session replay and heatmap tools such as Hotjar, FullStory, Microsoft Clarity and Mouseflow carry the highest exposure because they record granular user interaction by design. Live chat widgets and certain third-party pixels that capture form input before consent also carry meaningful risk. Standard aggregate analytics like Google Analytics carries lower but not zero exposure.
Does a cookie consent banner protect me from CIPA lawsuits?
Only if scripts do not fire until after consent is given. The core legal problem in most CIPA cases is tracking that starts before a visitor has made a choice. A banner that displays immediately but lets session replay or pixel scripts load in the background regardless of the visitor's answer does not fix the underlying exposure.
Should I stop using session replay tools because of these lawsuits?
Not necessarily. Session replay remains one of the most useful CRO diagnostic tools available. The fix is usually configuration, not removal: gate the script behind explicit consent, mask sensitive form fields at the source, and confirm your vendor's data processing terms rather than assuming default settings are compliant.
Does this only affect businesses based in California?
No. CIPA and similar state wiretapping statutes generally apply based on where the website visitor is located, not where the business is registered, and California residents can be reached by any US website regardless of where the company is based. Florida and Illinois have brought a growing number of similar cases under their own state laws.
The takeaway
The tools that make conversion optimization possible are now also a documented legal exposure, and the settlements from 2026 show the numbers are not trivial. The answer is not abandoning session replay or heatmaps. It is auditing exactly when those scripts fire relative to consent, fixing the gap, and treating that fix as part of your CRO program rather than a separate legal chore. A site that tests responsibly still beats a site that does not test at all, and it also beats one that tests carelessly.