Session Replay Tools and CIPA Lawsuits

Session replay tools such as Microsoft Clarity, Hotjar and FullStory record how each visitor moves through a site and rebuild it as a video-like replay. California Invasion of Privacy Act, CIPA, complaints name them because they start recording when the page opens. Their privacy settings mask typing, but none of them waits for consent unless the site holds the script until accept.

What session replay records

A session replay script records the page as the visitor sees it and every interaction with it: mouse movement, scrolling, clicks, taps and the order of pages visited. The vendor rebuilds that into a replay a site owner can watch, plus heatmaps of where people click and how far they scroll.

Microsoft Clarity is free. Hotjar is now part of Contentsquare. FullStory captures each visitor's clicks, scrolling and what they type into forms, masked by default. Suitcast's catalog lists 10 session replay scripts among the 43 it recognizes, including Mouseflow, Lucky Orange, Crazy Egg and Smartlook.

Picture a dental practice on WordPress whose agency installed Clarity during a redesign to see why visitors left the booking page. The agency watched a few replays and moved on. The script kept running on every page for every visitor, and nobody at the practice knows it is there.

The vendors do limit what a recording holds, and each one works differently, as the section on privacy settings below shows. What none of them limits by default is when recording starts. On a site with no consent gating, the script loads with the page and sends its first data before a visitor has seen a cookie banner, let alone answered it.

Why complaints name session replay tools

Complaints describe session replay as the clearest case of the wiretap theory. Section 631(a) of CIPA covers anyone who, "without the consent of all parties to the communication", reads or attempts "to learn the contents or meaning of any message, report, or communication while the same is in transit", and anyone who "aids, agrees with, employs, or conspires with" a person doing so. Complaints argue the vendor does the reading and the site owner employs it. Section 637.2 lets an injured person sue for $5,000 per violation or three times actual damages, whichever is greater, and says actual damages are not required.

The counts are smaller than for ad pixels. On Suitcast's trackers page, in the 12 months to September 21, 2026, Contentsquare and Microsoft Clarity each appear in 10 verified complaints, FullStory in 9, Hotjar in 7 and Quantum Metric in 5, while Meta Pixel appears in 140. Suitcast counts 411 verified website tracking filings in that window on its dataset page.

Suitcast still rates every session replay script critical. The rating reflects what the script records, the whole visit rather than a single event, and complaints treat recording of that kind as the core of the claim. A complaint can name several scripts on one site, so a replay tool can appear beside the pixel or the analytics tag that drew the letter.

Privacy settings mask typing, but they do not wait for consent

Each vendor offers privacy settings, and they are easy to mistake for consent settings. Read what each one controls.

Microsoft Clarity. Clarity's consent documentation says that to stop Clarity setting cookies before consent, you go to Settings, then Setup, and turn cookies off. That controls cookies only. Microsoft's own verification step is to decline consent and "ensure Clarity is executing", and its consent management page says that with analytics_storage denied the "Clarity tag loads, but only cookieless data is collected". Clarity has enforced consent signals for visitors from the European Economic Area, the UK and Switzerland since October 31, 2025, and its FAQ says sites with no visitors from those places need not send one. For masking, Settings, then Masking, defaults to Balanced, and input boxes are masked in every mode.

Hotjar. Hotjar's help center says it suppresses user input by default and that "Hotjar disables most content suppression by default", apart from numbers and email addresses. The switches are under Sites & Organizations, the gear icon, Data suppression, including one called On-page text. Hotjar offers no consent switch of its own. Its cookie article says blocking Hotjar until consent depends on the site's setup and sends owners to their developer or platform.

FullStory. FullStory's Form Privacy rules are on by default and mask inputs, text areas and dropdowns. Private by Default, which captures no text unless it is allowlisted, is turned on by request to FullStory's support team. FullStory is the one of the three with a documented way to hold capture: its developer documentation says to set _fs_capture_on_startup to false and call FS('start') when ready.

Masking decides what a recording contains. It does not decide when the recording starts, which is the fact a complaint describes.

How to hold session replay until consent

The dependable fix is the same for every vendor: the script itself loads only after the visitor clicks accept.

1. Decide whether you use it. If nobody has opened the replays in months, remove the script. It is the only option that leaves nothing to configure.
2. Find how it was installed. A WordPress plugin, a Shopify app, a snippet pasted into the theme header, or a tag in Google Tag Manager. The fix lives in that place.
3. Google Tag Manager. Give the replay tag a consent requirement on analytics_storage, or fire it on a trigger that runs only after accept. A tag with no requirement fires regardless of the banner.
4. A consent plugin. Complianz, CookieYes and similar plugins can hold a script until accept. Add the replay snippet through the plugin, in the category it uses for statistics, rather than in the theme header.
5. FullStory. Set _fs_capture_on_startup to false and call FS('start') from the accept handler, as its documentation describes.
6. Keep masking on. Clarity's Balanced or Strict mode, Hotjar's input suppression and FullStory's Form Privacy still matter after consent.

Then load the site in a private window with the network panel recording and filter for clarity.ms, hotjar and fullstory. Any row before your first click is a request that went first.

Suitcast's free scan runs that check on up to 5 pages of your public pages. It records every request from the moment a page starts loading until the network goes quiet or 8 seconds pass, matches each against its 43 scripts, then presses reject when the banner offers it, never accept, and watches 3 more seconds.

A card like this one is what a Clarity setup with its cookie setting turned off can still produce: the script fired within a second of each page opening, and it kept sending after reject because the setting governs cookies, not the script.

Session replay settings compared

The rows below compare what each vendor's own settings do before a visitor chooses, as each vendor's documentation describes them on September 21, 2026.

Read the last two columns together. Only FullStory documents a way to hold capture itself, and for all three the dependable hold is the same: the script or its capture starts after the visitor accepts.

Keeping replay held as the site changes

Consent gating drifts. A new theme brings back an old header snippet, a plugin update resets its script slots, an agency adds Clarity to a campaign landing page without the consent trigger. The replay that waited last month records first this month, and nothing tells the owner.

Suitcast's Monitor plan repeats the scan on up to 100 pages of one site every week and emails what changed: new scripts, scripts that stopped, fixes that did not hold, and new filings over the same trackers. It costs $39 a month or $390 a year, less than one hour of privacy counsel, and keeps every dated report with its PDF.

That fits a dental practice on WordPress whose agency added Clarity for a redesign, and a Shopify store that tried Hotjar during a theme change. An agency with 5 to 30 client sites uses Pro, five sites for $79 a month or $790 a year with the agency name on each PDF; the pricing page compares them.

Limitations

Vendors change their settings and their documentation. This article describes Microsoft's, Hotjar's and FullStory's pages as read on September 21, 2026; read them again before relying on a setting, and test the result in a browser rather than trusting a toggle.

A browser-based scan sees only requests the browser makes. It cannot see what a recording contains, whether masking is on, or data a site sends from its own server. The catalog covers 43 scripts, and the free scan reads 5 pages pages.

The complaint counts come from verified filings, so they are floors: demand letters are not counted and state-court coverage is partial, as the methodology page explains. How CIPA applies to session replay is unsettled and is for courts to decide. California's SB 690 was presented to the Governor on September 4, 2026 with no later action recorded as of September 21; its enrolled text changes section 637.2 only for claims under section 638.51 and does not amend section 631. Nothing here is legal advice. The not legal advice page explains what a count means, and the scanner policy describes what the scan loads.