Which Tracking Scripts Appear Most in Website Privacy Lawsuits

California Invasion of Privacy Act, CIPA, complaints name session-replay tools, chat widgets and ad pixels, because each records something a visitor typed, said or clicked and sends it to a third party before the visitor answers a consent banner. The live counts by script are on Suitcast's trackers page, built from complaint text and updated daily.

The four categories complaints name, and why

CIPA complaints about websites rest on two theories, and the script categories follow from them. The section 631(a) wiretap theory needs the contents of a communication: something the visitor typed or said. The section 638.51 pen register theory needs routing information: an IP address, a device identifier, a referrer. Scripts that capture both are named most; scripts that capture only the second are named less. The CIPA demand letter guide explains both theories in detail.

Session replay records mouse movement, scrolling, clicks and keystrokes, and reassembles them into a video-like replay of the visit. That is the strongest fit for the wiretap theory because the recording includes what the visitor typed into a form before they submitted it. Complaints describe this as recording the visitor's session without permission, and the Suitcast tracker catalog marks every tool in this category critical.

Chat widgets store the conversation and usually track the visitor's page views as well. Complaints say the vendor, not only the business, receives and stores the messages, and that the visitor was not told. The section 632.7 claim about cellular communications appears here, for chats opened on a phone.

Ad pixels send page views, add-to-cart and purchase events, and sometimes typed form values such as an email address, to an advertising platform for measurement and targeting. Meta Pixel and TikTok Pixel are marked critical in the catalog; the pixels from Google Ads, Microsoft, LinkedIn, Pinterest, Snap, X, Reddit, Criteo and AdRoll are marked high.

Analytics sends less: pages viewed, source, device, an identifier. Google Analytics 4, HubSpot, Heap, Mixpanel, Segment and Amplitude appear in complaints as part of a list rather than as the lead allegation, and the catalog marks them medium. Segment deserves a separate look because one script forwards data to many destinations, so it can feed dozens of trackers at once.

The scripts by name, and what each records

The descriptions below are the ones Suitcast shows next to each finding, drawn from the tracker catalog that also feeds the trackers page.

Meta Pixel reports what visitors do on your site so you can run and measure Facebook and Instagram ads. Complaints describe it sending page views, clicks and sometimes form entries to Meta before the visitor agreed.

TikTok Pixel reports visits, add-to-carts and purchases back to TikTok. Complaints describe it collecting page views and typed information such as email addresses before consent.

Microsoft Clarity records a video-like replay of mouse movements, scrolling, clicks and typing, and builds heatmaps. Clarity is free, which puts it on many small business sites where nobody looks at the recordings.

Hotjar records sessions including mouse movement, scrolling and keystrokes, and turns them into replays and heatmaps. Complaints treat tools like this as the central example of wiretapping a visitor's interaction with the page.

FullStory captures a full replay including what visitors type into forms. Mouseflow, Lucky Orange and Crazy Egg do the same job with heatmaps, and Lucky Orange also bundles a live chat window in the same script.

Intercom Messenger, Drift and LiveChat are chat widgets that store conversations and track page views. Complaints say chat tools like these record and share conversations with the vendor without telling the visitor first. Tidio, Zendesk Chat and Gorgias Chat are in the same group and common on Shopify stores.

Google Analytics 4 counts visits and shows which pages people look at and where they came from. Complaints cite it for sending browsing activity and device details to Google before the visitor was asked.

Google Tag Manager is not a tracker itself. It is the container that loads the others, and complaints name it because it fires those tags the moment a page opens, before any banner is answered. On most sites it is where the real trackers are switched on, and it is where gating happens.

How to gate each category

Gating means the script does not load until the visitor clicks accept, and stays off if they click reject or ignore the banner. The setting lives in a different place on each platform. These paragraphs follow the plain fixes Suitcast shows next to each finding.

Shopify. Turn on the customer privacy banner under Settings, Customer privacy, and keep every app tied to it. The Facebook & Instagram, TikTok, Google & YouTube and Pinterest apps installed from the app store follow the banner; a pixel pasted into theme code does not. Check that Klaviyo, Attentive, Yotpo, Lucky Orange and Gorgias follow it too, in each app's own settings.

WordPress. Place every script through a consent plugin such as Complianz or CookieYes rather than in the theme header or a code snippet plugin. The plugin holds the script until accept and offers a custom script slot for tags it does not know, such as the Microsoft Advertising UET tag or a chat widget.

Google Tag Manager. Open the container, turn on consent mode in the container settings, and give each tag a consent requirement: analytics_storage for analytics tags, ad_storage for ad pixels, and ad_user_data for the Google Ads tag. Without a per-tag requirement, consent mode changes nothing. Delete tags for services you no longer use while you are there.

Session replay tools. Most have their own consent switch. Clarity's is in the Clarity dashboard under Settings, Require cookie consent. Hotjar, Mouseflow, Lucky Orange, Smartlook and FullStory each have a setting that waits for consent, and FullStory, LogRocket and Quantum Metric also need form fields masked. Turn the switch on, then connect it to the banner or to consent mode.

Chat widgets. Load the widget only after accept, and add a line in the greeting that conversations are saved. If nobody staffs the chat, remove the script rather than gating it.

The removal rule. Almost every plain fix in the catalog ends the same way: if you are not running the ads, reviewing the recordings or staffing the chat, remove the script. A script nobody uses is exposure with no return.

Categories compared by what they record and risk level

The risk level is the one the Suitcast tracker catalog assigns to each script. It reflects how complaints describe the category, not a legal conclusion.

Read the table as an order of operations. Gate or remove the critical rows first, since they carry the wiretap theory. Then the high rows. Then decide whether the medium rows earn their place, which for most small sites means keeping Google Analytics 4 behind consent mode and removing the rest.

Where the counts come from, and why they are floors

The per-script counts on the trackers page come from the text of filed complaints. Suitcast fetches complaint documents from CourtListener for the CIPA cases it tracks, searches the text for each tracker's name and known aliases, and counts the dockets that mention it. The methodology page describes the query and the matching, and the data page carries the coverage note.

That method produces floors, for three reasons. Demand letters are not filings, and most letters settle before a complaint exists, so the largest share of claims never enters the count. Complaint text is not available for every docket, and a docket without text cannot be matched. And complaints often describe a category, session replay software, without naming the vendor, which matches nothing.

So a script with a low count is not a low risk. It may be new, it may be named by category, or it may be the kind of tool a firm mentions in a letter and never in a complaint. The risk levels in the catalog are set from how complaints describe the category, not from the count.

I do not print the per-script counts in this guide because the table on the trackers page updates daily and a number written today would be wrong in a month. The window and scope are stated next to every count there. The firm counts for CIPA live on the firms page: in the last 12 months the top five by federal civil dockets were Bursor & Fisher with 55, Nathan & Associates with 26, Gutride Safier with 22, Tauler Smith with 21 and the Law Offices of Ross Cornell with 19. Of the 455 civil CIPA cases in that window, the Northern District of California holds 173 and the Central District of California 113, per the California page.

How to check your own site

By hand: open the site in a fresh private window with the browser's network panel recording before the page loads. Do not touch the banner. Every request to a host that is not yours is a script that fired before consent, and the panel shows the time each one fired. Then click reject and reload, and note what still fires. Repeat on a product page and a page with a form, because tags are often scoped to templates.

The free Suitcast scan does the same thing and writes it down. It loads your public pages in a real browser, checks every request against the tracker catalog and records each match with its timing before any click, then clicks reject when the banner offers it, and records again. The report lists what fired before consent and what kept firing after reject, by script name, with the plain fix and where the setting lives.

Two things the scan does that a manual check misses. It records the timing, so the report shows a pixel that fired a fraction of a second after load, before any banner could have rendered. And it is dated, so after you gate or remove scripts, a second scan shows the change with a timestamp, which is the record you want if a letter ever arrives. The scanner policy describes what the scan loads and how to block it.

Limitations

The catalog is 43 trackers. A script not in the catalog is not named in a scan result or a count, and new tools arrive faster than any list. If your site uses a recording or chat tool that is not listed here, treat it by its category, not by its absence.

Counts are floors for the reasons above, and they are federal. CIPA cases filed in California state court are covered only through curated sources, so the picture on the California page and the New York page is partial, and the data page says so next to every number.

The risk levels are descriptive. Critical means complaints describe the category as recording content; it is not a prediction that a given script will draw a letter. A site with only analytics can receive one, and a site with session replay may never hear anything. The scan shows what a complaint would cite; it does not stop anyone from filing, and it does not determine whether any script violates any statute. The not legal advice page says this in full.

Gating changes what fires from now on; it does not change what already fired. If you have already received a letter, read the CIPA demand letter guide first, and if the letter is about accessibility rather than tracking, the ADA website lawsuit letter guide covers that. Owners who want a weekly dated record of what fires can compare plans on the pricing page.