California Invasion of Privacy Act, CIPA, complaints name ad pixels and analytics most often, led by Google Analytics 4, the Google Ads tag and Meta Pixel, because they send a visitor's activity to a third party before the visitor answers a consent banner. Session replay and chat tools are named less often but rated higher risk. The live counts by script are on Suitcast's trackers page, updated daily.
The four categories complaints name, and why
CIPA complaints about websites rest on two theories, and the script categories follow from them. The section 631(a) wiretap theory needs the contents of a communication: something the visitor typed or said. The section 638.51 pen register theory needs routing information: an IP address, a device identifier, a referrer. Scripts that capture both fit the claim best and carry the highest risk rating, while the scripts named in the most complaints are ad pixels and analytics, which are on far more sites. The CIPA demand letter guide explains both theories in detail, and the cookie banner test shows how to check which scripts fire before consent on your own site.
Session replay records mouse movement, scrolling, clicks and keystrokes, and reassembles them into a video-like replay of the visit. That is the strongest fit for the wiretap theory because the recording includes what the visitor typed into a form before they submitted it. Complaints describe this as recording the visitor's session without permission, and the Suitcast tracker catalog marks every tool in this category critical.
Chat widgets store the conversation and usually track the visitor's page views as well. Complaints say the vendor, not only the business, receives and stores the messages, and that the visitor was not told. The section 632.7 claim about cellular communications appears here, for chats opened on a phone.
Ad pixels send page views, add-to-cart and purchase events, and sometimes typed form values such as an email address, to an advertising platform for measurement and targeting. Meta Pixel and TikTok Pixel are marked critical in the catalog; the pixels from Google Ads, Microsoft, LinkedIn, Pinterest, Snap, X, Reddit, Criteo and AdRoll are marked high.
Analytics sends less: pages viewed, source, device, an identifier, so the catalog marks it medium. It is still named often: Google Analytics 4 appears in 166 verified complaints in the 12 months to September 16, 2026, more than any other script. HubSpot, Heap, Mixpanel, Segment and Amplitude are in the same group. Segment deserves a separate look because one script forwards data to many destinations, so it can feed dozens of trackers at once. On Shopify, the same scripts often sit outside the store's banner entirely, which the Shopify cookie banner guide explains.
The scripts by name, and what each records
The descriptions below are the ones Suitcast shows next to each finding, drawn from the tracker catalog that also feeds the trackers page.
Meta Pixel reports what visitors do on your site so you can run and measure Facebook and Instagram ads. Complaints describe it sending page views, clicks and sometimes form entries to Meta before the visitor agreed.
TikTok Pixel reports visits, add-to-carts and purchases back to TikTok. Complaints describe it collecting page views and typed information such as email addresses before consent. The TikTok Pixel guide covers TikTok's own consent calls.
Microsoft Clarity records a video-like replay of mouse movements, scrolling, clicks and typing, and builds heatmaps. Clarity is free, which puts it on many small business sites where nobody looks at the recordings.
Hotjar records sessions including mouse movement, scrolling and keystrokes, and turns them into replays and heatmaps. Complaints treat tools like this as the central example of wiretapping a visitor's interaction with the page.
FullStory captures a full replay including what visitors type into forms. Mouseflow, Lucky Orange and Crazy Egg do the same job with heatmaps, and Lucky Orange also bundles a live chat window in the same script.
Intercom Messenger, Drift and LiveChat are chat widgets that store conversations and track page views. Complaints say chat tools like these record and share conversations with the vendor without telling the visitor first. Tidio, Zendesk Chat and Gorgias Chat are in the same group and common on Shopify stores.
Google Analytics 4 counts visits and shows which pages people look at and where they came from. Complaints cite it for sending browsing activity and device details to Google before the visitor was asked. Holding it until a visitor chooses is a setting rather than a rewrite: the Google Analytics 4 consent guide covers basic and advanced consent mode and where each platform sets them.
Google Tag Manager is not a tracker itself. It is the container that loads the others, and complaints name it because it fires those tags the moment a page opens, before any banner is answered. On most sites it is where the real trackers are switched on, and it is where gating happens.
How to gate each category
Gating means the script does not load until the visitor clicks accept, and stays off if they click reject or ignore the banner. The setting lives in a different place on each platform. These paragraphs follow the plain fixes Suitcast shows next to each finding.
Shopify. Turn on the customer privacy banner under Settings, Customer privacy, and keep every app tied to it. The Facebook & Instagram, TikTok, Google & YouTube and Pinterest apps installed from the app store follow the banner; a pixel pasted into theme code does not. Check that Klaviyo, Attentive, Yotpo, Lucky Orange and Gorgias follow it too, in each app's own settings.
WordPress. Place every script through a consent plugin such as Complianz or CookieYes rather than in the theme header or a code snippet plugin. The plugin holds the script until accept and offers a custom script slot for tags it does not know, such as the Microsoft Advertising UET tag or a chat widget.
Google Tag Manager. Open the container, turn on consent mode in the container settings, and give each tag a consent requirement: analytics_storage for analytics tags, ad_storage for ad pixels, and ad_user_data for the Google Ads tag. Without a per-tag requirement, consent mode changes nothing. Delete tags for services you no longer use while you are there.
Session replay tools. Load the script itself only after accept, through the consent plugin or a Google Tag Manager consent trigger. A vendor's own consent setting is usually narrower than it sounds: Microsoft says Clarity keeps collecting without cookies when consent is denied, and Hotjar leaves consent to the site. FullStory can hold capture until a consent call. The session replay guide has the settings for each.
Chat widgets. Load the widget only after accept, and add a line in the greeting that conversations are saved. If nobody staffs the chat, remove the script rather than gating it.
The removal rule. Almost every plain fix in the catalog ends the same way: if you are not running the ads, reviewing the recordings or staffing the chat, remove the script. A script nobody uses is exposure with no return.
Categories compared by what they record and risk level
The risk level is the one the Suitcast tracker catalog assigns to each script. It reflects how complaints describe the category, not a legal conclusion.
| Category | Examples | What it records | Catalog risk |
|---|---|---|---|
| Session replay | Microsoft Clarity, Hotjar, FullStory, Mouseflow, Lucky Orange, Crazy Egg | Mouse movement, scrolling, clicks, keystrokes, a replay of the visit | Critical |
| Ad pixel, social | Meta Pixel, TikTok Pixel | Page views, cart and purchase events, sometimes typed form values | Critical |
| Ad pixel, other | Google Ads, Microsoft UET, LinkedIn, Pinterest, Snap, X, Reddit, Criteo, AdRoll | Page views, conversion events, an advertising identifier | High |
| Chat | Intercom, Drift, LiveChat, Tidio, Zendesk Chat, Gorgias | The conversation, page views, sometimes typed pre-chat fields | High |
| Call tracking | CallRail | The page that led to the call, and the call itself when recording is on | High |
| Analytics | Google Analytics 4, HubSpot, Heap, Mixpanel, Segment, Amplitude | Pages viewed, source, device, an identifier; Heap also captures form changes | Medium |
| Email and SMS marketing | Klaviyo, Mailchimp, Attentive | Products viewed, typed email addresses and phone numbers in pop-ups | Medium |
| Tag container | Google Tag Manager | Nothing itself; loads the others at page open | Medium |
Read the table as an order of operations. Gate or remove the critical rows first, since they carry the wiretap theory. Then the high rows. Then decide whether the medium rows earn their place, which for most small sites means keeping Google Analytics 4 behind consent mode and removing the rest.
Where the counts come from, and why they are floors
The per-script counts on the trackers page come from the text of filed complaints. Suitcast fetches complaint documents from CourtListener for the CIPA cases it tracks, searches the text for each tracker's name and known aliases, and counts the dockets that mention it. The methodology page describes the query and the matching, and the data page carries the coverage note.
That method produces floors, for three reasons. Demand letters are not filings, and most letters settle before a complaint exists, so the largest share of claims never enters the count. Complaint text is not available for every docket, and a docket without text cannot be matched. And complaints often describe a category, session replay software, without naming the vendor, which matches nothing.
So a script with a low count is not a low risk. It may be new, it may be named by category, or it may be the kind of tool a firm mentions in a letter and never in a complaint. The risk levels in the catalog are set from how complaints describe the category, not from the count.
The counts in this guide are as of September 16, 2026, and the trackers page updates daily, so a number here will drift; the window and scope are stated next to every count there. In the 12 months to that date, Google Analytics 4 is named in 166 verified complaints, the Google Ads tag in 161, Meta Pixel in 141, TikTok Pixel in 118 and the LinkedIn Insight Tag in 91. Session replay tools are named far less often, Microsoft Clarity in 10 and Hotjar in 7, but each complaint that names one fits the wiretap theory closely.
The firm counts live on the firms page. In the same window the firms named on the most federal website tracking dockets were Bursor & Fisher with 49, Gutride Safier with 22, Nathan & Associates and Tauler Smith with 17 each, and the Law Offices of Ross Cornell with 10. Suitcast counts 414 verified website tracking filings in that window, and the data page notes that about three in four are filed in California courts against companies located anywhere.
How to check your own site
By hand: open the site in a fresh private window with the browser's network panel recording before the page loads. Do not touch the banner. Every request to a host that is not yours is a script that fired before consent, and the panel shows the time each one fired. Then click reject and reload, and note what still fires. Repeat on a product page and a page with a form, because tags are often scoped to templates.
The free Suitcast scan does the same thing and writes it down. It loads your public pages in a real browser, checks every request against the tracker catalog and records each match with its timing before any click, then clicks reject when the banner offers it, and records again. The report lists what fired before consent and what kept firing after reject, by script name, with the plain fix and where the setting lives.
Two things the scan does that a manual check misses. It records the timing, so the report shows a pixel that fired a fraction of a second after load, before any banner could have rendered. And it is dated, so after you gate or remove scripts, a second scan shows the change with a timestamp, which is the record you want if a letter ever arrives. The scanner policy describes what the scan loads and how to block it.
Limitations
The catalog is 43 trackers. A script not in the catalog is not named in a scan result or a count, and new tools arrive faster than any list. If your site uses a recording or chat tool that is not listed here, treat it by its category, not by its absence.
Counts are floors for the reasons above, and they are federal. CIPA cases filed in California state court are covered only through curated sources, so the picture on the California page and the New York page is partial, and the data page says so next to every number.
The risk levels are descriptive. Critical means complaints describe the category as recording content; it is not a prediction that a given script will draw a letter. A site with only analytics can receive one, and a site with session replay may never hear anything. The scan shows what a complaint would cite; it does not stop anyone from filing, and it does not determine whether any script violates any statute. The not legal advice page says this in full.
Gating changes what fires from now on; it does not change what already fired. If you have already received a letter, read the CIPA demand letter guide first, and if the letter is about accessibility rather than tracking, the ADA website lawsuit letter guide covers that. Owners who want a weekly dated record of what fires can compare plans on the pricing page.
Suitcast identifies risk indicators. It is not legal advice and does not determine compliance.
Last updated September 16, 2026.