Why do tracking scripts lead to lawsuits?

Complaints under the California Invasion of Privacy Act argue that a script which records what a visitor does, before the visitor agrees, is eavesdropping or a pen register. The statute allows $5,000 per violation, so firms look for pixels, session replay and chat tools that load the moment a page opens.

Is it illegal to use Google Analytics or the Meta Pixel?

No. The complaints target when a script runs, not the script itself. Loading it only after a visitor accepts in a consent banner, or removing it when it is unused, removes the pattern the complaints describe. Whether a specific setup is lawful is a question for a lawyer.

How does Suitcast know which scripts fire before consent?

The scanner opens your public pages in a real browser without clicking anything and checks every request that leaves the page against this catalog, recording each match. When a banner has a reject button, it clicks it and records which scripts keep firing.

What does the risk level mean?

It reflects what the script collects and how often scripts of its kind appear in complaints. Session replay and chat tools that capture typing, and the Meta and TikTok pixels, are critical. Other advertising pixels are high. Analytics, testing and email scripts are medium.

Tracking scripts

Tracking scripts named in website privacy lawsuits

Privacy complaints name specific scripts: ad pixels, session replay and chat tools that run before a visitor agrees. Find the ones on your site and the fix for each.

43 scripts the scanner recognizes, by risk

Critical12 scripts
High18 scripts
Medium13 scripts

Risk reflects what a script records and how often scripts like it appear in complaints.

The short answer

The Suitcast scanner recognizes 43 tracking scripts by the requests they make: 12 rated critical, 18 high and 13 medium under the California Invasion of Privacy Act, CIPA. 19 of them are named in verified complaints from the last 12 months. Session replay tools, chat widgets that capture typing, and the Meta and TikTok pixels carry the most risk. Each page explains what the script records and how to stop it firing before consent.

By type

8 kinds of script, ordered by risk

Scripts of the same kind record the same things and take the same fix. Open any script for the steps on Shopify, WordPress and Google Tag Manager.

Advertising pixel
13 scripts
Up to critical risk
Session replay
10 scripts
Up to critical risk
Chat widget
6 scripts
Up to high risk
Call tracking
1 script
Up to high risk
- CallRail
Analytics
6 scripts
Up to medium risk
Email marketing
3 scripts
Up to medium risk
A/B testing
2 scripts
Up to medium risk
- Optimizely Web Experimentation
- VWO
Other tracking
2 scripts
Up to medium risk
- Google Tag Manager
- Yotpo

Full catalog

All 43 scripts

Sorted by complaints naming each script in the last 12 months, then by risk.

Google Analytics 4
Vendor
Google
Type
Analytics
CIPA risk
Medium
Complaints, 12 months
10
TikTok Pixel
Vendor
TikTok
Type
Advertising pixel
CIPA risk
Critical
Complaints, 12 months
7
Google Ads conversion and remarketing tag
Vendor
Google
Type
Advertising pixel
CIPA risk
High
Complaints, 12 months
7
Meta Pixel
Vendor
Meta (Facebook and Instagram)
Type
Advertising pixel
CIPA risk
Critical
Complaints, 12 months
6
LinkedIn Insight Tag
Vendor
LinkedIn (Microsoft)
Type
Advertising pixel
CIPA risk
High
Complaints, 12 months
3
Microsoft Advertising UET tag
Vendor
Microsoft
Type
Advertising pixel
CIPA risk
High
Complaints, 12 months
3
Pinterest Tag
Vendor
Pinterest
Type
Advertising pixel
CIPA risk
High
Complaints, 12 months
3
Reddit Pixel
Vendor
Reddit
Type
Advertising pixel
CIPA risk
High
Complaints, 12 months
3
Contentsquare
Vendor
Contentsquare
Type
Session replay
CIPA risk
Critical
Complaints, 12 months
2
Hotjar
Vendor
Hotjar (Contentsquare)
Type
Session replay
CIPA risk
Critical
Complaints, 12 months
2
Google Tag Manager
Vendor
Google
Type
Other tracking
CIPA risk
Medium
Complaints, 12 months
2
HubSpot tracking code
Vendor
HubSpot
Type
Analytics
CIPA risk
Medium
Complaints, 12 months
2
Microsoft Clarity
Vendor
Microsoft
Type
Session replay
CIPA risk
Critical
Complaints, 12 months
1
AdRoll
Vendor
AdRoll (NextRoll)
Type
Advertising pixel
CIPA risk
High
Complaints, 12 months
1
Criteo OneTag
Vendor
Criteo
Type
Advertising pixel
CIPA risk
High
Complaints, 12 months
1
Snap Pixel
Vendor
Snap Inc.
Type
Advertising pixel
CIPA risk
High
Complaints, 12 months
1
Taboola Pixel
Vendor
Taboola
Type
Advertising pixel
CIPA risk
High
Complaints, 12 months
1
X (Twitter) Pixel
Vendor
X Corp.
Type
Advertising pixel
CIPA risk
High
Complaints, 12 months
1
Amplitude
Vendor
Amplitude
Type
Analytics
CIPA risk
Medium
Complaints, 12 months
1
Crazy Egg
Vendor
Crazy Egg
Type
Session replay
CIPA risk
Critical
Complaints, 12 months
0
FullStory
Vendor
FullStory
Type
Session replay
CIPA risk
Critical
Complaints, 12 months
0
LogRocket
Vendor
LogRocket
Type
Session replay
CIPA risk
Critical
Complaints, 12 months
0
Lucky Orange
Vendor
Lucky Orange
Type
Session replay
CIPA risk
Critical
Complaints, 12 months
0
Mouseflow
Vendor
Mouseflow
Type
Session replay
CIPA risk
Critical
Complaints, 12 months
0
Quantum Metric
Vendor
Quantum Metric
Type
Session replay
CIPA risk
Critical
Complaints, 12 months
0
Smartlook
Vendor
Smartlook (Cisco)
Type
Session replay
CIPA risk
Critical
Complaints, 12 months
0
CallRail
Vendor
CallRail
Type
Call tracking
CIPA risk
High
Complaints, 12 months
0
Drift
Vendor
Drift (Salesloft)
Type
Chat widget
CIPA risk
High
Complaints, 12 months
0
Gorgias Chat
Vendor
Gorgias
Type
Chat widget
CIPA risk
High
Complaints, 12 months
0
Intercom Messenger
Vendor
Intercom
Type
Chat widget
CIPA risk
High
Complaints, 12 months
0
LiveChat
Vendor
Text (LiveChat)
Type
Chat widget
CIPA risk
High
Complaints, 12 months
0
Outbrain Pixel
Vendor
Outbrain
Type
Advertising pixel
CIPA risk
High
Complaints, 12 months
0
Tidio
Vendor
Tidio
Type
Chat widget
CIPA risk
High
Complaints, 12 months
0
Zendesk Chat (Zopim)
Vendor
Zendesk
Type
Chat widget
CIPA risk
High
Complaints, 12 months
0
Attentive
Vendor
Attentive Mobile
Type
Email marketing
CIPA risk
Medium
Complaints, 12 months
0
Heap
Vendor
Heap (Contentsquare)
Type
Analytics
CIPA risk
Medium
Complaints, 12 months
0
Klaviyo onsite tracking
Vendor
Klaviyo
Type
Email marketing
CIPA risk
Medium
Complaints, 12 months
0
Mailchimp site tracking
Vendor
Intuit Mailchimp
Type
Email marketing
CIPA risk
Medium
Complaints, 12 months
0
Mixpanel
Vendor
Mixpanel
Type
Analytics
CIPA risk
Medium
Complaints, 12 months
0
Optimizely Web Experimentation
Vendor
Optimizely
Type
A/B testing
CIPA risk
Medium
Complaints, 12 months
0
Segment
Vendor
Twilio Segment
Type
Analytics
CIPA risk
Medium
Complaints, 12 months
0
VWO
Vendor
Wingify (VWO)
Type
A/B testing
CIPA risk
Medium
Complaints, 12 months
0
Yotpo
Vendor
Yotpo
Type
Other tracking
CIPA risk
Medium
Complaints, 12 months
0

Tracking scripts recognized by the Suitcast scanner
Script	Vendor	Type	CIPA risk	Complaints, 12 months
Google Analytics 4	Google	Analytics	Medium	10
TikTok Pixel	TikTok	Advertising pixel	Critical	7
Google Ads conversion and remarketing tag	Google	Advertising pixel	High	7
Meta Pixel	Meta (Facebook and Instagram)	Advertising pixel	Critical	6
LinkedIn Insight Tag	LinkedIn (Microsoft)	Advertising pixel	High	3
Microsoft Advertising UET tag	Microsoft	Advertising pixel	High	3
Pinterest Tag	Pinterest	Advertising pixel	High	3
Reddit Pixel	Reddit	Advertising pixel	High	3
Contentsquare	Contentsquare	Session replay	Critical	2
Hotjar	Hotjar (Contentsquare)	Session replay	Critical	2
Google Tag Manager	Google	Other tracking	Medium	2
HubSpot tracking code	HubSpot	Analytics	Medium	2
Microsoft Clarity	Microsoft	Session replay	Critical	1
AdRoll	AdRoll (NextRoll)	Advertising pixel	High	1
Criteo OneTag	Criteo	Advertising pixel	High	1
Snap Pixel	Snap Inc.	Advertising pixel	High	1
Taboola Pixel	Taboola	Advertising pixel	High	1
X (Twitter) Pixel	X Corp.	Advertising pixel	High	1
Amplitude	Amplitude	Analytics	Medium	1
Crazy Egg	Crazy Egg	Session replay	Critical	0
FullStory	FullStory	Session replay	Critical	0
LogRocket	LogRocket	Session replay	Critical	0
Lucky Orange	Lucky Orange	Session replay	Critical	0
Mouseflow	Mouseflow	Session replay	Critical	0
Quantum Metric	Quantum Metric	Session replay	Critical	0
Smartlook	Smartlook (Cisco)	Session replay	Critical	0
CallRail	CallRail	Call tracking	High	0
Drift	Drift (Salesloft)	Chat widget	High	0
Gorgias Chat	Gorgias	Chat widget	High	0
Intercom Messenger	Intercom	Chat widget	High	0
LiveChat	Text (LiveChat)	Chat widget	High	0
Outbrain Pixel	Outbrain	Advertising pixel	High	0
Tidio	Tidio	Chat widget	High	0
Zendesk Chat (Zopim)	Zendesk	Chat widget	High	0
Attentive	Attentive Mobile	Email marketing	Medium	0
Heap	Heap (Contentsquare)	Analytics	Medium	0
Klaviyo onsite tracking	Klaviyo	Email marketing	Medium	0
Mailchimp site tracking	Intuit Mailchimp	Email marketing	Medium	0
Mixpanel	Mixpanel	Analytics	Medium	0
Optimizely Web Experimentation	Optimizely	A/B testing	Medium	0
Segment	Twilio Segment	Analytics	Medium	0
VWO	Wingify (VWO)	A/B testing	Medium	0
Yotpo	Yotpo	Other tracking	Medium	0

Questions owners ask

Why scripts lead to lawsuits, and what the scanner checks.

Why do tracking scripts lead to lawsuits?: Complaints under the California Invasion of Privacy Act argue that a script which records what a visitor does, before the visitor agrees, is eavesdropping or a pen register. The statute allows $5,000 per violation, so firms look for pixels, session replay and chat tools that load the moment a page opens.
Is it illegal to use Google Analytics or the Meta Pixel?: No. The complaints target when a script runs, not the script itself. Loading it only after a visitor accepts in a consent banner, or removing it when it is unused, removes the pattern the complaints describe. Whether a specific setup is lawful is a question for a lawyer.
How does Suitcast know which scripts fire before consent?: The scanner opens your public pages in a real browser without clicking anything and checks every request that leaves the page against this catalog, recording each match. When a banner has a reject button, it clicks it and records which scripts keep firing.
What does the risk level mean?: It reflects what the script collects and how often scripts of its kind appear in complaints. Session replay and chat tools that capture typing, and the Meta and TikTok pixels, are critical. Other advertising pixels are high. Analytics, testing and email scripts are medium.

Keep going

Which of these fire on your site before consent?

The free scan checks every request your pages make before the banner is answered against this catalog, with the millisecond each one fired.

Suitcast identifies risk indicators. It is not legal advice and does not determine compliance.

Tracking scripts named in website privacy lawsuits

8 kinds of script, ordered by risk

Advertising pixel

Session replay

Chat widget

Call tracking

Analytics

Email marketing

A/B testing

Other tracking

All 43 scripts

Questions owners ask

Keep going

Which of these fire on your site before consent?