Are Session Replay Tools Legal? The Wiretapping Lawsuit Wave
Session replay tools aren't illegal, but the way many teams deploy them can expose you to a wiretapping lawsuit. The short answer, if you deploy replay in the US: whether you get sued turns almost entirely on two things a court can check without ever watching a single recording. Did you record before the visitor consented? And did you capture anything sensitive without masking it? Get those two wrong and you're a target. Get them right and most of the current case law is on your side.
I watch replays for a living, so let me set the scene the way a plaintiff's attorney does.
Watch what happens at 0:14
Open a recorded checkout session. At 0:04 the visitor lands on the page. At 0:09 she starts filling the form. At 0:14 her cursor moves to the card field and she types sixteen digits. If your replay tool captured those keystrokes as plain characters, streamed them to a vendor's servers, and did it all before a consent banner ever appeared, then that eight-second clip is the entire complaint. No creativity required. That's the demand letter.
Now play the same session with masking on. The card field renders as a row of dots. The tool recorded that a field was focused and filled, not the number inside it. Same UX insight for me. Nothing readable for a lawyer. Same feature, completely different legal posture, and the only difference is a config flag most teams never touched.
That gap between "we turned it on" and "we configured it" is where the lawsuits live.
Why a 60-year-old wiretap law is the weapon
Most of the noise comes from California's Invasion of Privacy Act, CIPA, a statute written in 1967 for phone taps. Plaintiffs' firms rediscovered it because it carries statutory damages of $5,000 per violation with no need to prove actual harm. Multiply that by every visitor in a class and the math gets scary fast.
The volume is not hypothetical. OneTrust reported more than 800 CIPA claims filed in 2025 alone, with individual demand letters typically landing between $15,000 and $40,000. Those are settlement-shakedown numbers by design: cheap enough to pay, expensive enough to hurt, and priced to make litigation the more painful option. The firms send them in batches.
Two CIPA sections do the work. Section 631 is the classic wiretap claim: someone read the "contents" of a communication in transit without consent. Section 638.51 is the "pen register / trap and trace" theory, borrowed from the law on capturing dialed phone numbers, now stretched to cover tracking that logs who you are and what you did. Plaintiffs increasingly plead both at once, and stack the federal Electronic Communications Privacy Act on top, so that if one theory gets tossed the others survive.
The pen-register angle is its own mess. Some California state judges have decided the trap-and-trace framing doesn't fit web tracking at all, reasoning that the newer CCPA and CPRA are the right home for those disputes. Plenty of federal district judges disagree and treat pixels and similar tags as pen registers. The Covington roundup lays out that division in detail, and the practical takeaway is blunt: the same conduct can be legal or not depending on which court hears it. That's not a stable place to build a data pipeline on.
I'm a UX researcher, not your lawyer, and nothing here is legal advice. But you don't need a JD to see the pattern in the rulings.
The case law is genuinely split, and that matters
Here's the uncomfortable truth for anyone who wants a clean yes-or-no: courts disagree with each other, sometimes in the same week. A Covington roundup of 2025 website-wiretapping decisions reads like two different bodies of law wearing the same statute.
Watch how far apart these landed.
| Case | Court / date | What happened | Why |
|---|---|---|---|
| Torres v. Prudential | CA federal, Apr 2025 | Defense won on summary judgment | Replay events "do not become readable content until after they are stored and reassembled," so nothing was read in transit |
| Mikulsky v. Bloomingdale's | 9th Cir., Jun 20 2025 | Dismissal reversed, case revived | Complaint plausibly alleged replay captured the contents of interactions, not just metadata |
| Papa John's | 9th Cir., 2025 | Dismissal affirmed | A party to a conversation can't "eavesdrop" on its own conversation |
| In re BPS Direct / Cabela's | 3rd Cir., May 11 2026 | Plaintiffs cleared standing | Captured payment-card data was enough for Article III injury, splitting from the 9th Circuit |
Look at Torres and Mikulsky together. Same technology, same statute, two months apart, opposite outcomes. In Torres v. Prudential the court leaned on a technical fact: session replay reconstructs the session after events are stored, so the vendor never "reads" content while it's moving across the wire. Defense-friendly, and grounded in how the plumbing actually works.
Then the Ninth Circuit went the other way. In Mikulsky v. Bloomingdale's, decided June 20, 2025, the court reversed a dismissal and said the plaintiff had plausibly alleged the software didn't just log metadata like page URLs, it captured the content of what the user typed and did. That distinction, metadata versus content, is now the whole ballgame under Section 631.
The split went appellate in 2026. Loeb & Loeb flagged that on May 11, 2026 the Third Circuit in In re BPS Direct / Cabela's held that plaintiffs whose card data was scooped up by replay code had a real, concrete injury for Article III standing, the exact kind of allegation the Ninth Circuit had been tossing on standing grounds. When two federal appeals courts disagree that openly, it usually means the Supreme Court eventually has to weigh in. Until then, your exposure depends partly on which courthouse the plaintiff picks.
If you're waiting for the law to settle before you clean up your setup, I'd stop waiting. The one thing every one of these cases has in common: the sympathetic plaintiff is the one whose sensitive data got recorded without a clear chance to say no.
What the winners did differently
Strip away the doctrine and the defensible deployments share a short list of habits. None of them are exotic. Most are a Tuesday afternoon of config work.
The party-to-the-conversation defense, the one that saved Papa John's, works best when you run the replay yourself rather than piping raw content to a third party that can use it for its own purposes. Courts are far more comfortable with a site recording its own visitors than with a vendor sitting in the middle reading the mail. So the architecture question ("who actually receives the keystrokes, and can they reuse them?") isn't just plumbing. It's a legal fact.
Masking is the other big one, and it's the cheapest insurance you'll ever buy. Loeb & Loeb's guide to session-replay legal risk and Sentry's replay privacy docs say the same thing in different words: passwords must be masked by default, and payment, government-ID, and health fields should be redacted before the data ever leaves the browser. If your tool ships a recording of a credit card number, you built the plaintiff's exhibit for them.
I'll say the quiet part plainly. Almost every horror-story clip I've watched involved a field nobody thought to mask: a coupon box that people paste emails into, a "notes" field on a medical intake form, a free-text search where someone typed their full name. Masking known-sensitive inputs is table stakes. Masking the unexpected ones is what separates careful teams from defendants.
Consent: the trap that catches everyone
Here's the failure mode I see most, and it's almost always accidental.
The recording script loads on page one, before the cookie banner resolves, and starts capturing immediately. The visitor hasn't clicked anything. Maybe they'll reject analytics. Maybe their browser is already sending a Global Privacy Control signal that legally means "no." Doesn't matter, because you already recorded them. That pre-consent window, often just a few seconds, is where a huge share of 2026's pixel and replay claims are being manufactured. Plaintiffs' firms literally load your site in a browser with GPC on and watch whether your tags fire anyway.
So the rule the compliance-minded tools converge on: the replay script must not run in pre-consent, reject, or GPC states. Not "records but discards later." Doesn't fire at all until you have a lawful basis. In GDPR terms that means an affirmative opt-in before any capture; in the CIPA world it means a defensible record that the visitor agreed, or that you're a party recording your own site with adequate disclosure. The banner has to gate the script, not just decorate the page.
A quick reality check on where this bites hardest:
- EU/UK visitors need prior, affirmative consent under GDPR/ePrivacy. Legitimate interest is a weak footing for keystroke-level recording, and regulators have said so.
- California is the CIPA hotspot, but the theories are spreading. Similar wiretap statutes exist in states like Pennsylvania, Florida, and Illinois, and firms are testing them.
- Everywhere you should honor GPC as a legally meaningful opt-out. Several state laws already treat it as one, and ignoring it is the kind of fact that reads badly to a judge.
The plain-language compliance checklist
This is the do / don't I'd hand a team standing up replay tomorrow. It's not legal advice, it's the pattern the defensible deployments follow. Run it top to bottom before you ship.
Do:
- Gate the script on consent. No firing before opt-in, on reject, or when GPC is present. Test it by loading your own site with GPC enabled and confirming nothing captures.
- Mask by default, then widen. Passwords, card fields, and ID/health inputs masked out of the box. Then add every free-text and "notes" field you've got, because those catch the accidental PII.
- Keep recordings first-party where you can. Prefer a setup where the site controls the data rather than handing raw content to a third party free to reuse it. Sign a real DPA with any vendor.
- Disclose specifically. Your privacy policy should say, in plain words, that interactions including clicks, keystrokes, and scrolls may be recorded, name the vendor, and state why.
- Set a short retention window. Thirty to ninety days covers most support and UX use cases. Auto-delete, and verify it actually deletes.
- Keep proof. Consent logs, a record of when masking config changed, screenshots of the banner behavior. If a demand letter arrives, your defense is evidence, not vibes.
Don't:
- Record on high-sensitivity pages (checkout, medical intake, account settings) without extra masking scrutiny.
- Assume a tool is safe because it's popular. Defaults vary wildly, and several capture more than you'd guess until you check the network tab.
- Treat a cookie banner as consent if the script already fired underneath it. Courts and I both can see the tag timing.
- Ship the vendor's default config to production and call it done.
Most modern replay platforms give you the controls to satisfy this list. Kixo, for one, ships default masking and a programmatic opt-out alongside its web and native replay, which is the baseline you want, though the burden of configuring consent gating correctly still sits with you regardless of vendor.
So, are they legal?
Yes, with an asterisk the size of a demand letter. Session replay is a legitimate, boring UX tool when it's masked, consented, and disclosed. It becomes a lawsuit when it quietly records sensitive content from people who never got a real chance to opt out. The technology didn't change between the winning cases and the losing ones. The configuration did.
The law will keep wobbling. We've now got a genuine circuit split, state and federal courts reading the same statute differently, and plaintiffs' firms stacking three theories per complaint to survive any single dismissal. None of that uncertainty helps you, and none of it is a reason to freeze. The teams getting sued in 2026 mostly aren't the ones with an unsettled legal question. They're the ones who never opened the masking settings.
If you want a deeper vocabulary for the signals behind all this, our behavior analytics glossary unpacks the terms. But for the legal exposure specifically, the whole game is those two questions from the top. Did you record before consent? Did you capture something sensitive unmasked? Answer both correctly and you've handled the part that actually gets litigated.
This article is general information, not legal advice. Talk to privacy counsel about your specific deployment, especially if you operate in California or the EU.