CIPA lawsuits over pixels, session replay and chat widgets

Section 631 of the Penal Code is a wiretap provision. Among other things, it covers anyone who, “without the consent of all parties to the communication”, reads or attempts “to learn the contents or meaning” of a message “while the same is in transit” (Cal. Penal Code § 631(a)). Plaintiffs argue that a third-party script on a website does exactly that when it captures what a visitor types or clicks on the way to the business.

Section 638.51 concerns pen registers and trap and trace devices — tools that record who communicates with whom, not what is said. It provides that “a person may not install or use a pen register or a trap and trace device without first obtaining a court order” (Cal. Penal Code § 638.51(a)). Plaintiffs argue that tracking scripts collecting visitors’ IP addresses and device details fall under it.

Sources: Cal. Penal Code § 631 · Cal. Penal Code § 638.51

• Session replay: scripts that record clicks, scrolling and typing so the session can be played back later.
• Chat widgets: visitors’ messages pass through the chat provider’s servers on their way to the business.
• Pixels and tags that receive what visitors enter in forms or search fields, or the address of the page they are reading.
• Tracking scripts that collect IP addresses and device identifiers, the basis of most § 638.51 claims.

None of these tools is unlawful as such. The claims turn on who receives the data, what they may do with it, and whether the visitor agreed beforehand.

These provisions use the language of telephone surveillance, and courts are still working out how they apply to websites. Different courts have reached different results on similar facts, and decisions continue to change the picture. Questions that typically matter include:

• Whether the vendor only provides a tool for the business or can also use the data for its own purposes.
• Whether what was captured is the content of a communication — such as typed text — or only information about it.
• Whether, when and how the visitor consented before the tool started recording.
• Whether the business disclosed the tool clearly enough, and where.

That is why a scan can show that a session replay tool runs before any consent choice, but not whether a lawsuit about it would succeed.

• An inventory of third-party scripts, especially on pages with forms, search, chat and checkout.
• Consent before recording: session replay and similar tools start only after the visitor agrees, and the consent banner actually holds them back until then.
• Masking: session replay set to hide what visitors type into form fields.
• Vendor contracts: terms that bar the vendor from using what visitors type or do for its own purposes. This lowers the risk; it does not remove it.
• Disclosure where it matters: a short notice next to the chat window, and an accurate description of these tools in the privacy policy.
• Advice from an attorney licensed in California, since the case law keeps moving.

CIPA is a separate law. It is not limited to businesses above the CCPA’s revenue or data thresholds, and honoring Global Privacy Control does not by itself address it: the CCPA concerns the right to opt out of sale and sharing, while the CIPA claims concern consent to the recording itself. A site can do well on one and still carry risk on the other.

Sources: CCPA, Cal. Civ. Code § 1798.100 ff. (CPPA) · Cal. Penal Code § 631