Session Replay Tools and CIPA: Is Hotjar, Microsoft Clarity, or FullStory a Legal Risk on Your Site?

Hotjar, Microsoft Clarity, and FullStory are all named in active CIPA lawsuits. They're not illegal. But the way most websites deploy them is. Here's what each tool actually captures, what the 2026 case law says, and the configuration changes that close the gap.

Session replay is one of the most useful tools in a product team's stack. Load Hotjar, Clarity, or FullStory on your site and you can watch exactly what real visitors do — where they hesitate, what they click, where they abandon. For most teams, it goes in on day one of a new project and stays there permanently, quietly recording in the background.

That "quietly recording in the background" is exactly what California's wiretapping law targets. The California Invasion of Privacy Act — a 1967 statute now extensively applied to digital tracking — imposes $5,000 statutory damages per violation, with no proof of harm required. And plaintiff firms have identified session replay as the next major wave after the Meta Pixel: a whole category of tool that most businesses installed for UX insights, that most businesses have never audited for legal risk, and that sends real-time keystroke, mouse-movement, and interaction data to a third-party server whether or not the visitor consented. This article walks through what each of the three most-used tools actually captures, what courts have said, and the specific configuration steps that make the difference between a compliant deployment and a demand letter. One thing throughout: this is informational, not legal advice, and CIPA outcomes are genuinely fact-specific.

What session replay tools actually capture

Before the legal theories, the technical reality. Session replay tools embed a JavaScript snippet in your pages that begins transmitting data to a third-party server from the moment it loads. Depending on configuration, that data stream typically includes:

• Mouse movements — every cursor position change, continuously tracked in real time
• Clicks and taps — which elements were interacted with, coordinates, timestamp
• Keystrokes — what the user types into form fields (masked by default for known sensitive fields in most tools, but the defaults differ significantly between tools)
• Page navigation — URLs visited, time on page, navigation sequence
• Rage clicks and dead clicks — frustration signals the tools detect automatically
• Scroll depth — how far down each page the visitor reached
• Device and browser data — operating system, browser version, viewport size, IP address
• Full session replays — the complete recorded session, playable back from the vendor's dashboard

The phrase "transmitting data to a third-party server" is the critical one legally. The data isn't being stored locally in your browser. It's being sent, in real time, to Hotjar's servers, Microsoft's Azure infrastructure, or FullStory's cloud — third-party entities that are separate legal persons from your website. That's the hook plaintiffs use.

The two CIPA theories against them

Plaintiffs have pursued session replay tools under both of CIPA's main digital-tracking provisions. Both are active in 2026. Both are unsettled. And both can theoretically apply to the same deployment simultaneously.

Theory 1: Wiretapping under § 631(a)

CIPA § 631(a) prohibits intentionally reading or attempting to read the contents of a communication in transit without all-party consent. Plaintiffs argue that when a visitor types into a search field, a form, or a chat box while Hotjar or FullStory is running, the tool captures and transmits those keystrokes to a third party in real time — making the vendor an unauthorized wiretapper reading communications as they occur. The critical word is "in transit." Courts have disagreed significantly on whether session replay data is intercepted during transmission or only after.

The April 2025 Torres v. Prudential Financial ruling (N.D. Cal.) is the most important defendant-friendly precedent: the court granted summary judgment for Prudential, holding that CIPA § 631 requires evidence a party actually read communication contents while genuinely in transit, and that session replay software reassembling data only after transmission does not satisfy this requirement. That ruling has narrowed § 631 liability substantially — but it has not eliminated it, and not all courts have followed it.

Theory 2: Pen register / trap and trace under § 638.51

The newer, more expansive theory treats session replay tools as "pen registers" — devices or processes that capture routing and addressing information (IP addresses, device identifiers, page paths, interaction metadata). CIPA § 638.51 requires a court order to install such a device; plaintiffs argue session replay scripts are installed without one and without valid consent. This theory doesn't require interception "in transit" and is harder to defend against on a motion to dismiss, which is why it has become the plaintiffs' preferred framing.

The 2026 case law: split but clarifying

The case law on session replay and CIPA is genuinely divided, but certain patterns are emerging from the volume of decisions. The split is useful to understand because it tells you where the legal risk concentrates.

Defendant-friendly rulings

Torres v. Prudential Financial (April 2025, N.D. Cal.) — Summary judgment granted. Session replay data reassembled after transmission is not interception "in transit" under § 631. Most significant defendant win to date. Thomas v. Papa John's International (Ninth Circuit, affirmed 2025) — Affirmed dismissal. Papa John's was a party to its own visitors' communications; a party cannot "eavesdrop" on its own conversation. The direct party exception applies. However, the court noted the plaintiff hadn't pleaded the aiding-and-abetting theory against FullStory specifically, and that avenue remains open. Khamooshi v. Politico (October 2025) — § 638.51 pen register claim dismissed for lack of Article III standing; generic metadata didn't create a concrete injury.

Plaintiff-friendly rulings

Noom v. FullStory (reversed) — Court initially found FullStory could be a third-party eavesdropper, focusing on the real-time nature of data capture. Keystrokes received as they occur, not after session concludes, survived as the § 631 aiding-and-abetting theory. Separately, a court found FullStory was acting as Noom's agent and the party exception applied — illustrating how dramatically the outcome turns on vendor configuration and contractual framing. D'Antonio v. CNN (S.D.N.Y.) — Denied motion to dismiss. Court found plaintiff adequately pleaded Article III standing and declined to resolve at pleading stage whether trackers collected content vs. routing data. Balabbo v. Wildflower Brands — Mixed: CIPA claims dismissed, but common law invasion of privacy survived where credit card data and medical information were transmitted to third parties via session replay.

Hotjar: CIPA risk and configuration

Hotjar is a product experience insights platform — session recordings, heatmaps, feedback widgets, surveys, funnels — used by product and marketing teams to understand user behavior. It's one of the most widely deployed session replay tools on the web.

What it captures: Mouse movements, clicks, scroll depth, rage clicks, keystrokes in form fields (masked by default — you must explicitly use data-hj-allow to unmask), page URLs and navigation, device and browser metadata, IP address.

Default masking behavior: Hotjar masks all form inputs by default — a meaningfully more conservative posture than Clarity. You must actively opt fields in to recording using data-hj-allow. Password fields and known sensitive fields are always masked. This reduces keystroke-capture risk but does not eliminate the broader CIPA exposure, which attaches to the data stream itself, not just the keystroke content.

Privacy posture: Hotjar is GDPR and CCPA certified, respects Do Not Track browser signals, and offers consent management integration. It does not honor the Global Privacy Control (GPC) automatically — you must configure this through your CMP.

CIPA-specific risk: Hotjar is named in CIPA complaints and demand letters. The risk is almost entirely concentrated in firing behavior — if the Hotjar script loads and begins transmitting before the visitor has consented, every interaction captured before consent is a potential violation. At $5,000 per violation, a site with meaningful California traffic that ran Hotjar unconsented for 12 months has a large theoretical exposure.

Configuration for CIPA defense: Block the Hotjar script at the CMP level until analytics consent is given. Do not rely on Hotjar's internal consent toggle as a standalone compliance mechanism — the script must not load at all pre-consent, not load and then pause. Exclude checkout pages, account pages, and any page rendering payment data or personal health information.

Microsoft Clarity: CIPA risk and configuration

Microsoft Clarity is the free session replay tool — heatmaps, session recordings, rage click detection, scroll maps, completely free with no session or traffic limits. That combination — zero cost, no limits — has made it a default install for tens of thousands of sites whose teams never thought twice about the compliance implications.

What it captures: Mouse movements, clicks, scroll depth, keystrokes (masked for common PII patterns automatically, but Clarity requires custom configuration for domain-specific sensitive data), page paths and URLs, device and browser data, IP address, full session replays. Clarity also uses the data for Microsoft's own product improvement and industry benchmarking — a use not present in Hotjar's model that adds a purpose-limitation dimension.

Default masking behavior: More permissive defaults than Hotjar. Clarity masks common PII patterns (email, credit card number patterns) automatically but requires explicit configuration for domain-specific sensitive fields. This means out-of-the-box Clarity deployments on eCommerce or healthcare sites can capture more sensitive content than operators realize.

Critical privacy gap — Do Not Track: Unlike Hotjar, Microsoft Clarity does not respect Do Not Track browser settings. And while GPC compliance requires configuration through your CMP, Clarity's default behavior means it will record sessions for users who have expressed a privacy preference in their browser — unless your CMP actively blocks the script. This is a specific, documented compliance gap.

Ninth Circuit ruling: The Ninth Circuit affirmed dismissal of CIPA claims involving Microsoft Clarity specifically in a 2025 ruling, finding the complaint failed to plausibly allege harm or that Clarity's data capture constituted an interception of a "communication" as defined by the statute. That's a favorable precedent — but it reflects the specific facts and standing failures in that complaint, not a categorical clearance for all Clarity deployments. Camplisson v. Adidas (November 2025), conversely, named Microsoft trackers as plausible pen registers.

CIPA-specific risk: Higher than Hotjar for most default deployments due to more permissive masking defaults, the Do Not Track gap, and the Microsoft data-usage model. The "free" price of Clarity comes with data flowing to Microsoft's wider analytics and AI ecosystem — and plaintiffs have argued that this broader data use strengthens the "third-party interceptor" theory.

Configuration for CIPA defense: Block Clarity at the CMP level before consent. Configure strict masking for any domain-specific sensitive fields. Do not deploy on checkout, account, or payment pages. Verify GPC signals propagate to block the script — Clarity will not self-enforce this. Review Microsoft's terms to understand the data-sharing model before deploying on sensitive-audience sites.

FullStory: CIPA risk and configuration

FullStory is the enterprise digital experience platform — session replay, product analytics, frustration signals, error tracking, AI-generated insights. It is more expensive, more configurable, and more powerful than either Hotjar or Clarity, typically deployed by engineering and product teams at mid-market and enterprise companies.

What it captures: Full session replays, click maps, cursor tracking, custom event data, frustration and error signals, form interactions, device and browser metadata. FullStory uses a class-based masking system — elements with the fs-exclude class are not recorded, and it can be configured to mask all text by default with selective unmasking using fs-unmask. This provides more granular control than the other two tools but requires developer effort to configure correctly.

Enterprise configuration advantage: FullStory offers HIPAA Business Associate Agreements (BAAs) for healthcare customers — a capability Hotjar and Clarity lack. It also offers configurable field-level masking through its SDK. But this advantage is configuration-dependent: a default FullStory deployment without careful masking and consent gating carries the same CIPA risk as any other unconsented session replay tool.

CIPA case law specifically: FullStory appears in more CIPA case law than any other session replay vendor. The Nike FullStory case found FullStory could plausibly be a third-party eavesdropper when recording keystrokes in real time. The Noom v. FullStory litigation produced split outcomes on the party-exception question — illustrating how vendor configuration and the contractual relationship between FullStory and the site operator significantly affect whether the party exception applies. In Thomas v. Papa John's, the Ninth Circuit affirmed dismissal on the direct party exception, but explicitly noted the aiding-and-abetting theory against FullStory specifically was not pleaded — leaving that avenue open for future plaintiffs.

Configuration for CIPA defense: Block FullStory at the CMP level before consent. Use the SDK's masking capabilities aggressively, especially on authenticated pages. Restrict recording to specific pages under active UX investigation rather than deploying site-wide. Turn off recording on checkout, payment, account, and any page rendering sensitive data. Review and understand whether your vendor agreement characterizes FullStory as an agent of your site (strengthening the party exception) or an independent third party.

How all three compare on CIPA-relevant defaults

The critical insight from this table: on every GPC row, the answer is "via CMP only." Not a single one of these tools self-enforces GPC without your CMP blocking the script. The entire CIPA defense for session replay is in your CMP configuration, not in the tool's own privacy settings.

The pages that make the scan a demand letter

Plaintiff firms systematically scan for a specific pattern: session replay firing before consent on a page that includes form inputs or personal data. Not all pages are equal risk. The pages that generate demand letters most reliably:

• Checkout pages — name, address, card number in form fields, with session replay capturing keystrokes and the vendor receiving payment-adjacent data. The highest-risk pattern in eCommerce.
• Sign-in and account pages — identified user, behavioral data, email addresses in form fields. The CIPA exposure is stronger when the captured data is linkable to a specific person.
• Contact and lead forms — names, email addresses, phone numbers typed into form fields while session replay is active.
• Search fields on sensitive sites — on healthcare, financial, or legal sites, what a user searches for is itself sensitive. Session replay capturing that search query and transmitting it to a third party has been a named exposure in multiple cases.

How to keep using them safely

The goal is not to remove session replay — it's to deploy it in a way that the automated scan finds nothing to flag. The technical steps that achieve this:

• Block the script at the CMP level before consent — genuinely. The session replay script must not load, not merely pause, until the visitor explicitly consents. A CMP that displays a banner while the script loads in the background is the exact pattern that generates demand letters. The script should not be in your page source at all until consent is recorded.
• Assign it to the correct consent category. Session replay is analytics at minimum; some counsel classify it as "marketing" given the behavioral profiling it enables. Whichever category you use, it must require opt-in, and the banner must clearly disclose that behavioral recording is included in that category.
• Exclude checkout, payment, account, and sensitive pages explicitly. Even with consent in place, remove the script from these pages via your tag manager configuration. The consent is granted for one context; a consumer consenting to "analytics cookies" likely did not understand they were consenting to keystroke recording on a payment page.
• Enable aggressive masking. For Clarity, add custom masking for all sensitive fields on your domain. For FullStory, configure the SDK's masking classes. For Hotjar, confirm no fields are using data-hj-allow on sensitive pages.
• Verify GPC propagation. Test with a GPC-enabled browser (Brave or Firefox with the GPC extension). The session replay script should not load at all when GPC is detected. If it does, your CMP is not propagating GPC correctly.
• Keep verifiable consent records. Your records should show that for each session where replay ran, consent was obtained before the script loaded, with a timestamp.
• Turn it off when you're not actively using it. Many sites have session replay running on every page indefinitely, recording sessions nobody ever watches. Limit recording to pages under active investigation and disable globally when there's no open UX question. The smaller the recording footprint, the smaller the exposure.

Frequently asked questions