The risk behind tracking before consent
Why pixels, chat widgets and session-replay tools that fire before a visitor says yes have become a legal target — in plain English.
The laws behind these claims
CIPA § 631 — Wiretapping Active
Claims that a third party (a chat vendor, session-replay tool or ad pixel) "listened in" on a visitor's communication with your site without consent. Private lawsuits are still allowed.
CIPA § 637.2 — Damages Active
Lets a person sue for $5,000 per violation or three times actual damages, whichever is greater. No proof of actual harm is required.
CIPA § 638.51 — "Pen register" Changed
Claims that trackers capturing IP addresses act as a "pen register." SB 690, signed September 30, 2026, provides that from January 1, 2027 only the California Attorney General — not private plaintiffs — can bring these claims over website or app tracking. Wiretapping claims are not affected.
Other states & federal law Active
Similar claims are brought under Pennsylvania's wiretap law (WESCA) — especially for session replay — and under the federal Video Privacy Protection Act (VPPA) when pages with video share viewing data through a pixel.
Which tools draw the most claims
Session replay
Microsoft Clarity, Hotjar, FullStory and similar tools record clicks, scrolling and typing.
Chat widgets
Messages typed into a third-party chat are a common basis for wiretapping claims.
Advertising pixels
Meta, TikTok, Google Ads, Pinterest, LinkedIn and others send page visits and identifiers to ad platforms.
Analytics & tag managers
Lower risk on their own, but often listed in demand letters — and tag managers can load the high-risk tools above.
Real cases
| Case | What was alleged | Outcome |
|---|---|---|
| Sutter Health California, 2026 | Google Analytics and Meta Pixel on its websites sent patient browsing data to third parties. | $21.5 million class settlement (no admission of wrongdoing). |
| Los Angeles Times California, 2026 | Website trackers acted as a "pen register" under CIPA. | $3.85 million settlement reported (approved June 2026). |
| Popa v. Harriet Carter Gifts 3rd Circuit, 2022 | Session-replay software on an online store recorded visitors' activity. | Court allowed the wiretapping claim to proceed, triggering a wave of session-replay suits. |
| VPPA "Meta Pixel" cases Federal courts, 2025–2026 | Pixels shared which videos a visitor watched, linked to their Facebook ID. | Courts are split; the U.S. Supreme Court agreed to review a related case. |
What a claim can cost a small business
Demand letter
Pre-lawsuit settlement demands are commonly reported in the $10,000 – $40,000 range, usually with a 20–30 day deadline.
Lawsuit defense
Defending a case in court has been reported to cost well over $100,000 in legal fees — even when the business wins.
Class action
Statutory damages multiply per visitor. Reported website-tracking class settlements range from about $1 million to over $20 million.
Hidden costs
Time lost, emergency developer fees, insurance deductibles, and the reputational hit of a public privacy lawsuit.
Figures are ranges reported by law firms and industry sources; actual outcomes vary widely.
What reduces the risk
The common technical fix is straightforward: a consent banner that is actually shown to U.S. visitors, configured so that ad pixels, chat and session-replay tools wait until the visitor accepts, plus regular checks so new tools don't slip back in. That removes the pattern most claims rely on. It does not make anyone immune from claims.
Sources
- California Penal Code § 637.2 — california.public.law
- SB 690 (2026) — Mayer Brown, WilmerHale
- Sutter Health settlement — ClassAction.org
- Pen register litigation & LA Times settlement — Holland & Knight, Privacy World
- Session replay (Popa) — ZwillGen
- VPPA & Meta Pixel — Bloomberg Law
- Demand letter amounts — Ketch, pii.ai