Home › Guides › Session replay and chat
Session replay and chat widgets: the wiretapping risk
In short: session-replay tools record what visitors do on your pages, and chat widgets pass what they type to a vendor. Wiretapping laws are about third parties capturing communications without consent — so these tools are among the highest-risk items a scan can find. Keep them, but load them only after "Accept".
Why these tools are treated as "high risk"
Most tracking claims are about who heard the conversation. A visitor thinks they're interacting with your business, but a third-party vendor is capturing it in real time:
- Session replay — Microsoft Clarity, Hotjar, FullStory, LogRocket, Mouseflow, Lucky Orange — records clicks, mouse movement, scrolling and sometimes keystrokes, so you can "watch" a visit later.
- Chat widgets — Intercom, Drift, Tidio, Zendesk, HubSpot chat, Facebook Messenger plugins — send typed messages to the vendor's servers.
Under CIPA § 631, plaintiffs argue the vendor "eavesdropped" without consent. After Popa v. Harriet Carter Gifts (3rd Circuit, 2022) let a session-replay claim proceed under Pennsylvania's wiretap law (WESCA), a wave of similar suits followed. SB 690 in California does not change § 631 wiretapping claims.
Signs your site has one
- Network requests to
clarity.ms,hotjar.com,fullstory.com,mouseflow.comorluckyorange.com. - A chat bubble in the corner that loads on every page, even before anyone clicks it.
- Plugins or apps you installed for "heatmaps" or "visitor recordings" — often forgotten after a test.
Our free scan flags all of these in red when they load before consent.
How to keep them — safely
Session replay
- Load the tool only after the visitor accepts analytics or "statistics" cookies in your banner.
- Turn on input masking so form fields are never recorded.
- Exclude sensitive pages (checkout, account, health or financial forms).
- If nobody watches the recordings, remove the tool — it's risk with no benefit.
Chat widgets
- Show a static chat button and load the vendor's script only when the visitor clicks it.
- Add a short notice in the chat window: messages are handled by a service provider, with a link to your privacy policy.
- Or load the widget only after consent through your banner.
Is a recorder or chat loading before consent?
Find out free in 15 seconds. We can set them to wait for $149 and prove it with a re-scan.
Common questions
Is Microsoft Clarity safe because it's free and from Microsoft?
Who makes the tool doesn't change the pattern. Clarity records sessions like other replay tools, and it's commonly listed in demand letters. Load it after consent and use masking.
Does masking make session replay safe to load before consent?
Masking reduces what's captured, but the tool still records the session. The safer setup is masking plus loading only after consent.
We only use chat for support. Is that still a risk?
The claims focus on the vendor receiving messages, not your intent. Loading the chat on click, with a short notice, keeps support working while removing the "before consent" pattern. Not legal advice.