The tools that record what a visitor does, and the claims that follow

What it is

Session replay tools record a visitor interactions with a page, including mouse movement, scrolling and keystrokes, and send them to a vendor for playback. Chat widgets often route conversations through a third party too. A substantial volume of litigation argues that doing either without consent is interception of a communication under state wiretap law.

Does it apply to you

• Your site runs a session recording or heatmap tool.
• Your site runs a third-party chat widget where the vendor receives the conversation.
• You run certain analytics or advertising pixels that capture form interactions, which have attracted the same theory.

What being wrong costs

The California Invasion of Privacy Act is the statute most often invoked, and it provides a private right of action with statutory damages, which is what makes these claims economic to bring at volume. Courts have divided on whether and when these theories succeed, and the law is genuinely unsettled. What is not unsettled is that receiving a demand is common and that defending one is expensive regardless of outcome.

What it demands

• In practice: knowing what is running on your pages, disclosing it accurately, and obtaining consent before it runs where consent is the safer position.
• Being able to show what a given visitor was told and what they agreed to, at the time they visited.

What WebSpark does

• No session recording runs on a WebSpark site.
• Where a client wants a chat widget or analytics, it is declared as a vendor, appears in the cookie table and privacy notice, and does not load before consent.
• The content security policy blocks any origin nobody declared, so a script added through a tag manager cannot quietly start recording.

What you can show

• A consent log showing what was presented and chosen, with dates.
• A dated test showing that no third-party request fires before consent.
• A vendor list that matches the origins the browser is permitted to contact.

What stays yours

• Deciding whether the tool is worth the exposure. We can make it consented and disclosed; whether to run it at all is your call, and worth taking advice on.