Session Replay, Tracking Pixels and Privacy in the US

This guide is not legal advice

Privacy law in the United States changes quickly and depends on where your visitors are, what you collect and how you use it. This guide summarizes the cited sources as of their publication dates. Several are law firm commentaries, labeled as secondary sources in the list below. Check current law with a qualified attorney before deciding how to use these tools.

What these tools collect

Session replay tools record what visitors do on a page, such as mouse movements, clicks, scrolling and typing, and rebuild the session as a video-like replay. Heatmaps aggregate clicks and scrolling across many visitors. Tracking pixels are small pieces of code, often supplied by advertising or analytics platforms, that send information about a visit to a third party.

All three can capture more than a site owner intends. A replay can include text typed into a form before it is submitted. A pixel can send the address of the page a visitor viewed, which may itself reveal sensitive information, such as a page about a medical condition.

What the FTC has said about pixels

In March 2023, the Federal Trade Commission's Office of Technology published "Lurking Beneath the Surface: Hidden Impacts of Pixel Tracking" ¹. It states that "Tracking pixels can be hidden from sight and can track and send all sorts of personal data", and warns that companies whose pixels "impermissibly disclose an individual's personal information" to third parties "may be violating the FTC Act".

The practical lesson is that what your privacy notice says must match what your tools actually do. If the notice says you do not share personal information with advertisers, but a pixel sends page addresses and identifiers to an advertising platform, that gap is a risk.

California wiretap claims

The California Invasion of Privacy Act, or CIPA, is a state wiretapping law that predates the web. Plaintiffs have used it to bring claims against websites that use session replay, chat tools and pixels, arguing that these tools let a third party intercept communications without consent.

A July 2025 alert from the law firm Duane Morris explains that CIPA provides statutory damages of $5,000 per violation, and names session replay among the targeted practices ². That picture changed in part in 2026. Governor Newsom signed Senate Bill 690 on September 30, 2026. According to advisories from Kelley Drye and DLA Piper, from January 1, 2027 only the California Attorney General may bring claims under Penal Code section 638.51, the pen register and trap and trace provision, and the change reaches actions filed on or after January 1, 2025 ^3,4. Kelley Drye adds that the broad exception for data used for a commercial purpose, which appeared in the earlier version of the bill, was dropped, and that the wiretapping provision in section 631, the one most session replay claims rely on, is unchanged ³.

A June 2025 Duane Morris alert describes Mikulsky v. Bloomingdale's, an unpublished Ninth Circuit decision of June 20, 2025, which reversed the dismissal of a CIPA section 631(a) claim over alleged interception of the contents of a visitor's communications through session replay technology, without consent ⁵. An unpublished decision is not binding precedent, but the case illustrates why legal teams pay attention to these tools.

State privacy laws and opt-out signals

Beyond wiretap claims, a growing number of states have broad consumer privacy laws. A June 2026 Husch Blackwell article counts 24 states with such laws, after Alabama, Louisiana, Oklahoma and Vermont joined the 20 that had them at the start of 2026 ⁶.

In California, the California Consumer Privacy Act applies to businesses that meet certain thresholds. The California Privacy Protection Agency adjusted the annual gross revenue threshold to $26,625,000, effective January 1, 2025 ⁷. The agency adjusts these figures for inflation in odd-numbered years, so the next adjustment is due on January 1, 2027; check the CPPA page for the current figure. Revenue is only one of the tests; read the statute and the agency's materials for the full criteria.

Opt-out preference signals, such as Global Privacy Control, let a browser tell a site that the visitor wants to opt out of the sale or sharing of their data. A November 2025 Freshfields commentary reports that amended CCPA regulations, effective January 1, 2026, require businesses to detect, honor and confirm such signals, and describes a coordinated investigation by California, Colorado and Connecticut into compliance ⁸. The California Privacy Protection Agency announced on September 30, 2025 that Tractor Supply agreed to pay a $1.35 million fine, with one of the alleged violations involving opt-out requests sent through preference signals such as Global Privacy Control ⁹. Session replay and advertising pixels are among the tools such signals may need to switch off.

Keep personal data out of analytics

Google Analytics has its own rule about personal information. Its help documentation says "Avoid sending PII to Google when collecting Analytics data" and that "Both the URL path and parameters must be free of PII" ¹⁰. PII means personally identifiable information, such as names, email addresses and phone numbers. A common way to break the rule by accident is a form that puts the visitor's email address into the URL of the thank-you page.

Practical steps for site owners

1. Inventory your tools. List every analytics, replay, heatmap, chat and advertising script on the site, what each collects and where the data goes.
2. Mask by default. Configure replay tools to mask all form inputs and any page content that may contain personal data. Check the masking by watching real replays.
3. Exclude sensitive pages. Do not run replay or advertising pixels on pages about health, finances, accounts or checkout unless counsel has reviewed it.
4. Check URLs for personal data. Make sure no form or link places names, emails or other identifiers in page addresses.
5. Describe tools accurately. Your privacy notice should name the categories of tools, what they collect and why, in plain language.
6. Honor opt-out signals and choices. Where required, detect preference signals and turn off the tools they cover.
7. Limit retention and access. Keep recordings only as long as you need them, and limit who can view them.
8. Get legal advice on consent. Whether you need consent before recording, and how to get it, is a legal question that depends on your visitors and tools.

Research without replay

Replay is not the only way to understand behavior. Recruited usability sessions, where participants give informed consent and know they are being recorded, often explain behavior better, because you can ask why. Our guide to consent and incentives covers that approach, and our friction analysis service can work from aggregate analytics and recruited sessions alone.