Session Replay Lawsuits — What They're About and How to Reduce Risk

Short answer: in the United States, plaintiffs have sued website operators and replay vendors claiming that recording a visitor's interactions without consent is unlawful interception of communications under state wiretapping laws. Results have been mixed and depend on the court and the facts. The practices that lower your risk are consistent: tell visitors, get consent before recording, mask what they type, and use a vendor that only processes data for you.

Table of Contents

1. What the Claims Say
2. Why Outcomes Vary
3. Practices That Attract Claims
4. How to Reduce Risk
5. Questions to Ask Your Vendor
6. Key Takeaways

What the Claims Say

Several US states have laws, written long before the web, that prohibit recording or intercepting a communication without the consent of the people involved. Some require the consent of all parties. California's Invasion of Privacy Act is the most frequently cited, and similar statutes in other states have been used as well.

The argument, in outline:

1. A visitor's clicks, keystrokes, and form entries are a communication with the website.
2. A third-party script captures that communication as it happens.
3. The visitor did not consent.
4. Therefore the capture is an unlawful interception, and the website operator enabled it.

Some of these statutes allow damages per violation, which is why the claims are often brought as class actions.

Related claims have been made about chat widgets, advertising pixels, and other tracking technologies, using similar reasoning.

Why Outcomes Vary

Courts have reached different conclusions, and the following questions tend to matter.

Because these turn on specific facts and on differing judicial views, there is no simple rule. The absence of a settled answer is itself a reason to be careful.

Practices That Attract Claims

Looking across the kinds of allegations made, these patterns recur:

• Recording begins the moment the page loads, before any notice or choice.
• The privacy policy does not mention session recording.
• Typed text is captured unmasked, including text the visitor deleted or never submitted.
• Sensitive pages are recorded: health, financial, or legal subject matter.
• The vendor's terms let it use the data for its own products.
• A consent banner exists and the recording script ignores it.

Each of these is avoidable.

How to Reduce Risk

1. Get consent before recording

Do not load or start the recording script until the visitor has agreed. This addresses the central element of the claims.

DeepSync projects default to consent-required mode: the SDK collects nothing until it receives an explicit consent signal (consent modes). Wire it to your banner's accept action and confirm that declining really results in no recording (setup guide).

2. Say it plainly

Name session recording in your privacy policy and in the consent notice. Vague phrases about "enhancing your experience" are not disclosure.

3. Mask what visitors type

Keystrokes and form contents are the part of a session most clearly treated as the content of a communication. Mask them at the source.

DeepSync masks passwords, payment fields, and text inputs in the browser at capture time, so the real values never reach its servers and cannot be recovered from a recording (PII masking).

4. Exclude sensitive areas

Do not record pages concerning health, finances, legal matters, or children. Block elements that display such data.

5. Choose a vendor that works only for you

Your contract should restrict the vendor to processing data on your behalf and prohibit its use for other purposes.

6. Keep data briefly

Shorter retention reduces exposure.

7. Check your chat and other widgets

The same reasoning has been applied to chat tools and pixels. Review every script that captures what visitors type.

8. Document it

Keep records of your consent flow, masking audit, and vendor agreement.

Questions to Ask Your Vendor

1. Does recording wait for a consent signal by default?
2. Where does masking happen: in the browser or on your servers?
3. Are typed inputs masked by default?
4. Can we block specific elements and pages?
5. Do your terms restrict you to processing data on our behalf?
6. Do you use our data to train models or for your own products?
7. Where is data stored, and for how long?
8. Can we delete an individual's data on request?

Key Takeaways

• The claims centre on recording without consent through a third party.
• Outcomes vary; the area is unsettled.
• Consent before recording and input masking address the core allegations.
• Review chat widgets and pixels with the same care.

Conclusion

The lawsuits target careless implementations. Recording that waits for consent, masks what people type, and is disclosed openly is a different practice from the one being litigated.

Read DeepSync's consent documentation.