Microsoft Clarity: Tracking Behavior & Litigation Context
What Microsoft Clarity Is
Microsoft Clarity is a free behavioral analytics tool that records how visitors use a website, producing session replays, heatmaps, and interaction analytics.
What It Does
Clarity's script captures DOM mutations, mouse movement, scrolling, clicks, and keystroke events (with masking rules), reconstructing a visitor's session as a playable recording on Microsoft's servers. It also aggregates rage-click, dead-click, and scroll-depth metrics.
Browser Communications Generally Observed
Continuous batched requests to clarity.ms endpoints during a visit, carrying serialized DOM and interaction data, page URLs, and a persistent visitor identifier. Recording typically begins at page load; masking of text inputs depends on configuration and can be incomplete for custom form controls.
How Our Scanner Detects It
Our scanner detects Clarity's script and network traffic, observes whether recording begins before consent, and uses synthetic form interaction with marker values to test whether typed input is transmitted before submission.
Common Implementation Behavior
Often added directly or via tag manager with default settings. Common issues observed include recording enabled on pages containing forms with sensitive fields, incomplete input masking, and recording beginning before any consent interaction.
Litigation & Risk Context
Session replay tools including Clarity have been named repeatedly in website tracking lawsuits invoking state interception statutes, on the theory that recording a visitor's interactions constitutes capturing the contents of a communication. Presence of Clarity is a potential risk indicator meriting configuration review, particularly on form-heavy or sensitive-category sites; it is not a determination that any statute was violated.
Tracked Cases Involving This Technology
Popa v. Microsoft Corp.
The article reports that California enacted SB 690 to narrow private CIPA pen-register litigation involving websites and applications while preserving wiretapping and eavesdropping claims. It also describes developing standing standards, including a Ninth Circuit ruling in Popa v. Microsoft Corp. that generalized web-tracking injury allegations are insufficient for constitutional standing.
Brittanee Jackson, et al. v. Yardi Systems, Inc., et al.
An official Santa Barbara Superior Court tentative ruling addresses a filed class action alleging that Yardi Systems and RentCafe used website-tracking tools to intercept and disclose visitors' information without their knowledge or consent. The tentative ruling overrules the defendants' demurrer and directs an answer by October 9, 2026; the excerpt does not establish a final order or liability finding.
In re: Zillow Group, Inc. Session Replay Software Litigation
Law360 reports that a Washington federal judge threw out a proposed class action alleging Zillow used Microsoft browser tracking software that shared users' website activity with third parties. The excerpt identifies the case and its September 12, 2022 filing date, but does not disclose the dismissal grounds or appeal status.
Doe v. Bayhealth Medical Center, Inc.
Three anonymous patients brought a putative class action alleging that Bayhealth's website trackers collected private health information and disclosed it to Facebook, Google, and Microsoft for targeted advertising. On April 4, 2025, the Delaware Superior Court granted in part and denied in part Bayhealth's motion to dismiss the first amended complaint. The excerpt provides allegations and procedural background but does not identify the claims affected or the reasoning for the mixed ruling.
Thomas v. Papa John's International, Inc.
The Ninth Circuit affirmed dismissal of Thomas's session-replay privacy claims while rejecting Papa John's personal-jurisdiction challenge. The unpublished memorandum is not precedent except as provided by Ninth Circuit Rule 36-3. ([law.justia.com](https://law.justia.com/cases/federal/appellate-courts/ca9/24-3557/24-3557-2025-06-18.html))
Sanchez v. Cars.com; Aviles v. LiveRamp
A Chamberlain Hrdlicka blog post explains how plaintiffs have used California's 1967 Invasion of Privacy Act (CIPA) pen register provisions to sue websites over routine trackers and describes inconsistent trial-court rulings on that theory. The post reports a pending amendment to SB 690 that would remove the private right of action for § 638.51 pen register claims tied to websites/apps, shifting enforcement to the Attorney General, while leaving wiretap/eavesdrop provisions (§§ 631–632) intact.
Remediation Options Operators Commonly Consider
- Inventory every third-party script, pixel, and embed on the site and document what each transmits, to whom, and when (page load, pre-consent, during interaction, pre-submission).
- Gate non-essential tracking behind a consent management platform configured to actually block network transmission before consent — not merely hide a banner.
- Review and, where appropriate, disable optional data-capture features (advanced matching, automatic event capture, input/keystroke capture, session recording of form fields).
- Update the privacy policy and any consent language to accurately describe the third-party technologies in use and the data they receive.
- Re-scan after every tag manager or website change; tracking configurations drift over time.
Frequently Asked Questions
Is session replay illegal?
No court has held that session replay is categorically unlawful, and no statute names it. Plaintiffs have argued that specific implementations amount to interception under specific state statutes, with mixed public outcomes. This page is informational, not legal advice.
Does Clarity record what visitors type?
Clarity captures interaction events and, depending on masking configuration, may capture typed content in unmasked fields. Our scanner tests this empirically with synthetic marker input.
Related Intelligence
Sources
This page is based on direct technical observation by our scanner and vendor documentation; tracked litigation sources will be listed as the intelligence engine links them to this technology.
About This Page
Publisher: Inspection-Ready Institute, Inc. (DBA Crandall Consulting), an independent website compliance and risk consultancy. We are not a law firm and nothing on this page is legal advice.
How this content is produced: Facts are extracted from publicly available sources — court and government materials, recognized legal press, professional analysis, and industry reports — by our litigation intelligence engine, stored with full source provenance, and rendered from the database. Risk guidelines are computed by a deterministic formula, never by an AI model directly. See the full methodology.
Limitations: Counts labeled "Tracked" reflect matters identified in our source set and are not official court statistics. We report what courts decided and did not decide; we do not predict outcomes.
Corrections: If you believe anything on this page is inaccurate, contact us via the contact page and we will review the underlying sources promptly.
Is Your Website Creating Hidden Tracking Risk?
Scan your site for third-party tracking and potential wiretap exposure. Free, no account required.
Scan My Website