Session Replay (category): Tracking Behavior & Litigation Context
What Session Replay (category) Is
Session replay is a category of tools (Microsoft Clarity, Hotjar, FullStory, Mouseflow, Lucky Orange, and others) that record a visitor's on-site behavior — mouse movement, clicks, scrolling, and DOM changes — and reconstruct it as a watchable recording.
What It Does
Replay scripts serialize the page and the visitor's interactions in near-real time and stream that data to the vendor's servers, where operators can replay individual sessions. Depending on masking configuration, typed input may be included.
Browser Communications Generally Observed
Continuous batched transmissions to vendor endpoints throughout a visit, beginning at page load in default configurations, containing serialized DOM state, interaction events, page URLs, and persistent visitor identifiers.
How Our Scanner Detects It
Our scanner identifies replay scripts across vendors, verifies when recording begins relative to consent, and types synthetic marker values into forms to empirically test whether keystrokes or field values are transmitted before submission.
Common Implementation Behavior
Deployed via tag managers with defaults that record all pages. Recurring observed issues: recording on checkout/patient/intake pages, incomplete masking for custom components, and consent banners that don't gate the recorder.
Litigation & Risk Context
Session replay is the technology category most consistently named in website 'wiretap' litigation under all-party consent statutes, on the theory that recording visitor interactions captures the contents of a communication without consent. Detection is a meaningful informational risk indicator on any site, and especially on form-heavy or sensitive-category sites — but is not a legal determination.
Tracked Cases Involving This Technology
Variety Media LLC v. Superior Court
Jones Walker reports that SB 690 was signed September 30, 2026, and will limit private civil remedies for covered Section 638.51 website and application claims beginning January 1, 2027. In Variety Media, LLC v. Superior Court, the California Court of Appeal withdrew submission and requested briefing on mootness and possible exceptions; no final merits or mootness decision is reported.
Popa v. Microsoft Corp.
The article reports that California enacted SB 690 to narrow private CIPA pen-register litigation involving websites and applications while preserving wiretapping and eavesdropping claims. It also describes developing standing standards, including a Ninth Circuit ruling in Popa v. Microsoft Corp. that generalized web-tracking injury allegations are insufficient for constitutional standing.
In Re: BPS Direct, LLC; Cabela’s, LLC Wiretapping Litigation
The excerpt identifies a Third Circuit opinion in the BPS Direct and Cabela's wiretapping litigation, decided May 11, 2026. Its opening describes the retailers' use of JavaScript Session Replay Code to capture and store website interactions, but the bounded excerpt does not reveal the holding or disposition.
In re: Zillow Group, Inc. Session Replay Software Litigation
Law360 reports that a Washington federal judge threw out a proposed class action alleging Zillow used Microsoft browser tracking software that shared users' website activity with third parties. The excerpt identifies the case and its September 12, 2022 filing date, but does not disclose the dismissal grounds or appeal status.
Tanner v. FCA US LLC
This website-tracking suit received a mixed pleading ruling: interception and constitutional privacy claims survived, while pen-register, CDAFA, and UCL claims were dismissed. The court allowed amendment rather than entering a final judgment. ([docs.justia.com](https://docs.justia.com/cases/federal/district-courts/california/caedce/2%3A2026cv01475/486758/22))
Garcia, et al. v. Microsoft Corporation, et al.
The putative class action concerns tracking on Minecraft websites, applications, and online services. The court questioned concrete injury and required a standing response, without dismissing the action or deciding liability. ([docs.justia.com](https://docs.justia.com/cases/federal/district-courts/california/candce/3%3A2025cv11078/461935/45))
Ann Jones v. Bloomingdales.com, LLC; Ann Jones and Jane Tenzer v. Papa John's International, Inc.
The Eighth Circuit affirmed dismissals of website session-replay suits because plaintiffs inadequately alleged concrete privacy injury. The court distinguished general browsing activity from private information and did not resolve personal jurisdiction.
Farst v. AutoZone, Inc. et al.
The agreement addresses claims concerning session replay on AutoZone.com and provides $20 for each valid, timely claim, with approved-claim funding capped at $1,233,820. The settlement class comprises qualifying Pennsylvania residents who placed website orders while session replay was enabled and were not AutoZone Rewards members. Settlement remains subject to court approval, and defendants deny liability. ([classaction.org](https://www.classaction.org/media/farst-v-autozone-inc-et-al-settlement.pdf))
Blaker v. Netscout Systems
Loeb & Loeb reports that the Los Angeles Superior Court dismissed Blaker v. NetScout Systems, Inc. with prejudice, rejecting a CIPA § 638.51 claim concerning an X Corp. SDK deployed on NetScout's website. The article attributes the result to statutory interpretation distinguishing telephonic communications from routine website tracking and contrasts it with litigation involving Kochava and Jornaya.
Thomas v. Papa John's International, Inc.
The Ninth Circuit affirmed dismissal of Thomas's session-replay privacy claims while rejecting Papa John's personal-jurisdiction challenge. The unpublished memorandum is not precedent except as provided by Ninth Circuit Rule 36-3. ([law.justia.com](https://law.justia.com/cases/federal/appellate-courts/ca9/24-3557/24-3557-2025-06-18.html))
Remediation Options Operators Commonly Consider
- Inventory every third-party script, pixel, and embed on the site and document what each transmits, to whom, and when (page load, pre-consent, during interaction, pre-submission).
- Gate non-essential tracking behind a consent management platform configured to actually block network transmission before consent — not merely hide a banner.
- Review and, where appropriate, disable optional data-capture features (advanced matching, automatic event capture, input/keystroke capture, session recording of form fields).
- Update the privacy policy and any consent language to accurately describe the third-party technologies in use and the data they receive.
- Re-scan after every tag manager or website change; tracking configurations drift over time.
Frequently Asked Questions
Which session replay vendors appear in litigation?
Public complaints have named many vendors in the category. Theories target the recording behavior itself, so the specific vendor matters less than configuration: what is captured, when recording begins, and how masking and consent gating are set up.
Related Intelligence
Sources
This page is based on direct technical observation by our scanner and vendor documentation; tracked litigation sources will be listed as the intelligence engine links them to this technology.
About This Page
Publisher: Inspection-Ready Institute, Inc. (DBA Crandall Consulting), an independent website compliance and risk consultancy. We are not a law firm and nothing on this page is legal advice.
How this content is produced: Facts are extracted from publicly available sources — court and government materials, recognized legal press, professional analysis, and industry reports — by our litigation intelligence engine, stored with full source provenance, and rendered from the database. Risk guidelines are computed by a deterministic formula, never by an AI model directly. See the full methodology.
Limitations: Counts labeled "Tracked" reflect matters identified in our source set and are not official court statistics. We report what courts decided and did not decide; we do not predict outcomes.
Corrections: If you believe anything on this page is inaccurate, contact us via the contact page and we will review the underlying sources promptly.
Is Your Website Creating Hidden Tracking Risk?
Scan your site for third-party tracking and potential wiretap exposure. Free, no account required.
Scan My Website