8 in 10. 4 in 10. $5,000. Those are the three numbers in this post. The twist is a law California just passed: it ends one kind of private CIPA lawsuit from 1 January 2027, and the wiretapping claim it leaves standing is the one used against session replay, chat, search bars and ad pixels.
This page explains the law and the tools. It is not legal advice, we are not lawyers, and nothing here says any tool, ours included, is "CIPA compliant". If you got a letter, talk to a lawyer.
What a CIPA claim says
The California Invasion of Privacy Act is a 1967 wiretapping law. Plaintiffs' firms use two parts of it against websites.
- Section 631, wiretapping. It covers anyone who, without "the consent of all parties", tries "to learn the contents or meaning" of a message "while the same is in transit", and anyone who "aids" them.source The website theory: a third-party script read what a visitor typed or did. Session replay, chat widgets and search bars are the usual targets.
- Section 638.51, pen register. It bars a "pen register or a trap and trace device" without a court order.source A pen register records "addressing, or signaling information ... but not the contents".source The website theory: a tracker that collects IP addresses and device details is one.
The money comes from section 637.2: the greater of $5,000 per violation or three times actual damages, and the statute does not require proof of actual damages.source The law firm Fisher Phillips estimates that over 4,700 digital wiretapping lawsuits were filed in California or under California law since 2022, about two thirds with a pen register claim.source Demand letters that settle quietly would not show up in a count of lawsuits.
What SB 690 changes, and what it does not
SB 690 was signed on 30 September 2026 and takes effect on 1 January 2027.source Against a private company, only the Attorney General can then sue under the pen register section for conduct "on an internet website, online application, or mobile application", and it reaches back to pending cases filed in the two years before that date.source
It does not touch section 631, the wiretapping claim, or its $5,000 per violation. Lawyers tracking these cases expect letters to lean on 631 from here.source Section 631 is the claim used against session replay, chat, search bars and ad pixels, so those stay at the center. Private suits already filed before 2025 are not covered, and the Attorney General can still sue.
What the courts have done with session replay
Three federal appeals courts upheld the dismissal of session replay cases because the visitor showed no concrete harm: Jones v. Bloomingdale's (8th Circuit, 2024, Missouri law),source Cook v. GameStop (3rd Circuit, 2025, Pennsylvania law)source and Popa v. Microsoft (9th Circuit, 2025, Pennsylvania law), where the site ran "the session-replay technology known as 'Clarity'".source None of them was a CIPA case.
Read those carefully. They are rulings on standing in federal court, not rulings that replay is legal, and no appeals court has said it is. California state courts are not bound by them. Some trial courts have let CIPA claims against session replay go forward, as one did against Nike over FullStory in 2021.source On chat widgets, one court let a 631 claim go forward because the visitors alleged the chat vendor could use the chats for its own purposes,source and in a separate case an unpublished 9th Circuit ruling found no evidence that the chat vendor read the messages.source
What stores actually load
We looked at the scripts loaded on a sample of sites that run the Harvv pixel, 14 to 26 October 2026. About 8 in 10 load the Meta Pixel and about 8 in 10 the Google tag. About 4 in 10 run session replay, almost all of it Microsoft Clarity. Every site with session replay also ran an ad pixel. The median site loaded scripts from about 13 outside hosts, and one loaded 49.
That is the real exposure for most stores: not one tool, but a dozen scripts nobody has listed in one place, each added by a different person, an app or an agency.
What each tool sends by default
Each cell links to the vendor page it comes from, read on 27 October 2026. Defaults matter because most stores never change them.
| Tool | Replay | Typing and page text | Whose data | Waits for consent |
|---|---|---|---|---|
| Microsoft Clarity | Yes | Input boxes are always masked. The default mode masks numbers and email addresses; other page text is captured.source | Microsoft is an independent controller, not your processor, and may build user profiles for advertising.source | Consent Mode holds back cookies, and is on by default only for EU, UK and Swiss visitors.source |
| Hotjar | Yes | Typed input and long numbers are hidden by default. Hiding other page text is a setting you turn on.source | Owned by Contentsquare, which contracts as a processor with exceptions for benchmarking and its own development.source | No consent API found in its docs; the site is responsible for collecting consent.source |
| FullStory | Yes | Newer accounts mask form fields. Other page text is captured unless Private by Default is turned on.source | Processes data on your behalf, with a license to improve its services.source | Can wait to start recording until you tell it to.source |
| Lucky Orange | Yes | Keystrokes are opt-in. Page text is captured unless you mark it sensitive.source | Acts as a processor for its customers, per its privacy statement.source | Optional "Require Consent" setting and consent API.source |
| Mouseflow | Yes | Keystrokes are excluded automatically.source | Processor; its DPA bars other purposes.source | Can wait to start recording until you tell it to.source |
| Google Analytics 4 | No | Form events send the form name, id, destination and button text.source | Listed as a processor service in Google’s Ads data processing terms.source | Consent Mode; in advanced mode it still sends cookieless pings.source |
| Meta Pixel | No | Sends button clicks and form field names; field values only with Advanced Matching.source | Meta may use the data to personalize ads and improve its own products.source | Consent grant and revoke calls.source |
| TikTok Pixel | No | Sends button clicks and ad events.source | TikTok may use the data to improve its own ad delivery.source | Not confirmed from TikTok’s own docs. |
| Klaviyo | No | Page views and product views; it identifies a visitor after a form or email click.source | Service provider or processor, per its DPA.source | On Shopify it follows Shopify’s privacy setting, which by default asks only in the EU, UK and Switzerland. Elsewhere you block it yourself.source |
| Harvv | No | Never sends what a visitor types. For a form field it sends only whether it was filled in and roughly how long the entry was. It keeps the label of what was clicked, like "Add to cart".source | Processor and service provider for visitor data, in our DPA.source | Not yet. Today a visitor who declines is still counted, with no cookie or stored id. A mode that sends nothing until they accept is built but not switched on.source |
Two things separate the tools. First, session replay captures the page itself, text included. By default Clarity masks only numbers and email addresses on the page, Hotjar hides other page text only if you turn that on, and Lucky Orange masks text only where you mark it. Second, whose data it is: Clarity, Meta and TikTok may use what they collect for their own products and ads, while processors contract to use it only for you. In a 631 case, whether the vendor can use the data for itself is often the argument.
Where Harvv fits, including the limit
Harvv is an analytics pixel that finds what is broken on a site: dead clicks, rage clicks, slow pages, bot traffic. It does not record session replays, so no one can play back a visit. It does record events such as clicks and scrolls, with the label of what was clicked. It never sends what a visitor types: for a form field it sends only whether the field was filled in and roughly how long the entry was. It keeps no raw IP address.source Our DPA makes us your processor and service provider for visitor data.source
The limit, stated plainly: Harvv is still a third-party script, and today it counts a visitor who declines consent, with no cookie and no stored id. A mode that holds everything in the browser and sends nothing until the visitor accepts is built, and it is not switched on yet. If consent before anything is sent is your rule, Harvv does not meet it today.source
For agencies: the letter goes to your client
Agencies install most of these scripts, and the letter lands on the store. One defense firm, Ballard Spahr, gives this list:source
- List every script on every client site, and what each one collects.
- Load tracking only after consent, then test that the banner really blocks it.
- Make the privacy policy match what the scripts actually do.
- Make vendor contracts say what data each vendor gets, that it follows the visitor's consent choice, and that you can audit it.
- Keep dated records of the setup and of consent.
Questions people search
What is a CIPA lawsuit?
A claim under the California Invasion of Privacy Act, a 1967 wiretapping law, that a website let a third party listen in on visitors. The two theories used against websites are section 631, reading the contents of a communication in transit (session replay, chat widgets, search bars), and section 638.51, using a "pen register" (trackers that collect IP addresses and device details).
What are CIPA statutory damages?
Section 637.2 allows the greater of $5,000 per violation or three times actual damages, and the statute does not require proof of actual damages. That per-violation figure is why demand letters arrive with a number attached.
How many CIPA lawsuits have been filed?
The law firm Fisher Phillips estimates that over 4,700 digital wiretapping lawsuits were filed in California or under California law since 2022, about two thirds with a pen register claim. That is their estimate. Demand letters that settle quietly would not show up in it.
Does SB 690 end CIPA lawsuits?
No. SB 690, signed on 30 September 2026 and operative 1 January 2027, takes away private lawsuits against companies under the pen register section for conduct on websites and apps. Only the Attorney General can bring those. The wiretapping section, 631, is untouched, and so is its $5,000 per violation. Expect letters to lean on 631.
Is session replay illegal?
No court has settled it either way. Three federal appeals courts upheld the dismissal of session replay cases under Missouri and Pennsylvania law because the visitors showed no concrete harm, including Popa v. Microsoft, a case about Microsoft Clarity. None was a CIPA case, and none said replay is legal. Some trial courts have let CIPA claims against replay go forward, and replay that catches health, financial or typed personal details is a bigger risk.
How to avoid a CIPA lawsuit?
One defense firm, Ballard Spahr, gives this list: know every script on the site, load tracking only after consent and test that the banner really blocks it, make the privacy policy match what the scripts do, make vendor contracts say what data each vendor gets and that it follows consent, and keep dated records. This page is not legal advice, and your own lawyer should check that list against your site.
Does Harvv make my site CIPA compliant?
No tool can promise that, and we do not. Harvv records no session replays, never sends what a visitor types, keeps no raw IP address, and is your service provider by contract. It is still a third-party script, and today it counts visitors who decline consent, without a cookie. About 8 in 10 sites in our sample also run an ad pixel, which is usually the bigger question.
Method: script hosts loaded on a sample of live customer sites running the Harvv pixel, 14 to 26 October 2026, sites with at least 50 measured sessions; Harvv's own sites, test and demo sites excluded. The census sees scripts on the page; Shopify's sandboxed web pixels, server-side tags and chat widgets inside iframes are not counted, so real exposure is higher, not lower. Statute text from FindLaw's copy of the California Penal Code. Vendor cells from each vendor's documentation, read 27 October 2026. Not legal advice. Related: Microsoft Clarity privacy, in Microsoft's words, Shopify bot traffic, measured.