CCPA and AI Session Replay Tools 2026: Heatmaps, Recordings and the Wiretapping Problem
Almost every growth team installs a session recorder. It answers the question nobody else can — where do people actually get stuck — and the setup is one script tag. What that tag also does is stream a visitor's scrolling, clicking, typing and hesitation to a company the visitor has never heard of, in a state with a private right of action and a very active plaintiff bar.
What These Tools Actually Capture
The mental model most teams carry is "aggregate heatmaps." The reality is a DOM-level reconstruction of an individual person's visit: cursor path, scroll depth, every click including the frustrated repeated ones, page-to-page navigation, device and network signals, and — unless it has been explicitly suppressed — the contents of form fields as they are typed, before submission and before any consent to process them.
That last part is where the trouble concentrates. A visitor who starts filling in a support form with an account number, thinks better of it, and deletes the text has still generated a recording of the account number. A prospect who abandons a form after typing an email address has still handed you an identifier. Abandoned input is captured input.
Two Separate Legal Questions, Often Conflated
- •Session data and derived inferences are both personal information
- •Vendor use beyond your instructions turns disclosure into a sale or share
- •Notice at collection must describe what is actually recorded
- •Global Privacy Control must be honored server-side, not just visually
- •Deletion and access requests have to reach the vendor's copy too
- •Third-party script framed as an uninvited listener on the visit
- •Statutory damages per plaintiff, which is what makes it a class vehicle
- •Capture that begins before consent weakens every defense
- •Chat widgets and replay scripts get sued on the same theory
- •Vendor's own data use is central to whether it is a 'party' at all
Service Provider Status Is the Whole Ballgame
Under the CCPA, handing personal information to a vendor is not automatically a sale or a share. It stops being one when the vendor is a service provider: contractually restricted to processing on your documented instructions, prohibited from retaining or using the data for its own purposes, and barred from combining it with data from other customers except in narrow permitted cases. The contract has to say this. Most standard analytics terms, read closely, say something looser.
The clause to hunt for is model training and product improvement. A vendor that reserves the right to use "aggregated and de-identified" customer data to train its AI features has reserved a purpose of its own. That does not automatically destroy service-provider status, but it is the sentence a regulator or a plaintiff will read first, and it is negotiable more often than teams assume.
What the AI Layer Adds
The 2026 generation of these products does not just store sessions. It summarizes them in natural language, clusters visitors by behavior, flags "frustration" and "purchase intent," and answers questions about individual users. Every one of those outputs is an inference drawn from personal information, which the CCPA treats as personal information itself — including when the inference reaches a sensitive category like health interest or financial distress. A behavioral score you never stored in your own database is still yours to disclose, honor deletion on, and defend.
The Pages Where Recording Should Simply Be Off
Field-level masking is fragile. It depends on selectors that break the next time a form is redesigned, and nobody re-tests it after a release. The durable control is page-level: no recording on checkout and payment pages, on account creation and login, on password reset, on anything collecting health, biometric, immigration, or government-ID information, and on internal admin views where staff can see customer records. Whitelist the pages you record rather than blacklisting the ones you do not — the failure mode of the first approach is missing data, and of the second, a recorded credit card.
Session Replay Compliance Checklist
Immediate Actions
- ☐Inventory every recording, heatmap and chat script actually loading in production
- ☐Replay one of your own sessions and look for readable data that should be masked
- ☐Disable recording entirely on checkout, auth, and any health or ID collection page
- ☐Suppress all input capture by default and allow-list the few fields you need
- ☐Confirm the script does not fire before a consent choice is registered
Within the Quarter
- ☐Read the vendor contract for model-training and product-improvement carve-outs
- ☐Get service-provider terms in writing, or treat the flow as a share with an opt-out
- ☐Describe session recording explicitly in the notice at collection
- ☐Wire Global Privacy Control to actually suppress the script, not just set a flag
- ☐Extend deletion and access request workflows to the vendor's stored sessions
Frequently Asked Questions
Is session replay legal in California?
It is not banned, but two bodies of law reach it. The CCPA treats session data and the inferences drawn from it as personal information, and routing it to a vendor can be a sale or share depending on the contract. Separately, plaintiffs argue a third-party recording script is an unauthorized interception under the state wiretapping statute. The tool is legal; the out-of-the-box configuration often is not.
Does using a session recorder count as a sale or share?
Only if the vendor uses the data for its own purposes. A vendor locked into service-provider terms — processing solely on your instructions, no retention for its own use, no cross-customer combination — is generally not a sale or share. A vendor that reserves rights to benchmark, train models, or optimize advertising with your visitors' sessions is, and that triggers opt-out link and Global Privacy Control obligations.
What is the wiretapping claim actually alleging?
That a visitor's communication with your site was simultaneously captured and transmitted to a third party the visitor never chose to interact with. The defense usually turns on whether the vendor is best characterized as an extension of the site operator or as an independent listener — which is decided largely by the contract and by what the vendor does with the data.
Do the AI features change anything legally?
Yes. AI session summaries, friction detection and intent scores create inferences about individual users, and inferences are personal information under the CCPA. If those features are powered by shared models trained on customer sessions, that is vendor use beyond your instructions, which weakens the service-provider position the entire compliance story rests on.
Is masking enough to make this safe?
Masking helps but degrades quietly. Selector-based rules break when a form is redesigned and nobody re-tests them. Page-level exclusions for checkout, authentication, and sensitive data collection are far more durable, and an allow-list of recorded pages beats a block-list of excluded ones.
Does our cookie banner cover this?
Rarely. Most banners load the recording script before the visitor chooses anything, so capture predates consent. And a generic cookie notice does not tell anyone their keystrokes and mouse movements are being recorded and replayed by an outside company. Say what is captured, and hold the script until the choice is made.
Related Reading
Find Out What Your Site Is Actually Loading
Most of this exposure is not a decision anyone made. It is a script a contractor added two years ago, a tag manager container nobody audits, and a default setting that captures more than the team believes it does. The fix starts with an honest inventory of what runs in production.
Knowing exactly what your pages load and expose is the same discipline applied to the rest of your site. Run a free scan of your site to see what's live today.