Session Replay & Heatmaps · Updated 2026
Microsoft Clarity records session replays and builds heatmaps, capturing how visitors move through and interact with your pages. Using it is perfectly legal — but running Microsoft Clarity before a visitor consents is what creates exposure under California's wiretapping law.
Is this tracker on your site? Find out free in 30 seconds.
Real browser scan, no signup to run it. You see a summary of the findings; the full report with every tracker unlocks with your email.
California's Invasion of Privacy Act (CIPA), Penal Code § 631, prohibits intercepting communications without all-party consent. Since 2022, a wave of plaintiff-firm litigation has applied this decades-old wiretapping statute to website session-replay, chat, and pixel tools — arguing that capturing a visitor's clicks, keystrokes, and form input without consent is an unlawful interception. Clarity records session replays and heatmaps; replaying visitor input without consent has driven CIPA § 631 demand letters.
Statutory damages run up to $5,000 per violation, and plaintiffs argue each affected visitor session is a separate count — which is why even small sites receive demand letters.
In a landmark action, the California Attorney General reached a $1.2M CCPA settlement with Sephora over undisclosed sale of personal information and its failure to honor opt-out (Global Privacy Control) signals — a CCPA enforcement action, not a session-replay/CIPA case. Separately, private CIPA suits over session-replay and chat tools have named retailers, healthcare providers, and SaaS companies alike. The common thread across both: trackers firing before the visitor had any chance to opt out.
// Clarity supports a built-in consent signal. Load the snippet, but call:
// clarity('consent');
// ONLY from your CMP's accept callback. Without that call, Clarity withholds cookies.
cmp.onConsent('analytics', () => window.clarity && window.clarity('consent'));
Microsoft Clarity's official privacy/consent documentation →
RegSentry runs a real browser against your site, watches exactly when Microsoft Clarity (and every other tracker) first contacts a third-party server, and captures the evidence — including whether it intercepts keystrokes typed into your forms.
Is this tracker on your site? Find out free in 30 seconds.
Real browser scan, no signup to run it. You see a summary of the findings; the full report with every tracker unlocks with your email.