Session recording, ad pixels, and the California problem

A remodeling contractor in Glendale asked us a good question last month: “My agency put a Facebook pixel and a session recorder on my site three years ago. Should I care?”

Probably. Here is why, in plain language, with no scare tactics and no legal advice.

What this code actually does

An advertising pixel is a small piece of JavaScript. When someone loads a page that has one, the pixel sends a message to the advertising platform. That message contains, at minimum:

• The address of the page being viewed
• A referring page
• An identifier for the browser, usually a cookie the platform already set
• Whatever custom event the site was configured to send — ViewContent, Lead, Purchase

A session recorder goes considerably further. It streams a reconstruction of the visit to a third party: mouse movement, scrolling, clicks, and — depending on configuration — what was typed into forms before anything was submitted.

That distinction matters. A pixel reports that a page was seen. A recorder reports what the visitor did on it, keystroke by keystroke, to a company the visitor has never heard of.

Why that became a lawsuit

California has a wiretapping statute, CIPA, written long before websites existed and drafted broadly enough to be argued at them. Plaintiffs’ firms have brought a large volume of claims on the theory that a third-party script capturing a visitor’s interactions is a party listening in on a communication without consent.

Separately, the CCPA and CPRA impose duties on what you share with advertising platforms, require an honest “Do Not Sell or Share” mechanism, and require that Global Privacy Control signals be honored.

You do not need to follow every case to take the practical lesson: code that captures visitor behaviour and sends it to a third party, before that visitor agreed to anything, is the pattern being targeted — and it is running on a great many ordinary business websites that nobody would describe as sensitive.

The exposure concentrates where the value does: forms, checkout, and booking confirmation pages. Those are exactly where an agency wants to fire a conversion event, and exactly where the captured data is most personal.

The four places we usually find it

When we audit a site, tracking risk usually sits in the same handful of places:

1. Confirmation pages. A pixel event named Lead or Purchase, firing on a URL that carries the customer’s details in the query string.
2. Session recorders installed and forgotten. Hotjar, Clarity, FullStory and similar, added during a redesign years ago, still streaming, with form-field masking never configured.
3. Tags that fire before the consent banner is answered. The banner is decorative — it changes nothing about what already loaded.
4. Tag manager containers nobody has opened in two years. Tags added by a former agency, still live, with no record of who added them or what they send.

The first thing worth doing is not legal. It is an inventory: open your tag manager, list every tag, and for each one answer who added it, what it sends, and whether it fires before or after consent. Most owners cannot answer any of the three, which is itself the finding.

How to run ads anyway

None of this means giving up measurement. It means measuring outcomes instead of behaviour.

Consent denied by default. Google Consent Mode v2 with denied defaults, so no advertising or analytics storage happens before a choice is recorded. Honor Global Privacy Control automatically, without requiring anyone to interact with a banner.

Server-side conversions. Send the outcome from your server — a booked job, a signed contract, a completed order — rather than letting a browser-side script observe the visitor and infer it. The platform learns that a sale happened and which campaign produced it, and nothing else.

Outcome-only payloads. The conversion event carries a value and a campaign identifier. It does not carry the page path, the form contents, or anything about the person that was not required to make the match.

No session recording. For most businesses the insight it buys does not come close to justifying the exposure. If you genuinely need to watch how a checkout fails, run it as a scheduled test with consent, not as an always-on stream.

This is a solved engineering problem and it costs less than most owners expect — usually a few days of setup, once.

What we are not saying

We are a marketing agency, not your lawyer. We report what is running on your site and how it is configured; we do not tell you whether any of it violates a statute, and we do not certify anything as compliant. Whether your exposure matters depends on facts about your business that belong with counsel.

What we will say is narrower and more useful: nearly every site we scan is running at least one tag nobody can account for, and finding out what they are is free.

The free audit lists what it detects in your page source, with the evidence it found, and says plainly what it did not check. Start there, then decide what deserves a conversation with your attorney.