Is Session Replay Legal? Jurisdiction by Jurisdiction

Is session replay legal? In every jurisdiction I’m aware of: yes, no law bans DOM recording of your own website. Also in every jurisdiction I’m aware of: a careless deployment can violate laws that were written decades before the technology existed. The gap between those two sentences is where all the litigation lives, and the gap is closed or opened almost entirely by configuration choices you control — masking, consent, and disclosure.

I’m going to walk through the major jurisdictions the way I’d brief my own team: what the law actually says, what plaintiffs’ lawyers are actually doing with it, and what the defensible setup looks like. I’m an engineer, not a lawyer, and this isn’t legal advice — it’s a map of where the questions are.

Is session replay legal in the United States?

There is no US federal law that addresses session replay, and no federal privacy statute that clearly prohibits it. The action is at the state level, and it comes from an unexpected direction: wiretap statutes.

The wiretap theory

Several states — California, Pennsylvania, and Florida are the active ones — have “two-party consent” wiretap or interception laws. Written for phone calls, they generally prohibit intercepting the contents of a communication unless all parties consent. Starting around 2021, plaintiffs’ firms began filing class actions arguing that a session replay script “intercepts” the “communication” between a user and a website, and that neither the site operator nor its replay vendor obtained the user’s consent.

Hundreds of these suits have been filed, most in California under CIPA (the California Invasion of Privacy Act) and a notable wave in Pennsylvania after a federal appeals court revived a wiretap claim against a retailer using a recording vendor. I won’t cite specific case names — the docket moves fast and half of what you read about individual cases is out of date — but the pattern across the California wiretap class actions is consistent:

• The third-party vendor is the legal linchpin. The strongest version of the claim is that the vendor is an eavesdropping third party intercepting the conversation between user and site. A site recording its own traffic, on its own infrastructure, is much harder to frame as “interception by a third party” — courts have repeatedly distinguished between a vendor acting as a mere tool (an extension of the site, like a tape recorder) and a vendor that receives and can use the data itself.
• What was captured matters. Cases where recordings included form inputs, health information, or chat contents look very different from cases involving click-and-scroll telemetry on a marketing page.
• Disclosure matters. A privacy policy that plainly discloses recording, and a consent banner that covers it, undercuts the “no consent” element. Many filed cases target sites that disclosed nothing.

Most of these suits settle or die at motion stage; a few have survived long enough to be expensive. The realistic US risk for a small SaaS is not a regulator — it’s a demand letter from a firm that ran a scanner across ten thousand sites looking for known replay scripts, and your response cost, not a verdict.

What this means in practice

Lawyers commonly advise US-facing sites to do three things: disclose session recording explicitly in the privacy policy, capture consent where feasible (or at minimum provide notice before recording on pages with form input), and configure the tooling so form contents are masked. My engineering read of the litigation pattern adds a fourth: the architecture itself is a variable. A recording pipeline where the script is served from your own domain and the data lands on infrastructure you control doesn’t hand a plaintiff the “third-party eavesdropper” framing that powers most of these complaints. That’s a genuine, if unquantifiable, risk reduction — and it’s one of the more defensible reasons teams pick a self-hostable tool like LogReplay over a third-party SaaS recorder for US traffic.

The EU and UK: legal, but consent is hard to avoid

In Europe the question is not wiretap statutes but the combination of GDPR and the ePrivacy Directive, and the analysis is more predictable.

GDPR governs the personal data in the recording — and a session recording of an identifiable user is personal data, full stop. You need a lawful basis under Art. 6, a disclosure under Arts. 13–14, retention limits under Art. 5(1)(e), and the rest of the standard machinery. This is all doable; I’ve written up the full checklist in our guide to session recording under GDPR.

The sharper constraint is ePrivacy. The directive’s terminal-equipment rule (the “cookie law,” though it covers more than cookies) requires consent for storing or accessing information on a user’s device except when strictly necessary to provide the service the user requested. Regulators including the ICO and the EDPB have been consistent that analytics-adjacent tooling is not “strictly necessary.” Session replay for debugging sits in a gray zone teams argue about, but the safe reading — and the one lawyers commonly advise — is that a replay script needs consent in the EU and UK, same as analytics.

So: legal, yes. Consent-free, probably not, if you’re playing it straight. The practical consequence is that EU replay deployments run behind a consent banner and accept the coverage loss, or run under a legitimate-interest argument with aggressive masking and accept the regulatory ambiguity. Both are defensible positions held by reasonable teams; pretending the question doesn’t exist is the only indefensible one.

Everywhere else, briefly

• Canada. PIPEDA requires knowledge and consent for collection of personal information, with a reasonableness standard. Treat it like a slightly softer GDPR: disclose, minimize, and get consent where the data is sensitive.
• Brazil. LGPD tracks GDPR closely enough that a GDPR-compliant setup is most of the way there.
• Australia. The Privacy Act’s APPs require notice of collection; no explicit consent regime for this category yet, but reform pressure is real.
• Health, finance, children. Sector rules override everything above. HIPAA in the US healthcare context deserves its own separate and much more cautious analysis; if your users are minors or your pages touch financial account data, assume stricter rules apply before deploying anything.

The configuration is the compliance

Here’s the part that gets lost in every “is session replay legal” discussion: the law doesn’t evaluate the product category, it evaluates your deployment. The same tool is a lawsuit magnet in one configuration and a non-event in another. Ranked by how much each choice actually moves the risk, in my engineering opinion:

1. Masking form inputs, client-side. This single setting changes the character of what you’re doing under both the US wiretap theory (contents of communications) and GDPR (data minimization). Unmasked keystroke-level capture of forms is the fact pattern behind the ugliest cases.
2. Disclosure. A specific, plain-language statement that sessions are recorded, why, and for how long. Cheap, fast, and it removes the “surreptitious” framing that both plaintiffs and regulators lead with.
3. Consent gating where required. EU/UK: gate the script on consent. US: at minimum on pages with sensitive input, and increasingly the conservative advice is everywhere.
4. Data flow architecture. First-party script, data on your infrastructure, no vendor with independent access. Kills the third-party interception theory and the GDPR transfer problem in one move.
5. Retention. Thirty days of recordings is a debugging tool; two years of recordings is a surveillance archive. Judges, regulators, and your own security team will all read it that way.

Do the first two this week regardless of jurisdiction. Do all five if you record EU users or handle anything sensitive.

The honest summary: session replay is legal the way driving is legal. Nobody bans it; everybody expects you to follow rules that depend on where you are; and most crashes involve someone who wasn’t paying attention rather than someone who couldn’t have known better.