“Session replay” software is one of many website analytics tools targeted in wiretapping suits under the California Invasion of Privacy Act (“CIPA”). Last month, a California federal court confirmed one of the many reasons why the use of this software does not violate CIPA section 631: A defendant cannot “read” (or attempt to read) session replay data “in transit,” as CIPA requires, because “events recorded by” this software “do not become readable content until after they are stored and reassembled into a session replay.” Torres v. Prudential Financial, Inc., 2025 WL 1135088 (N.D. Cal. Apr. 17, 2025).
Plaintiffs in this case filled out an online form on Prudential’s website to obtain a life insurance quote. This online form allegedly incorporated a vendor’s “session replay” software to capture data about website visitors’ interactions with the form “for the purpose of later reassembling a session replay”—in other words, “a recreation of the events that took place on the webform.”
Plaintiffs claimed this violated CIPA section 631, based on the theory that the session replay vendor (ActiveProspect) wiretapped their communications with Prudential’s website, and Prudential aided and abetted the alleged wiretapping. After the Court granted class certification, Defendants Prudential and ActiveProspect moved for summary judgment.
The Court granted summary judgment in Defendants’ favor because “nothing in the record plausibly indicates that ActiveProspect reads or attempts to read the contents of the communication while they are in transit,” as CIPA section 631 requires. “[R]eading requires an attempt to understand the substantive meaning of a communication,” which ActiveProspect could not do while the captured data was “in transit.” As the Court explained, data captured using the session replay software “cannot be meaningfully read or understood until later,” when “a session replay is reassembled.” In granting summary judgment, the Court rejected an interpretation of “in transit” that “encompass[es] any hypothetical future attempt to read” the data, because “it would stretch CIPA’s statutory language too far.”