Is session replay legal? What SB 690 removes on January 1, and the claim it leaves behind

Is session replay legal? In California the answer moved on September 30, 2026, when Governor Newsom signed SB 690 - but in our reading it moved less than the coverage suggests. One of the two claims private plaintiffs use against website tracking disappears on January 1, 2027. The claim most session replay cases are actually built on survives intact, and it is the one that points at the vendor in your stack.

This post is about what changes for a team running a recording tool, not a case summary. We are not lawyers and this is not legal advice; the dates, statute text and court holdings below are linked to the sources we read on October 23, 2026.

Is session replay legal in California after SB 690?

Recording a visitor's session has never been unlawful in itself. What created the risk was a pair of claims under the California Invasion of Privacy Act (CIPA): a pen register and trap-and-trace claim under Penal Code Section 638.51, and a wiretap claim under Section 631. SB 690 takes the first one away from private plaintiffs. It does not touch the second.

That distinction decides whether the law changes anything for you. Pen-register claims were about the fact of collection - the pixel or script that routes identifiers to a third party. Section 631 claims are about contents: what the visitor typed, clicked and moved, intercepted while in transit by someone who is not a party to the conversation. Session replay is a contents story, which is why it sits on the wrong side of the line SB 690 draws.

What SB 690 removes, in its own words

The bill adds a new subdivision to Penal Code Section 637.2. Per Baker Donelson's reading of the enacted text, an action against a private actor for a violation of Section 638.51 "alleged to arise from conduct occurring on an internet website, online application, or mobile application" may be brought "only by the Attorney General." The private right of action for that one claim, on those surfaces, is gone.

Three details matter more than the headline:

• The date. It takes effect January 1, 2027, and the bill was signed on September 30, 2026.
• It reaches backwards. Subdivision (d)(2) applies retroactively to any pending claim in an action commenced within two years before the operative date, which Baker Donelson reads as actions commenced on or after January 1, 2025. A demand letter, it notes, is not a "pending claim."
• It may be contested. Hinshaw & Culbertson reports that CIPA plaintiffs plan to challenge the retroactivity provision on constitutional grounds, and that the Legislature added a severability clause so the rest of the law stands if that provision falls.

The claim it leaves behind points at your replay vendor

Section 631 survives with its statutory damages intact - $5,000 per violation, per Baker Donelson. ArentFox Schiff expects it to become plaintiffs' main theory, "particularly against session-replay and chat tools." Sections 632 and 632.7, the federal Wiretap Act and the Stored Communications Act are also untouched.

Two Ninth Circuit memoranda from June 2025 show what the surviving claim turns on. In Thomas v. Papa John's and Mikulsky v. Bloomingdale's, per Mayer Brown's summary, the court affirmed dismissal in the first because the plaintiff did not allege the company aided a third party in eavesdropping - a party cannot eavesdrop on its own communications. Two days later it reversed dismissal in the second, holding the plaintiff had sufficiently alleged that Bloomingdale's "aided, agreed with, employed, or conspired with" its session replay vendor to intercept the contents of her communications in transit.

In our view that is the practical test to apply to your own setup: not whether you record, but whether a third party receives contents it could use for itself. A self-hosted recorder and a vendor-hosted one are the same product and a different fact pattern.

Who has to act before January 1, and who does not

Act now if you are a named defendant in a California pen-register case filed on or after January 1, 2025. That is the population the retroactivity provision reaches, and the window to raise it with counsel is the next ten weeks.

Change nothing if your only CIPA exposure was a pen-register theory and you have no pending case. For private plaintiffs, that claim goes away on its own.

Do not loosen your configuration if you record contents - keystrokes, form text, page text. Nothing in SB 690 reduces Section 631 exposure, and Hinshaw's advice is to keep running a tracking-technology compliance program across cookies, pixels and SDKs rather than treat the bill as a reason to stop. Baker Donelson also lists Pennsylvania's WESCA and Florida's FSCA as continuing unaffected, so a California-only reading of your risk is incomplete.

You are out of scope if you use aggregate, cookieless analytics and no recording at all. Upfynd's analytics category - 228 products as of October 2026 - lists cookieless, aggregate-only tools alongside the recorders, and a tool that never reconstructs a session has no contents to intercept.

What your session replay tool masks by default

If the surviving claim is about contents, the setting that matters is what leaves the browser before anyone configures anything. Those defaults are not uniform. All four below are from each vendor's own documentation, read October 23, 2026.

The sources: Clarity masks input boxes and dropdowns in all modes and defaults to Balanced, which it defines as masking numbers and email addresses; PostHog masks inputs by default but states that general text is not masked by default; LogRocket says password fields are never recorded and that other inputs are recorded unless tagged data-private, whose default redaction type omits the typed input; and FullStory's Private by Default means no text is captured or sent outside the browser unless explicitly allowlisted, a mode its help center says is turned on by request to support.

Read across the rows and all four capture page text until someone changes a setting. Clarity's masking page also notes that changes apply only to new recordings and cannot be applied retroactively, so a configuration fix never cleans up what you already collected.

The same applies to heatmap and research tools that bundle recordings - Hotjar and Smartlook among the 142 products in Upfynd's UX & research category as of October 2026. Check each one's own suppression settings rather than assuming the category behaves alike.

What we would do with the next ten weeks

1. List every script that can reconstruct a session, web and mobile, and who receives the data. Hinshaw's recommendation covers cookies, pixels and SDKs; recorders belong on the same inventory.
2. Set the strictest masking mode your analysis can live with, then unmask specific elements - not the reverse. Clarity's Strict mode and FullStory's Private by Default are both built for that order.
3. Confirm what your contract says the vendor may do with the data for its own purposes. That is the fact the Mikulsky reversal turned on.
4. If you have a pending California pen-register claim filed on or after January 1, 2025, raise the retroactivity provision with counsel, and expect it to be contested.
5. Leave your consent flow alone until a lawyer tells you otherwise. SB 690 did not change Section 631, Section 632 or any non-California statute.

If the exercise ends with you deciding you do not need replay, the shortlist starts at Upfynd's analytics category, where cookieless and aggregate-only tools sit next to the recorders. We took the same approach to a different US rule in our write-up of what the FTC's review rule still allows: read the text, find the narrow thing that changed, and leave the rest of the program running.