Website chat, session replay and wiretap laws: what practice owners should know

A chat box on the home page, a script that records how visitors scroll and click, a form that sends each keystroke to an outside vendor. These tools help a practice see what works on its site. They have also become the basis for lawsuits that say a website let a third party listen in on a conversation, using wiretap laws written for telephones.

This guide is for practice owners and managers who run a website with chat, session replay, analytics or a scheduling widget. It covers the California and Pennsylvania laws that these claims rely on, what two federal appeals courts have said, where HIPAA fits, and how to write notices and set up tools so the site says plainly what it does. Scripts that record what people type into a booking form they never send are covered in following up on abandoned appointment requests.

The short version

• The claim is about a third party. These suits say an outside vendor read or recorded what a visitor typed or did on your site while it was happening, without the consent the state law requires.
• California asks for consent from all parties. Penal Code 631(a) covers reading or learning the contents of a communication without the consent of all parties, and 637.2 lets an injured person sue for the greater of 5,000 dollars per violation or three times actual damages.
• California also has a pen register section. Penal Code 638.51 says a person may not install or use a pen register or trap and trace device without a court order, with an exception where the user consents.
• Pennsylvania asks for consent from all parties too. 18 Pa.C.S. 5704(4) allows interception where all parties have given prior consent, and 5725 lets a person sue for at least 1,000 dollars in liquidated damages.
• Courts are not settled. The Third Circuit held that a website’s marketing vendor can be the one who intercepts under Pennsylvania law. The Ninth Circuit later held that a plaintiff whose only data was pet store browsing had no concrete injury, and noted that sensitive medical information could be different.
• A health site is the sensitive case. Keep chat, replay and third-party tags off the pages where people type symptoms, book visits or log in.

Why a website tool can lead to a wiretap claim

A wiretap law makes it unlawful to intercept a communication. The early versions were about phone lines. The website cases argue that a visitor’s messages to a site, such as chat text, search terms, form entries and clicks, are communications, and that a vendor whose script runs on the page receives them at the same moment as the site. If the vendor is a separate party and the visitor did not agree, the argument goes, the vendor intercepted the communication and the site helped.

Three kinds of tools come up in these claims:

• Chat widgets. A chat box run by an outside company sends the visitor’s messages to that company’s servers. If the vendor stores or analyzes the text for its own purposes, a plaintiff may call that interception.
• Session replay scripts. These record mouse movements, clicks, scrolling and form entries so the site owner can watch a visit back. The HHS online tracking bulletin names session replay scripts among the tracking technologies websites use.
• Tags and pixels. Code that sends page views and events to an analytics or ad company. Claims about these tools under the California pen register section say the code collects addressing and routing information about the visitor.

None of this means a court will agree with a given plaintiff. It means a practice website is part of the conversation, and the defense starts with knowing which tools run on which pages, and what the site tells visitors.

California: Penal Code 631 and all-party consent

California Penal Code 631(a) has several parts. The part these website claims rely on covers a person who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads or attempts to read, or to learn the contents or meaning of, a message, report or communication while it is in transit or passing over a wire, line or cable, or is being sent from or received at a place in California. It also reaches a person who uses information obtained that way, and a person who aids, agrees with, employs or conspires with someone to do those things.

The section is a crime, punishable by a fine of up to 2,500 dollars, county jail of up to one year, or both, with higher fines for repeat offenses. The private lawsuit comes from Penal Code 637.2(a): a person injured by a violation of the chapter may sue for the greater of 5,000 dollars per violation or three times actual damages. Section 637.2(b) also allows an injunction.

Two points matter for a practice. The consent standard is all parties, so the visitor’s agreement matters, not only yours. And the aiding and employing language is what plaintiffs use to name the website owner alongside the vendor.

For phone calls, our call recording consent guide covers California Penal Code 632 and the recorded-line greeting. The website claims use a different section, but the same all-party idea.

California: the pen register section, 638.51

California Penal Code 638.51(a) says a person may not install or use a pen register or a trap and trace device without first obtaining a court order under Section 638.52 or 638.53. Section 638.51(b)(5) allows a provider of electronic or wire communication service to use one if the consent of the user of that service has been obtained. A violation is a crime under 638.51(c), with the same fine and jail range as 631.

The definitions are in Penal Code 638.50. A pen register is a device or process that records or decodes dialing, routing, addressing or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication. A trap and trace device is a device or process that captures incoming impulses that identify the originating number or other dialing, routing, addressing or signaling information reasonably likely to identify the source of a communication, but not its contents.

Plaintiffs argue that a tracking script that collects a visitor’s IP address or device details is a trap and trace device under those words. The section was written for telephone surveillance, and courts have not all read it the same way, so treat this as a live risk rather than a settled rule. Because 637.2 applies to violations of the whole chapter, these claims also seek the 5,000 dollar statutory amount.

Pennsylvania: the Wiretapping and Electronic Surveillance Control Act

Pennsylvania’s law is Chapter 57 of Title 18. Under 18 Pa.C.S. 5703, a person commits a third degree felony if they intentionally intercept, or procure another person to intercept, a wire, electronic or oral communication, or intentionally disclose or use the contents knowing they came from an interception.

Section 5702 defines intercept as aural or other acquisition of the contents of a communication through the use of an electronic, mechanical or other device, and defines contents as any information concerning the substance, purport or meaning of the communication. Section 5704(4) says it is not unlawful for a person to intercept a communication where all parties to the communication have given prior consent.

The civil remedy is in 5725(a). A person whose communication is intercepted, disclosed or used in violation of the chapter may recover actual damages, but not less than liquidated damages of 100 dollars a day for each day of violation or 1,000 dollars, whichever is higher, plus punitive damages and reasonable attorney fees and litigation costs.

The federal law is one-party, with a condition

The federal Wiretap Act is less strict on consent. Under 18 U.S.C. 2511(2)(d), it is not unlawful for a person not acting under color of law to intercept a communication where that person is a party to it or where one of the parties has given prior consent. The exception does not apply if the communication is intercepted for the purpose of committing a criminal or tortious act in violation of federal or state law.

That last condition is why federal claims about health websites point to HIPAA or state privacy law as the tortious or criminal purpose. Whether that works depends on the facts and the court. For a practice, the safe reading is simple: do not count on one-party consent for a tool that sends patient information to an outside company.

What two federal appeals courts have said

Trial courts have ruled on these claims in different directions. We cite only two published appeals court opinions here, and we describe only what they held.

Popa v. Harriet Carter Gifts (3d Cir. 2022). A shopper browsed a retailer’s site while a marketing vendor’s code sent her clicks, searches and form activity to the vendor. In its precedential opinion filed August 16, 2022, the Third Circuit held that the Pennsylvania act has no broad exception for a party to the communication outside the law enforcement setting, so a vendor receiving the signals could be treated as intercepting them. It also held that the place of interception is the point at which the signals were routed to the vendor’s servers. It sent the case back for the trial court to decide where that happened, and whether the retailer’s privacy policy was enough to show that the shopper consented.

Popa v. Microsoft Corp. (9th Cir. 2025). The same plaintiff sued over a session replay tool on a pet supply site. On August 26, 2025, the Ninth Circuit affirmed dismissal for lack of Article III standing. It held that she had not alleged a concrete injury, because tracking her pet store preferences and her street name did not resemble the highly offensive intrusions or disclosures that courts have long treated as privacy wrongs. The court also said the software could be offensive in particular circumstances, and gave sensitive medical or financial information as examples.

Put together: one appeals court read the Pennsylvania statute broadly, and another closed the federal court door to a plaintiff with no sensitive data at stake. A practice website is the place where sensitive data is at stake, so the Ninth Circuit’s example cuts against relying on that ruling.

Where HIPAA fits

HIPAA is a separate question from the wiretap laws, and it applies to covered entities and their business associates. The HHS Office for Civil Rights bulletin on online tracking technologies says tracking on authenticated pages generally has access to protected health information, and that tracking on public pages where people schedule appointments or use a symptom checker can disclose it. The bulletin lists session replay scripts among the technologies it covers.

On June 20, 2024, the U.S. District Court for the Northern District of Texas vacated part of that guidance in American Hospital Association v. Becerra. The note HHS placed at the top of the bulletin says the court vacated it to the extent it says HIPAA obligations are triggered when an online technology connects an individual’s IP address with a visit to an unauthenticated public page addressing specific health conditions or providers. The rest of the bulletin remains on the HHS site. Our guide to tracking pixels on practice websites covers the bulletin and the ruling in more detail.

A site that keeps third-party tools out of protected areas lowers both risks at once. A HIPAA question asks whether protected health information went to a vendor without a business associate agreement or an authorization. A wiretap question asks whether a third party received the contents of a communication without consent. The same chat transcript can raise both.

Notices and banners: Use and Avoid

Consent is the main defense the statutes give you, so the wording on the page matters. Write it for a patient who reads quickly, and put it where the tool is, not only in a policy page linked from the footer.

• Chat window, use: “This chat is run for [Practice name] by an outside service provider, which stores the messages to provide the service. Please do not share medical details here. To discuss your health, call us or use the patient portal.” Avoid: “Your conversation is private” when a vendor stores the text.
• Chat used for scheduling, use: a notice that names the purpose and links to the privacy policy, shown before the first message is sent. Avoid: a notice that appears only after the visitor has typed.
• Banner, use: “We use analytics on this site to see which pages are used. You can accept or reject analytics cookies.” with Accept and Reject buttons of equal weight, and tags that do not load until the visitor chooses. Avoid: “By using this site you agree to all cookies” with tags already running.
• Privacy policy, use: a plain list of the tools on the site, what each one collects, which pages it runs on, and how to opt out. Avoid: general wording such as “we may share data with partners” that does not tell a visitor what happens on the booking page.

Two limits apply. A banner is not a HIPAA authorization: the HHS bulletin says a cookie banner where visitors accept or reject cookies does not meet the authorization requirements. And a notice cannot fix a tool that collects what it should not. Settings come first. Our privacy policy guide explains how the website policy and the Notice of Privacy Practices fit together, and our cookie banner guide covers banner design and tag settings.

Session replay and chat on a practice site: what to check

• Make a list of the scripts. Open the site with your browser’s developer tools and record each outside domain the pages load. Compare the list with the tools you think you use.
• Keep replay off sensitive pages. Exclude the booking flow, intake and contact forms, symptom checkers, the portal login and anything behind a login. If you keep replay elsewhere, turn on input masking so typed text is not captured, and test that it works.
• Check what the chat vendor does with transcripts. Read the terms for whether the vendor uses messages for its own purposes, such as training or analytics, and whether you can turn that off. Ask in writing whether it will sign a business associate agreement and what that agreement covers.
• Route clinical questions away from chat. Tell visitors to call or use the portal for health questions, and set the bot to reply with that message when it sees symptom words. Our AI chatbot guide covers bot setup in more detail.
• Load tags after a choice. If a visitor rejects analytics, the tags should not fire. Test it in a private browser window.
• Keep a dated record. Save a copy of the banner, chat notice and privacy policy each time you change them, with the date and the list of tools. If a demand letter arrives, this is what your attorney will ask for first.

An illustration

This example is invented. [Practice name] is a dermatology practice with patients in California. Its site has a chat box from an outside vendor on each page, a session replay script for usability testing, and an online booking form.

Dr. [Name] asks the web team to review it. The team finds that the replay script records the booking form, including the reason for visit field, and that the chat vendor keeps transcripts and may use them to improve its product. The practice turns replay off on the booking and contact pages and turns on input masking for the rest. It moves the chat box off the booking page, adds a notice above the chat box asking visitors not to share medical details, and changes the banner so analytics load only after the visitor accepts. Its attorney reviews the new wording and the vendor terms before the changes go live.

None of this promises the practice will never receive a demand letter. It means the practice can show what its site does and what it told visitors.

Checklist

• List of each outside script on the site, with the pages it runs on
• Session replay off on booking, intake, contact, symptom and login pages
• Input masking on and tested wherever replay stays
• Chat vendor terms read for transcript use, and BAA scope confirmed in writing
• Chat notice shown before the first message, asking visitors not to share medical details
• Banner with equal Accept and Reject, and tags that wait for the choice
• Privacy policy lists the tools, what they collect and how to opt out
• Dated copies of the banner, chat notice and policy saved
• Attorney review of the setup for each state where you see patients

How we help

We build websites, local search, Google Ads and lead generation and AI front desk tools for independent practices and health businesses. On the website side, that means a list of the scripts on each page, forms kept free of third-party tracking, and chat and banner notices written in plain words for your attorney to review. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules hub.

Sources

• California Penal Code 631 (Internet Archive copy of the official page, September 18, 2026)
• California Penal Code 637.2: Civil action (Internet Archive copy, August 10, 2026)
• California Penal Code 638.50: Definitions, pen register and trap and trace device (Internet Archive copy, May 20, 2026)
• California Penal Code 638.51: Pen register and trap and trace devices (Internet Archive copy, April 12, 2026)
• 18 Pa.C.S. Chapter 57: Wiretapping and Electronic Surveillance, including 5702, 5703, 5704 and 5725 (Pennsylvania General Assembly)
• 18 U.S.C. 2511: Interception and disclosure of wire, oral, or electronic communications prohibited
• Popa v. Harriet Carter Gifts, Inc., No. 21-2203 (3d Cir. opinion filed August 16, 2022), Internet Archive copy of the court’s PDF
• Popa v. Microsoft Corp., No. 24-14 (9th Cir. August 26, 2025)
• HHS OCR: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (with the note on the June 20, 2024 court order)

More in Practice websites, privacy and tracking