Court decision · 31 May 2022
Javier v. Assurance IQ, LLC
No. 21-16351, 2022 WL 1744107 (9th Cir. May 31, 2022) (unpublished) · U.S. Court of Appeals for the Ninth Circuit
What it means for your code
Session replay and chat transcripts need consent before recording starts, not in a footer or at form submission.
What happened
A website used a session-recording tool (TrustedForm) that captured a visitor's interactions while he filled out an insurance quote form, and asked for consent only at the end.
What was decided
Under California's Invasion of Privacy Act §631, consent must be obtained before the communication is recorded; retroactive consent is insufficient.
The legal test applied
- CIPA §631 requires the prior consent of all parties to a communication
- Consent obtained after recording began does not cure the interception
What would have changed the outcome
- Courts are split on whether a site's own vendor is an eavesdropping third party or an extension of the site
- Recording that starts only after explicit prior consent
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.