Is it risky to use session replay or analytics SDKs in my app?

Why session replay, autocapture, and tracking pixels lead to lawsuits and enforcement, and how to configure analytics so your privacy policy stays true.

Short answer

It can be. Session replay, autocapture, and advertising pixels collect far more than most teams realize, and that gap between what your privacy policy says and what the SDK sends is where the risk is. Lawsuits under state wiretapping laws and FTC enforcement over health data have both targeted exactly this. Analytics configured to send only named events with no user content is low-risk.

Where the risk comes from

• Wiretapping and eavesdropping claims. Plaintiffs have filed many class actions arguing that session replay and chat tools let a third party "intercept" users' communications without consent, under federal and state wiretapping laws. Recent results are mixed and turn on what was captured and what users were told. Defending these suits is expensive even when you win.
• Health data. The FTC has acted against health companies that sent health information to advertising and analytics platforms contrary to their privacy promises. GoodRx, the first case under the FTC's Health Breach Notification Rule, agreed in 2023 to a $1.5 million civil penalty, a ban on sharing health data for advertising, and consent requirements for other disclosures. BetterHelp agreed in 2023 to $7.8 million in consumer refunds and a ban on sharing health data for advertising. These were settlements, not rulings that every pixel is illegal, but they show the risk. In 2024 the FTC amended the Health Breach Notification Rule to make clear that an unauthorized disclosure, not only a hack, can be a breach, and that many health apps outside HIPAA are covered. So sending health data through an advertising pixel can create breach-notification duties, not just a privacy-policy problem. Washington's My Health My Data Act adds its own consent requirements and private lawsuits.
• Video viewing. Plaintiffs argue that sending what users watched, along with an identifier, to an advertising platform through a pixel violates the federal Video Privacy Protection Act. Appeals courts have split over who counts as a protected "consumer," and the Supreme Court heard argument in Salazar v. Paramount Global on October 14, 2026. A decision is pending, and it won't settle every question about pixel-based disclosures.
• False statements. If your privacy policy says you don't collect something and an SDK does, the policy is deceptive regardless of whether anyone intended it.

How the lawsuits are going

• Ordinary browsing is weaker ground for plaintiffs. In May 2026 the Third Circuit held that shoppers who only browsed a retailer's site lacked standing to sue over session replay, but that shoppers whose full payment-card details were captured at checkout could proceed (In re BPS Direct). In September 2026 a federal court in Washington dismissed the remaining session-replay claims against Zillow and Microsoft.
• Sensitive data changes the picture. Payment details, health information, and sensitive form entries make it much easier for a plaintiff to show real injury.
• Consent has to be real. In October 2026 a Pennsylvania appeals court revived a session-replay suit against Clarks, rejecting the argument that visitors consent to interception just by using the internet and asking whether they had adequate notice of third-party tracking. A privacy-policy link alone may not be enough.
• California is narrowing one type of suit. SB 690, signed in September 2026 and effective January 1, 2027, ends private lawsuits under the California Invasion of Privacy Act's pen-register provision (Section 638.51) for website and app tracking, leaving those claims to the Attorney General, and applies to some pending cases. It does not end private wiretapping claims under Section 631, which covers the contents of communications, or claims under other laws.

These are patterns, not rules. The statute, the court, what the software actually captured, and how it was configured all affect the outcome.

What to watch for

• Session replay records screens, including what users type and tap. Masking reduces this but rarely eliminates it: tap positions alone can reveal which option a user picked.
• Autocapture sends screen views, taps, and lifecycle events automatically, and defaults change between SDK versions.
• Event properties often carry user content without anyone noticing: a habit name, a search term, a mood value.
• Initialization order: SDKs that start before the user accepts your terms send data you have not disclosed or obtained consent for.
• Advertising and attribution SDKs share data with platforms that use it for their own purposes, which most privacy laws treat as sharing or selling.

A configuration that keeps policies true

• Initialize analytics opted out, and opt in after the user accepts your terms.
• Turn off session replay, autocapture, screen views, and lifecycle events explicitly in code, and in the vendor's project settings where they exist.
• Send only named events, and never include anything a user typed, selected, or uploaded.
• Identify users by a random ID, not by email or name.
• Re-test after every SDK upgrade.

Checklist an agent can run against the codebase

• List every analytics, crash-reporting, attribution, advertising, chat, and replay SDK, with versions.
• For each one, quote its configuration for replay, autocapture, screen views, and lifecycle events.
• Find where each SDK is initialized and whether that happens before the user accepts the terms.
• List every custom event and its properties, and flag any property containing user content.
• Check what identifier each SDK receives.
• Check whether URLs, page or screen titles, or form fields sent to any SDK reveal health conditions, medications, or what video a user watched.
• Compare the results to the privacy policy and the app store privacy labels.

Sources

• Third Circuit: In re BPS Direct (May 2026)
• Pennsylvania Superior Court: Thompson v. C. & J. Clark America (October 2026)
• W.D. Wash.: In re Zillow Group Session Replay Software Litigation (September 2026)

If this applies to you

Turning on session replay, adding an attribution SDK, or adding an event that carries user content is a pre-build feature check. For a full review of an app's analytics against its policies, see the app launch legal package.