Stage 4: Consent before tracking

The short answer

Analytics, session replay, ad pixels and chat widgets can record what people do on your site, and many of them need consent before they load. For visitors in the EU, load nothing that stores or reads data on their device until they agree, and make "Reject" as easy as "Accept". In California, honor the Global Privacy Control signal if the CCPA covers you and you sell or share data, and treat session replay as a lawsuit risk, because wiretap claims at $5,000 per violation survive the new SB 690 law. Then test that "Reject" really stops the tracking, because a banner that does nothing has already cost one company $1.55 million.

Why this matters

These are real cases. Each one has a source you can open.

• Refusing was harder than accepting. On 1 September 2025, France's data regulator, the CNIL, fined Google 325 million EUR in total. One reason: when people created a Google account, advertising cookies were placed without valid consent, and it was "more difficult to refuse" them than to accept (CNIL).
• Not only big tech. The same week, the CNIL fined the retailer SHEIN 150 million EUR for placing cookies without consent (CNIL).
• A banner that did nothing. In July 2025, California's Attorney General settled with Healthline for $1.55 million. Its cookie banner did not turn off tracking cookies when a visitor unticked the box, and it kept sharing data after people opted out (California AG).
• Ignoring the browser signal. In 2022, Sephora paid $1.2 million, in part because it did not process opt-outs sent by global privacy controls (California AG). In February 2026, Disney agreed to pay $2.75 million: its opt-out by signal applied only to the device, not to the logged-in account (California AG).
• Signals not switched on. In September 2025, the California Privacy Protection Agency fined Tractor Supply $1.35 million. Its site did not honor opt-out signals until July 2024, and its "Do Not Sell" form did not opt people out. The agency called it its largest fine (CPPA).
• Recording before consent. In Javier v. Assurance IQ (2022), a federal appeals court revived a session replay suit because the site recorded what the user typed before he saw the privacy policy. The court read California's wiretap law as requiring consent before the recording starts. This is from law-firm summaries; I did not read the opinion (DLA Piper).
• A jury and an SDK. On 1 August 2025, a jury found Meta liable under California's recording law for cycle and pregnancy data its SDK collected from users of the Flo app. Meta's own filing says plaintiffs seek $5,000 per class member and claim up to about 1.25 million members. Damages were not final as of 2026-10-09 (Meta 10-Q). Stage 5 covers health data in depth.

Core concepts

What counts as tracking

Analytics tools count visits and actions so you can see how people use your app. Session replay goes further: it records clicks, scrolling and what appears on screen, so you can watch a visit like a video. Autocapture is a setting that records every click and form interaction without you choosing which ones. A tracking pixel is a tiny image or script from an ad company that reports the visit back to that company. A cookie is a small file a site stores in the browser; similar technologies include local storage and pixels.

The EU rule is not only about cookies. The European Data Protection Board (EDPB), the group of EU data regulators, says the rule also covers tracking pixels and tracking links: sending a pixel to a device counts as storing information on it, and collecting the identifier counts as reading it (EDPB Guidelines 2/2023).

Worked example. I use PostHog for analytics on Ducktate. When I checked on 2026-10-09, session replay was off, but only because of a setting in the PostHog dashboard. Nothing in my website's code pins it off, so one toggle would turn it on for every visitor. My iPhone app pins replay off in code, with a unit test. My website also has no consent banner: PostHog and Google Analytics both load when the page loads. That is an opt-out model, and I have not yet assessed whether it meets EU rules. It is still open as of 2026-10-09. If the tool's dashboard is the only thing between you and recording every visitor, pin the setting in code.

Consent in the EU: reject as easy as accept

The EU's ePrivacy Directive, Article 5(3), allows storing or reading information on a user's device only with consent, unless it is strictly necessary for a service the user asked for. Strictly necessary covers things like keeping a user logged in. Analytics, replay and ad pixels are not strictly necessary. The EDPB quotes the article in its guidelines; I could not load the official EU text, so I rely on that quotation.

Consent here means a clear, positive action, given before the tracking starts. In 2023, the EDPB's cookie banner taskforce reported that a vast majority of EU regulators treat a banner as breaking the rules if a layer has an accept button but no reject option. It also says no cookie that needs consent may be set before consent. The report is not binding, and it says it is no "greenlight" from any regulator (EDPB taskforce report).

France has enforced this point for years. In January 2022, CNBC reported that the CNIL fined Google 150 million EUR and Facebook 60 million EUR because refusing cookies was not as easy as accepting them (CNBC). The 2025 Google fine above made the same point again.

Vendors now build this in. Since 31 October 2025, Microsoft Clarity, a session replay and heatmap tool, requires a valid consent signal for full function on visits from the EEA, the UK and Switzerland (Microsoft Clarity consent mode).

Worked example. Two banners:

Weak:    We use cookies to improve your experience.
         [ Accept all ]   Manage settings (small grey link)

Better:  We use analytics cookies to see which pages people use.
         [ Accept ]   [ Reject ]
         (same size, same style, same layer; nothing loads until a click)

On the better banner, a click on Reject loads no analytics at all, and the choice is saved so the banner does not come back on every page.

California: opt-out and Global Privacy Control

The US mostly uses an opt-out model: you may collect, but people can tell you to stop. The EU uses opt-in for trackers: you may not start until people agree.

Global Privacy Control (GPC) is a setting in some browsers and browser extensions that sends every site a signal meaning "do not sell or share my data". California's CCPA regulations, 11 CCR Sec. 7025, require a business that sells or shares personal information to treat an opt-out preference signal in a commonly used format as a valid opt-out request, and it gives an HTTP header or a JavaScript object as examples of that format. The text does not name GPC itself, but the Sephora case was about global privacy controls (11 CCR 7025).

Who this applies to matters. The CCPA only covers businesses that pass a size test, such as revenue above $26,625,000 or buying, selling or sharing the data of 100,000 or more Californians (Stage 3 has the full test). Many small apps fall below it. But if you do pass it, ad pixels can count as selling or sharing: in the Disney and Honda cases, the regulators pointed to data going to advertising companies (CPPA on Honda).

The enforcement cases also show what a working opt-out looks like:

Sources: Disney, Honda, Todd Snyder.

Session replay and California wiretap suits

The California Invasion of Privacy Act (CIPA) is an old anti-wiretapping law. It lets anyone harmed by a violation sue for $5,000 per violation, or three times their actual damages if that is more (Penal Code 637.2, FindLaw copy). The official California site blocked my tools, so that link is a copy. Law firms say no proof of actual harm is needed. Plaintiffs use three theories against websites:

1. Wiretap (Penal Code 631): a third party reads or learns what someone types in transit without everyone's consent. Used against session replay, chat widgets, and pixels that send form content.
2. Eavesdropping and recording (Penal Code 632 and 632.7): recording confidential communications without all-party consent. This is the theory the Flo jury used against Meta.
3. Pen register (Penal Code 638.51): a term from phone surveillance law. Plaintiffs argue that a pixel or SDK that collects IP address or device data is a pen register.

Some suits fail. In Popa v. Microsoft (2025), a federal appeals court threw out a session replay suit over Microsoft Clarity because the plaintiff showed no concrete harm. That comes from a search summary of a post on Eric Goldman's law blog; I did not read the post itself (Goldman's blog). That was a ruling on standing, not on whether replay is lawful, and state courts do not have the same limit. In Massachusetts, the state's top court held in 2024 that its wiretap law does not reach website tracking (Wiley summary).

What SB 690 changed. Governor Newsom signed SB 690 on 30 September 2026. I read law-firm summaries; the official bill site blocked my tools, and the governor's signing message is a scanned image (WilmerHale, Baker Donelson, Pillsbury).

Worked example. Your agent adds a session replay tool that starts on page load. A California visitor types into your sign-up form and your support chat. SB 690 does not help you: a suit over that recording would use the wiretap or recording theories, which SB 690 did not touch. The fix is the same as in the Javier case: show notice and get consent before recording starts, or do not record at all.

Setting up the tools

PostHog. The project setting "Record user sessions" is off by default in PostHog's code. Once someone turns it on, the web library records from the moment a visitor lands, unless your code sets disable_session_recording: true (PostHog config, PostHog replay controls). For consent, PostHog documents opt_out_capturing_by_default: true, then opt_in_capturing() on accept and opt_out_capturing() on reject. Opting out blocks autocapture, manual events and replay (PostHog data collection). PostHog also offers a cookieless mode that stores nothing on the device.

posthog.init("<your project token>", {
  opt_out_capturing_by_default: true, // capture nothing until the visitor agrees
  disable_session_recording: true,    // replay stays off unless you start it
  autocapture: false,                 // no automatic click and form capture
  capture_pageview: false,            // send only events you chose
  person_profiles: "identified_only",
});

function onAccept() { posthog.opt_in_capturing(); }
function onReject() { posthog.opt_out_capturing(); }

PostHog's docs suggest loading the library in opted-out mode instead of not loading it at all. I could not confirm whether an opted-out PostHog still contacts its server, so for EU visitors, open your browser's developer tools, click Reject, reload, and check the Network and Cookies tabs yourself.

If you do record, know the masking defaults. PostHog masks form inputs by default, but not other text on the page, and it does not mask network request bodies. Its docs call masking password fields "highly recommended as a minimum" and warn that a "show password" toggle turns the field into plain text. The class ph-no-capture hides an element from replay and autocapture (PostHog replay privacy).

Microsoft Clarity. The default masking mode, Balanced, masks numbers and emails, and input boxes are masked in every mode. Strict mode masks all text (Clarity masking). For EEA, UK and Swiss visits, send the consent signal through Clarity's Consent API or a supported consent tool.

Hotjar. Hotjar's help center blocked my tools. A summary of its page says Hotjar hides typed text by default. Check its Data suppression settings yourself before you rely on that.

Key terms

The checklist

• Keep a one-page list of every tracker on your site and app: what it is for, what data it sends, whether it waits for consent, and whether you have a contract with the vendor.Must doSource: CPPA on Tractor Supply, CPPA on Honda
• For visitors in the EU, load no analytics, replay, ad pixel or chat widget that stores or reads data on their device until they accept.If it appliesSource: EDPB Guidelines 2/2023, PostHog data collection
• Put a Reject button on the same layer as Accept, with the same size and style.If it appliesSource: EDPB cookie banner report, CNIL on Google, 2025
• If you have a banner or an opt-out, test that Reject really stops tracking: click Reject, reload, and check the Network and Cookies tabs in your browser's developer tools.If it appliesSource: California AG on Healthline
• Turn session replay off in your code, not only in the vendor dashboard, until you have a reason and a consent step.Should doSource: PostHog config, PostHog replay controls
• If you record sessions, show notice and get consent before recording starts.If it appliesSource: DLA Piper on Javier
• If you record sessions, mask all inputs and sensitive text, block payment, login, settings and chat pages, and scrub network request bodies.If it appliesSource: PostHog replay privacy, Clarity masking
• Turn off autocapture and send only the named events you chose.Should doSource: PostHog data collection
• If the CCPA covers you and you sell or share data, honor Global Privacy Control as an opt-out and apply it to the whole logged-in account.If it appliesSource: 11 CCR 7025, California AG on Sephora, California AG on Disney
• Do not ask for ID just to opt out, and test your opt-out form after every deploy.If it appliesSource: CPPA on Todd Snyder, CPPA on Honda
• If you use Microsoft Clarity and have visitors from the EEA, the UK or Switzerland, send the consent signal through its Consent API or a supported consent tool.If it appliesSource: Clarity consent mode
• Do not treat SB 690 as permission for session replay or chat recording; get consent before any tool captures what users type.Should doSource: Baker Donelson on SB 690, WilmerHale on SB 690

The prompt for your agent

Copy this into Claude Code, Codex or Cursor from the root of your project. Then do the browser test in item 9 yourself; the agent cannot click your live banner.

Audit this project for Stage 4 of a launch checklist: consent before tracking.
Do not change any code, config, or tracking setting until I approve a plan.

For each item below, report PASS, FAIL, or UNKNOWN, with the file and line that
proves it. If you cannot prove an item from the code, report UNKNOWN. Never
report PASS without evidence.

1. List every analytics, session replay, heatmap, ad pixel, tag manager, and chat
   widget the app loads, on every page and screen, with the file and line.
2. For each one: does it load before the visitor makes a consent choice? Quote
   the code that decides when it loads.
3. Is there a consent banner? Does it offer Reject on the same layer as Accept?
   Is the choice saved, and is it checked before any tracker starts?
4. When the visitor rejects, what code runs? Does it stop every tracker in item 1,
   including ones loaded by a tag manager?
5. Session replay: is it turned off in code (for PostHog,
   disable_session_recording: true), or does it depend only on a dashboard
   setting? If replay can run, does it start only after consent?
6. If replay can run: which inputs and text are masked, which pages are blocked,
   and are network request bodies scrubbed?
7. Is autocapture on? List the events the app sends on purpose.
8. Does the app read the Global Privacy Control signal (header or JavaScript)?
   If so, does it apply the opt-out to the logged-in account, not only the
   device?
9. List the cookies and local storage keys set on first page load, before any
   click. I will confirm this in the browser.
10. Does the privacy policy name every tool in item 1?

End with a table: item, status, evidence (file and line), and the smallest fix you
suggest. Then stop and wait for my approval.

For item 9, open your site in a private window, open the developer tools, and look at the Network tab and the stored cookies before you click anything. Then click Reject, reload, and look again.

Common mistakes

• Pasting the analytics snippet your agent wrote, with autocapture on and no consent step, and never reading what it sends.
• A banner that looks right but does not block anything. Healthline's banner did not turn tracking off.
• Thinking SB 690 ended the risk of session replay suits. It removed private pen register suits from 2027; wiretap and recording suits continue.
• Masking only the password field. Other text, names, chat messages and network bodies can still end up in recordings.
• Leaving replay off only in a vendor dashboard, where one click by anyone on the team turns it on for every visitor.
• Honoring an opt-out on one browser while the logged-in account keeps sharing, as in the Disney case.

Check yourself

Resources

• EDPB: Cookie Banner Taskforce reportGuidanceFree

  What EU regulators agree a banner must and must not do.

• EDPB: Guidelines 2/2023 on Art. 5(3) ePrivacyGuidanceFree

  Why pixels and tracking links count, not only cookies.

• CNIL: Google fined 325 million eurosArticleFree

  A 2025 fine where refusing cookies was harder than accepting.

• California 11 CCR 7025: opt-out preference signalsLawFree

  The rule that makes a browser signal a valid opt-out.

• California AG: Healthline settlementArticleFree

  A cookie banner that did not stop tracking, and what it cost.

• California AG: Disney settlementArticleFree

  Why an opt-out must reach the account, not only the device.

• Baker Donelson: SB 690 signed into lawArticleFree

  What SB 690 removes, what it keeps, and the fight over old cases.

• WilmerHale: CIPA reform signed into lawArticleFree

  A second summary of SB 690 from a law firm.

• PostHog: Data collection and consentDocsFree

  How to start PostHog opted out and opt in on consent.

• PostHog: Session replay privacy controlsDocsFree

  What PostHog masks by default and how to mask more.

• Microsoft Clarity: Consent modeDocsFree

  The consent signal Clarity needs for EEA, UK and Swiss visits.

• Microsoft Clarity: MaskingDocsFree

  The masking modes and how to change them per element.

Next stage

Some data needs more care than page views. Stage 5 covers health data and children's data: why ad pixels on health pages lead to FTC cases, the Health Breach Notification Rule, and what COPPA asks of any app that children might use.