Texas Data Law

Texas Data, Privacy & AI

Pixels, Session Replay, and Chat: Consent Before Code

Tracking pixels, session replay tools, and chat widgets can send page addresses, keystrokes, and even unsent text to third parties. That creates risk under wiretap laws in Texas and elsewhere, under privacy statutes, and under contract and tort law. This guide covers the claims and how to audit tags, limit vendors, and honor opt-out signals.

What the law requires

Pixels can send URLs, identifiers, event names, and form data. Session replay can record page changes, cursor movement, keystrokes, and field values. Chat tools can transmit text before a user presses send. These flows create risk under privacy statutes, contract, tort, and sector confidentiality rules.

Texas wiretap law. Plaintiffs have sued under Penal Code §16.02 and Civil Practice and Remedies Code chapter 123, which allows statutory damages of $10,000 for each occurrence (§123.004). These claims are not easy wins. Chapter 123 defines interception as the aural acquisition of a communication's contents without the consent of a party (§123.001), and courts must decide whether clicks and typed text are aural, whether the website owner is a party to its visitors' communications, and whether a vendor acting for the site is a separate interceptor. Texas's pen-register offense (Penal Code §16.03) covers devices that identify telephone numbers dialed or transmitted on a telephone line and gives no private right to sue, so it is a weak basis for website-tracking claims.

Federal wiretap law. The federal Wiretap Act's one-party consent rule does not protect an interception made to commit a crime or tort (18 U.S.C. 2511(2)(d)). Plaintiffs invoke this exception against sites that send health or financial information to advertising platforms.

California. Many demand letters to Texas businesses rely on California's Invasion of Privacy Act (CIPA), which provides $5,000 per violation. California's SB 690, operative January 1, 2027, leaves pen-register claims over online tracking to the California Attorney General, but it does not affect CIPA's wiretapping provision. On September 17, 2026, the Texas Attorney General warned Texas businesses about these letters and urged recipients to consult a lawyer before responding or paying.

TDPSA. Where the Texas Data Privacy and Security Act applies, consumers may opt out of targeted advertising, and controllers must honor universal opt-out signals such as Global Privacy Control (§§541.051(b)(5), 541.055(e)).

Related topics

Sources and legal update

Current through October 12, 2026.

This material is for general information and is not legal advice. Law and enforcement practice change. Consult counsel about specific facts.