Overview
This check confirms that any page or tool capable of tracking a visitor's movements or communication path (chat widgets, session-replay tools, click and scroll trackers) carries clear, upfront notice explicitly warning the visitor that their interactions are being processed and recorded in real time.
Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific CIPA compliance obligations.
Why it is important
CIPA § 631 and 632.7 require this disclosure to be explicit and given before recording begins, not buried in a general privacy policy the visitor may never open. A generic "we use cookies" banner does not satisfy this standard when the tool in question is capturing keystrokes, mouse movement, or a live chat conversation in real time.
The disclosure has to name the specific real-time recording/communication behavior, which is a materially higher bar than the general notice-at-collection language used for other privacy frameworks.
Implementation
Identify every page running a recording-capable tool (chat, session replay, click/scroll tracking), using the wiretap-risk tag inventory. Implement these pages as starting URLs in a new audit.
Write a script that scrapes each page for your approved disclosure wording. The script should make sure the wording is visible above the fold and logs a specific pass/fail message to the browser console. The ObservePoint team is happy to help you write and implement this.
Attach the script as an On-page action in the new Audit, so it logs its message on every crawled page.
Clone the Browser Logs by Page Domain report template, then customize it for this check:
Filter the Log Message column to the exact fail text your script logs (e.g. "disclosure text was not found on this page"), so the report only surfaces failing pages.
Make sure the page URL is included as a column, so each row tells you exactly which page failed.
Rename the report to something like "CIPA - Missing Recording Disclosure."
For any page still flagged, manually confirm the disclosure isn't hidden in a modal or the general privacy policy (a script can confirm the words are there); only a manual review confirms it reads as clear, upfront notice.
Remediation
For remediation, check the following list:
Where the disclosure is entirely absent, work with legal/privacy counsel to draft explicit real-time recording/communication language. This cannot simply reuse your general Notice at Collection text, since CIPA case law expects the specific recording behavior to be named.
Add the disclosure directly adjacent to or immediately preceding the recording-capable tool's activation point, not only in a footer link.
Re-run the audit after updating the disclosure wording or the script, and confirm the page no longer appears in the "CIPA - Missing Recording Disclosure" report.
Conclusion
This disclosure is the second half of the prior-consent requirement: suppressing the tag until consent is one obligation, and telling the visitor plainly what they're consenting to is the other, and both need to be true for the check on tag suppression to actually mean anything in front of a court.