Contract trap · Privacy policy
Third-party trackers & session replay
The policy authorises third-party cookies, pixels (Meta, TikTok, Google), analytics SDKs, chat widgets and session-replay tools that send page views, form entries and keystrokes to outside companies; reserves the right to identify you by device/browser characteristics, IP or hashed email and link your devices and household even when cookies are cleared; and states that browser Do Not Track or Global Privacy Control signals are ignored.
- Severity
- Serious
- How often it turns up
- Almost always
- Holds up?
- Depends where you are
- Clause phrases
- 24
What it looks like in a contract
Redline matches these phrases against your document verbatim. Drafters rarely invent new wording — they copy it, which is why the same sentences turn up across unrelated contracts.
In English-language contracts
- cookies, web beacons, pixels and similar technologies
- session replay
- we record your interactions with the Service
- keystrokes, mouse movements and scrolling
- third-party analytics providers such as Google Analytics
- Meta Pixel
- software development kits (SDKs)
- our chat provider may have access to the contents of your messages
- device fingerprinting
- probabilistic matching
- even if you clear your cookies
- we do not respond to Do Not Track signals
In Russian-language contracts
- Яндекс.Метрика
- Google Analytics
- Вебвизор
- файлы cookie и аналогичные технологии
- пиксели и веб-маяки
- сервисы сторонней аналитики
- рекламные сети и системы ретаргетинга
- сервисы онлайн-чата третьих лиц
- цифровой отпечаток устройства
- сопоставление устройств Пользователя
- объединять данные, полученные с разных устройств
- Сайт не обрабатывает сигналы Do Not Track
Check your own contract
Paste a clause, a page or the whole document. Nothing leaves your browser: the matching runs here, on this page, against the phrases above.
Why it bites
Sensitive context (health portals, therapy sign-ups, fertility apps, loan applications) leaks to ad networks and is joined to your profile; session replay captures what you type before you submit; fingerprinting defeats every opt-out you make; in RU foreign analytics is a cross-border transfer requiring RKN notification; ignoring GPC is itself a violation in California and several states.
Is it enforceable where you are
The same clause can be routine in one country and void in another. What follows is what the law says where you are — not advice on your particular contract.
In the EU and the UK, the GDPR governs the legal basis, the retention period and your right to erasure; in the US, state privacy laws (CCPA/CPRA and its successors) give an opt-out of sale and sharing.
United States
Disclosure-based; California CIPA §631/§638.51 wiretap suits over session replay, chat widgets and pixels have produced $150M+ in settlements (2022-2026); FTC treats sharing health data with ad platforms as unfair/deceptive (BetterHelp, GoodRx, Flo, Premom); CCPA treats fingerprints as personal information subject to opt-out and, with Colorado, Connecticut, Texas, Oregon and others, requires honouring GPC (Sephora $1.2M, 2022); CalOPPA requires disclosing how DNT is handled; Google permitted fingerprinting for ad customers from 16 Feb 2025.
- Cited
- CCPA
- CIPA §631
- FTC
European Union
Prior consent under ePrivacy Art 5(3) for all non-essential trackers and for any access to terminal-equipment information including fingerprinting (EDPB Guidelines 2/2023); Criteo €40M (CNIL, 2023) for tracking without proof of consent; Google Analytics transfers found unlawful by several DPAs after Schrems II (2022); GDPR profiling rules apply.
- Cited
- GDPR
United Kingdom
PECR reg 6 consent for non-essential cookies and fingerprinting alike — ICO (Dec 2024): 'businesses do not have free rein to use fingerprinting' and called Google's Feb 2025 policy change 'irresponsible'; ICO cookie compliance campaign since 2023; DUA Act 2025 gives power to recognise browser-level signals in future.
- Cited
- DUA Act 2025
- ICO
- PECR reg 6
Russia
РКН: cookies/метрики — ПД, нужен явный баннер-consent; Google Analytics = трансграничная передача, с 1 марта 2023 требуется уведомление РКН до начала (РКН рассылал предупреждения владельцам сайтов в 2023); Яндекс.Метрика допустима при раскрытии; device identifiers linked to a person are ПД under ст. 5-9 152-ФЗ; DNT/GPC not regulated.
- Cited
- 152-ФЗ
- ст. 5-9
Where this has actually happened
Regulator actions, court rulings and the contracts they were fought over.
- FTC v. BetterHelp (Mar 2023) — $7.8M, therapy sign-up data sent to Facebook/Snapchat for ads; FTC v. GoodRx (Feb 2023) — $1.5M under the Health Breach Notification Rule
- Frasco v. Flo Health — California federal jury (Aug 2025) found Meta liable under CIPA for receiving Flo users' reproductive-health data
- CNIL v. Criteo (June 2023) — €40M for tracking without demonstrable consent
- ICO response to Google's fingerprinting policy change (Dec 2024): 'We think this change is irresponsible'
- California AG v. Sephora (Aug 2022) — $1.2M, including failure to process Global Privacy Control opt-out signals
- Роскомнадзор warnings to site owners using Google Analytics without cross-border notification (2023)
What to do
In order, from the thing that takes a minute to the thing that takes a letter.
- Reject analytics/advertising cookies, block third-party scripts, enable GPC in your browser and keep a record
- Never enter sensitive data on sites whose policy lists ad pixels or fingerprinting
- US: consider CIPA/wiretap claims if a chat widget or replay tool shared your inputs and file a complaint in GPC states if sale/sharing continued
- EU/UK: complain to the DPA — ePrivacy consent covers any access to device information, not only cookies
- RU: check whether the site notified Роскомнадзор about foreign analytics and demand the legal basis under ст. 14 152-ФЗ.
Traps that travel with it
Drafters who use one of these usually use several.