CIPA § 631 Risk

Is Drift legal in California?

Chat Widget / Behavioral Tracking · Updated 2026

Drift's chat widget tracks visitor behavior and identity to power conversational marketing. Whether a particular implementation is lawful depends on its configuration, the information transmitted, disclosures, consent, and other facts. A request observed before a recorded consent choice is a technical signal to investigate, not a legal conclusion.

Why Drift can trigger CIPA claims

California's Invasion of Privacy Act (CIPA), Penal Code § 631, addresses specified forms of interception and related conduct. Plaintiffs have asserted that some website session-replay, chat, and pixel implementations fall within the statute when they capture interactions without valid consent. Courts assess the statute's application to the particular parties, data flow, timing, and other facts. Drift's chat widget tracks visitor behavior and identity; load it behind consent.

CIPA § 637.2 authorizes statutory damages of up to $5,000 for a qualifying violation. Plaintiffs may argue that multiple sessions support multiple counts; RegSentry does not determine whether a violation occurred or predict recoverable damages.

Real-world enforcement

The California Attorney General reached a $1.2M CCPA settlement with Sephora over allegations involving sale disclosures and opt-out (Global Privacy Control) signals. That was a CCPA enforcement action, not a session-replay or CIPA case. Separately, private CIPA complaints involving session-replay and chat tools have named businesses in several industries. Those matters arise under different laws and facts and should not be treated as proof that a particular technical finding is unlawful.

How to reduce consent-timing risk involving Drift

1. Confirm how Drift is installed. If it loads through Google Tag Manager, set the tag's "Consent" settings to require the relevant consent type so it cannot fire before opt-in.
2. Add GTM Consent Mode with all storage defaulting to "denied" (snippet below), and connect a CMP that flips consent to "granted" only after the visitor accepts.
3. If Drift is hard-coded as a raw <script> instead of via GTM, move it into GTM (or wrap it) so the consent gate actually applies — a raw snippet ignores Consent Mode.
4. Re-scan with RegSentry's "Verify fix" button to confirm Drift no longer fires before consent.

Consent-gating snippet

<!-- Place BEFORE the GTM/gtag snippet. Defaults all storage to "denied"
     so no tags fire until your CMP updates consent after the user opts in. -->
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('consent', 'default', {
    ad_storage: 'denied',
    analytics_storage: 'denied',
    functionality_storage: 'denied',
    personalization_storage: 'denied',
    security_storage: 'granted',
    wait_for_update: 500
  });
</script>

Your CMP (Cookiebot, OneTrust, Termly, etc.) calls gtag('consent','update',{...:'granted'}) only after the visitor accepts. Until then, tags stay blocked.

Drift's official privacy/consent documentation →

Check your own site

RegSentry runs a browser against authorized public pages and records when supported Drift and other third-party requests are observed relative to the test's consent state. Where supported, test-generated form interactions can help show the technical data flow. The scan does not decide whether a provider intercepted a communication or whether applicable law was violated.

← See all tracker compliance guides