Run a free scan

Torres v. Prudential: recording a form is not reading it in transit, but vendor access still mattered

Two facts decided this case, and you can check both in your own stack: what a form-recording vendor does with input while it travels, and which of the vendor’s staff can open the recordings afterwards. The court found the vendor was plausibly more than a "tape recorder" because some employees could view recordings. The defendants still won, because nobody read anything in transit.

US District Court, Northern District of California · CIPA §631 · Summary judgment, 17 April 2025 · Appeal pending

The problem

Prudential and its subsidiary Assurance IQ ran an online form for life insurance quotes that asked about demographics, family and medical history. ActiveProspect’s TrustedForm, embedded in the form, recorded each visitor’s interaction as it happened. Prudential did not expressly disclose the recording until after visitors clicked "Get an instant quote" (SJ order at 1–2).

Case record

Court
US District Court, Northern District of California (Judge Charles R. Breyer)
Case number
3:22-cv-07465-CRB; Ninth Circuit No. 25-3203
Parties
Valerie Torres and Rhonda Hyman, for a certified class, v. Prudential Financial, ActiveProspect and Assurance IQ
Counsel
Class counsel: Girard Sharp LLP ([class order at 1](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-07465/pdf/USCOURTS-cand-3_22-cv-07465-2.pdf)). Defendants: not stated in the cited record
Laws
CIPA §631(a); California constitutional privacy; UCL (dismissed in 2023)
Stage
Summary judgment for defendants; plaintiffs' appeal pending
Precedent
District court order; not binding on other courts
Amount
None
Source review
17 October 2026

What was alleged

What was alleged
ClaimWhat the law requiresFacts allegedResult
CIPA §631(a) against ActiveProspectA third party reading or attempting to read the contents of a communication while in transit, without consentTrustedForm intercepted, recorded and stored real-time interactions with the quote form ([SJ order at 1](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-07465/pdf/USCOURTS-cand-3_22-cv-07465-3.pdf))Third-party status disputed and left for trial; summary judgment on "in transit"
CIPA §631(a) against Prudential and AssuranceAiding the vendor's violationThey embedded TrustedForm without proper disclosureFails with no predicate violation ([at 12](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-07465/pdf/USCOURTS-cand-3_22-cv-07465-3.pdf))
California constitutional privacySerious invasion of a protected interestThe same recordingSurvived dismissal in 2023 ([MTD order](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-07465/pdf/USCOURTS-cand-3_22-cv-07465-0.pdf)); not certified or decided in the summary judgment order
UCLLost money or propertyThe same recordingDismissed 9 June 2023

The class certified on 26 November 2024 was "All natural persons who, while in California, visited Prudential.com, provided personal information on Prudential’s form to receive a quote for life insurance, and for whom a TrustedForm Certificate URL associated with that website visit was generated from November 23, 2021 to December 13, 2022" (class order at 1).

Technical issue

  • Tools or vendors: TrustedForm by ActiveProspect, embedded in the form’s source code (SJ order at 1).
  • Mechanism: "event listeners" detected clicks, mouse movements and keyboard input. TrustedForm built a "TrustedForm Certificate" containing a session replay, encrypted it and sent it to ActiveProspect’s servers. Some values, such as emails, were normalised and hashed before transmission. Only the holder of the certificate URL (the website owner) could retrieve it (at 1–2).
  • Vendor access: select ActiveProspect "superuser" employees could log into customer accounts and view certificates and replays, as far as the record showed only for troubleshooting (at 2, 6–8).
  • What data: demographics, family situation, medical history, contact details, keystrokes and clicks.
  • When: from the first interaction, before the disclosure at the end of the form.
  • How it came to light: discovery. Plaintiffs relied on depositions and a report by Professor Zubair Shafiq that event logs were stored on the server in decoded plain text; defendants challenged that report (at 7 n.1).

Inth’s technical interpretation: a recorder of this kind serialises low-level events (key down, input change, pointer move) and ships them in encrypted batches. Nothing in that pipeline parses meaning; the replay is rebuilt later from the event log when someone opens it. The court treated that as decisive for "reading in transit". It treated a different fact as decisive for "third party": vendor staff with account-level access to stored replays. Those are two separate engineering controls. The first is how the SDK transmits; the second is who at the vendor can open your data, and whether the vendor’s terms let it use the data for itself.

Illustrative pattern, not the defendant’s code. The recorder starts before any disclosure and vendor support has standing access:

// quote-form.ts (generic form-recording vendor)
import { formRecorder } from './vendor-recorder';

formRecorder.start({
  form: '#life-quote',
  captureInputs: true,     // health answers included
  supportAccess: 'always', // vendor staff can open any recording
});

Illustrative pattern, not the defendant’s code. Disclosure first, health fields excluded, vendor access by ticket only:

import { formRecorder } from './vendor-recorder';

onDisclosureAccepted(() => {
  formRecorder.start({
    form: '#life-quote',
    captureInputs: true,
    excludeFields: ['[data-health]', '[name="dob"]'],
    supportAccess: 'by-request', // customer grants time-limited access per ticket
  });
});

Timeline

Timeline
DateEvent
December 2021 to January 2023Plaintiffs complete the form ([SJ order at 2](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-07465/pdf/USCOURTS-cand-3_22-cv-07465-3.pdf))
November 2022Class action complaint filed
9 June 2023§631 and constitutional privacy claims survive; UCL dismissed ([order](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-07465/pdf/USCOURTS-cand-3_22-cv-07465-0.pdf))
6 June 2024Second amended complaint
26 November 2024Class certified for the §631 claim; Girard Sharp appointed class counsel ([order](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-07465/pdf/USCOURTS-cand-3_22-cv-07465-2.pdf))
17 April 2025Summary judgment for defendants ([order](https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-cv-07465/pdf/USCOURTS-cand-3_22-cv-07465-3.pdf))
19 May 2025Ninth Circuit appeal No. 25-3203 docketed; appellants' reply brief filed 19 November 2025 ([CourtListener](https://www.courtlistener.com/docket/73607489/))

Outcome

On third-party status the plaintiffs won the point. Applying the capability test from Javier v. Assurance IQ, the court held that ActiveProspect’s policy of not using the data was "irrelevant to the issue as to whether ActiveProspect is capable of using superuser access for its own ends", leaving a genuine dispute (at 7–8).

On reading in transit the defendants won: "nothing in the record plausibly indicates that ActiveProspect reads or attempts to read the contents of the communication while they are in transit" (at 9). Reading "requires an attempt to understand or interpret the substantive meaning of a communication, and the events recorded by TrustedForm do not become readable content until after they are stored and reassembled" (at 11). Mechanical hashing of emails and phone numbers was not reading either. With no predicate violation, the aiding claims against Prudential and Assurance failed (at 11–12).

As of 17 October 2026 the Ninth Circuit’s opinion, memoranda and argument-recording searches show no decision or argument in No. 25-3203. The order binds only the parties unless affirmed.

What it cost

What it cost
ItemRecord
Damages or settlementNone
Fee awardNone
Litigation stage reachedMotion to dismiss, discovery with expert reports, class certification, summary judgment, appeal
Defence costsNot stated in the cited record

Why it matters

  • The "in transit" defence works late. It won at summary judgment after more than two years, a certified class and expert discovery. It is not a pleading defence. Gutierrez v. Converse reached the same place for a chat vendor.
  • Capability keeps vendors in the case. The same court accepted that superuser access made ActiveProspect plausibly a third party. Vendors whose staff or models use customer data for their own ends are the claims that survive; see In re Otter.ai.
  • An appeal could change the line. If the Ninth Circuit reverses, "in transit" for recorded web events would need a new answer.
  • See Session replay and chat recording and CIPA §631.

How Inth catches this

  • Code audit: flags a pull request that adds a form recorder or replay SDK, and traces which form fields (health, date of birth, contact) flow into it before the disclosure step.
  • Website audit: records the recorder’s requests on each form step with the page, time, region and consent state.
  • Consent banner: measurement tools wait behind the banner where the policy is opt-in. Inth’s default California policy is opt-out, so tools run there until the visitor opts out unless you configure California opt-in.
  • Evidence: finding history shows who approved the recorder and on which form.

Inth cannot see which vendor employees open your recordings; that comes from the vendor’s access logs and your contract.

Checks for your own systems

In the repository

  • Find every recorder or replay SDK on forms that ask health, financial or identity questions, and the line where recording starts.
  • Check whether the SDK supports excluding fields, and whether health fields are excluded.

In the browser and network

  • Fill the form with test values and filter the Network panel for the vendor; note when the first batch leaves and whether values appear in clear text or hashed.

With the people responsible

  • Ask the vendor which of its staff can open your recordings, under what process, and for the access log.
  • Check the vendor’s general terms of service as well as your licence: the court relied on terms of service that reserved rights to use collected content (at 7 n.2).

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Prudential’s, Assurance IQ’s or ActiveProspect’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.