Session recording and GDPR: consent first

A visit replayed screen by screen, and who keeps it

France's data protection authority, the CNIL, describes these tools as capturing and displaying a user's entire browsing journey. Beyond the pages visited, they let you watch mouse movements, clicks or taps, scrolling and what the user types. Whoever watches the recording sees one person's visit, screen by screen.

The CNIL names the risks: constant tracking that can reveal habits, interests and, depending on the site, sensitive data; and collection that goes beyond what the purpose justifies. How serious this is depends on the kind of site, and so on what its pages show and ask for.

The vendor matters too. If it simply provides the tool, it acts on your behalf. If it reuses the recordings for its own purposes, such as improving its product, it becomes responsible for that processing, and you share responsibility with it for the collection. The recordings go to its servers: Microsoft Clarity is run by a US company, which raises the question of the data that leaves the EU during a visit.

The CNIL's draft recommendation of February 2026

On February 25, 2026, the CNIL published a draft recommendation on session replay tools, open for public consultation until April 22, 2026. It will adopt a final version after reviewing the contributions; until that version is published, the text remains a draft. It rests on a rule already in force: Article 5(3) of the ePrivacy Directive, which France transposed in Article 82 of its data protection act.

On consent, the draft is clear: these tools require the visitor's prior consent, because recording is not needed to provide the service. Consent can go through the banner you already have, provided each purpose is shown with a short title and a brief description. The CNIL encourages mentioning session recording on the first screen of the banner. Withdrawing consent must be as easy as giving it, and recording must then stop.

The draft also describes settings that the vendor should make available and that you choose:

• masking of forms, text fields, images and auto-filled fields, applied to everything by default when nothing is configured;
• blocking of passwords and payment data;
• recording limited to a sample of sessions, or to sessions where a defined event occurs;
• retention matched to the purpose, from a few hours after the session for customer support to a few months for fixing errors or improving a user journey.

It rules out ad retargeting, for which less intrusive options exist.

Browser fingerprinting falls under the same rule

Some tools follow a visitor without storing anything: they compute a fingerprint from the characteristics of the browser and device. In its Guidelines 2/2023 on the technical scope of the ePrivacy Directive, adopted in October 2024, the European Data Protection Board states that Article 5(3) does not apply to cookies alone, and recalls that device fingerprinting has been recognized as within its scope since 2014.

The CNIL's guidelines on cookies and other trackers (in French), adopted on September 17, 2020, also name fingerprinting among the techniques the rule covers. The absence of a cookie does not change anything: consent is still required, outside the exemptions the law provides.

The settings to require from whoever installed the tool

These decisions are made with whoever installed the tool, agency or developer, and with whoever watches the recordings.

1. Decide what the recording is for before you turn it on: fixing errors, improving a user journey, or helping customer support. The CNIL asks for the purpose to be set in advance, never based on what turns up while watching sessions. If standard analytics would serve that purpose, its draft says to prefer them.
2. Have the tool load only after the visitor agrees. Ask for it to be tied to your consent banner under a label that says what it does, and for a refusal to stop it from starting.
3. Require masking of typed input and blocking of passwords and payment data. These settings live in the tool account, not on your pages: ask to see them for each sensitive page, such as the customer account, checkout or contact form.
4. Cut down what is kept: a sample of sessions rather than all of them, or only the sessions where an error occurs, and a retention period that fits the purpose.
5. Read the vendor's contract. If it reuses recordings for its own purposes, the CNIL calls for a clear split of obligations between you, in particular for informing visitors.
6. Have your privacy policy name the tool that actually loads, and remove the tool once it is no longer used: a forgotten script keeps loading on every page.

Tying the tool to the banner is usually a setting. Masking takes more work on a site with many forms, since every sensitive field, current or future, has to be covered.

Before any answer, after a refusal, after consent

This percentage covers about 30 websites we audited between August 14, 2026 and September 24, 2026, the ones where this point could be checked. Many were audited because a defect showed up quickly, so the figure describes our audits, not websites in general.

That figure comes from the first of the audit's three visits. It opens your site in a fresh browser without answering the consent banner, and scrolls the page to its footer, which also triggers scripts loaded later. It records every service the browser contacts. Session recording tools are recognized by their address: Hotjar, Microsoft Clarity, FullStory, Mouseflow, Lucky Orange; a known fingerprinting service, FingerprintJS, is recognized the same way. If one of them is contacted before the visitor has answered, the report counts it as a compliance defect.

Two more visits follow, each in a fresh browser: one after a click on the refuse button, the other after a click on accept. They separate a tool tied to consent from a tool that starts whatever the visitor answers. A click only counts as a refusal on a plain refusal label, and only if the banner then disappears; otherwise the point is reported as not verifiable.

The anonymized report on a sporting goods store shows the expected setup. Microsoft Clarity starts there only after the banner is accepted, and nothing of the kind loads after a refusal. The report finds no defect; it only recommends mentioning the recording in the privacy policy.

The published sample on a B2B business website gives the other verdict: no session recording and no browser fingerprinting. That does not make it a site without tracking. Before the visitor makes any choice, its pages contact 29 third-party domains, including a tool that identifies visiting companies, while its privacy policy names a different one as an example. The report treats these services as trackers set before consent, under their own question, and does not mistake them for session recording.

Each tool found is named in the report, with the company that runs it and the law it falls under. Whoever installed it then knows what to tie to the banner, or what to remove.