In short
Session recordings are legal in most jurisdictions when visitors are told and, in the EU and UK, have consented before the recording script runs; when every input field and any personal or sensitive content is masked so the recording never captures it; and when the practice is disclosed in the privacy policy with a retention limit. Recording without consent in Europe breaches ePrivacy and GDPR rules, and in the United States a wave of lawsuits has treated undisclosed replay as wiretapping under state law. Configure the tool conservatively or do not run it.
What a session recording is
Session replay tools such as Hotjar, Microsoft Clarity, FullStory, LogRocket and Smartlook load a script on your pages that records the visitor's mouse movements, scrolls, clicks, taps and keystrokes, along with the changing state of the page, and reconstruct them as a playable video. Watching a dozen of them is the fastest way to see where a form loses people or where a page confuses them, which is why they are popular with product and marketing teams.
They also capture, by default, everything a visitor sees and types. That includes names, addresses, messages, search terms, health conditions entered into a symptom checker, and card details entered into a badly configured checkout. The legal question is entirely about that capture.
The legal position
EU and UK. Two regimes apply. The ePrivacy rules, implemented in the UK as PECR, require consent before storing or accessing information on a visitor's device that is not strictly necessary for the service they asked for; a replay script and its cookies are not strictly necessary. GDPR then governs the personal data the recording contains, requiring a lawful basis, transparency, minimisation, a retention limit, and appropriate safeguards; for anything revealing health, sexuality, politics or other special categories, explicit consent. Regulators in several member states have named session replay specifically in guidance, and the direction is uniform: consent first, masking always, disclosure in the policy.
United States. There is no federal consent requirement, but since 2022 hundreds of class actions have been filed under state wiretapping and privacy statutes, particularly California's CIPA and Pennsylvania's WESCA, arguing that recording a visitor's interactions without consent is an unlawful interception, and that sharing the recording with the replay vendor is disclosure to a third party. Outcomes have been mixed and many cases settled, but the litigation risk is real and growing, and a visible disclosure with an opportunity to decline is the practical defence. Sites collecting health, financial or children's data face additional statutes.
Elsewhere. Canada, Australia, Brazil and others have privacy laws with transparency and reasonable-purpose requirements that replay without disclosure fails. The conservative configuration below satisfies all of them.
The configuration that makes it defensible
- Load the script only after consent, through your cookie banner, categorised as analytics or similar, and honour a decline. In Europe this is required; elsewhere it is the strongest protection.
- Mask all inputs by default. Every replay tool has a setting to replace typed text with asterisks or to skip input fields entirely. Turn it on globally, not per field, so a new form added later is protected automatically.
- Mask sensitive page content. Account pages, order histories, messages, anything showing personal data of the visitor or of others. Tools support marking elements or whole pages for masking or exclusion.
- Exclude pages that should never be recorded: checkout and payment, login, anything medical, legal or financial in nature, and admin areas.
- Disclose it in the privacy policy: that recordings are made, by which vendor, for what purpose, how long they are kept, and how to opt out.
- Set a short retention, thirty days or less; the insight is in the first week, and old recordings are pure liability.
- Sign the vendor's data processing agreement and check where recordings are stored.
- Restrict who can watch. Recordings are personal data; access should be limited and logged.
- Respect Do Not Track and Global Privacy Control signals if you operate in jurisdictions that recognise them.
A tool configured this way records anonymous interaction patterns rather than people, and that is both the legal and the ethical line.
What you lose by configuring it properly
Surprisingly little. Masked inputs still show that someone typed and how long it took; masked content still shows where they scrolled and clicked. The value of replay is in the behaviour, not the words, and the words were the liability. Consent gating reduces the sample, sometimes substantially in Europe, which is a cost; a sample of consenting visitors is usually representative enough for the purpose of finding usability problems.
When not to use it
Healthcare, legal, financial and children's services, where the risk of capturing special-category data outweighs the benefit, unless the tool can be confined to non-sensitive pages with confidence. Sites without the capacity to configure and review the tool properly, where an unmasked default runs for years unnoticed. And any site that cannot honestly say why it is recording: replay is justified by a specific question about a specific flow, watched for a few weeks and then switched off, not by curiosity left running.
Used that way, alongside analytics that respect visitors, session replay is a legitimate research tool. If you are running one and are not sure what it is capturing, book a call; reviewing the configuration takes an hour.
Common questions
Do session recordings require consent under GDPR?
Yes, in practice. The ePrivacy rules require consent before non-essential scripts and cookies run on a visitor's device, and a replay script is not essential. GDPR then requires a lawful basis, disclosure, minimisation and a retention limit for the personal data captured. Load the script only after consent and mask all inputs and sensitive content.
Are session replay tools legal in the United States?
There is no federal consent requirement, but since 2022 many class actions have argued that undisclosed session replay is wiretapping under state laws such as California's CIPA, and sharing recordings with a vendor is disclosure to a third party. Results have been mixed and settlements common. Clear disclosure, an opt-out, and masking of inputs are the practical defences.
Does Hotjar or Microsoft Clarity record passwords and card numbers?
Not if configured correctly; both mask password fields by default and offer settings to mask or suppress all inputs and specific content. Left on default settings for other fields, replay tools can capture typed text. Enable global input masking, exclude checkout and login pages, and verify by watching a test recording.
Do I need to mention session recording in my privacy policy?
Yes. The policy should state that interactions are recorded, name the vendor, explain the purpose, give the retention period, and describe how to opt out. In the EU and UK this is required by GDPR transparency rules; in the US it is the core of the defence against wiretapping claims.
How long should session recordings be kept?
As briefly as the purpose allows, typically thirty days or fewer. The usability insight is in the first week of recordings; older ones add liability without value. Set the retention limit in the tool, state it in the privacy policy, and switch recording off once the question it was answering has been answered.
