Session Replay Privacy: How to Watch Users Without Violating GDPR

The session replay privacy problem

Session replay tools (Hotjar, FullStory, LogRocket, Microsoft Clarity) record everything a user does on your site: mouse movements, clicks, scroll, form inputs, and page content. The problem: if a user types their email, password, credit card number, or personal message, the replay captures it. This is personal data under GDPR. In 2023, the Austrian DSB ruled that Hotjar's session replay violated GDPR because it captured user inputs without adequate consent. In 2024, the CNIL fined two companies for using Clarity without proper disclosure. Session replay is powerful but legally dangerous.

What makes a session replay GDPR compliant

A privacy-safe session replay must do three things. First, redact all input fields. Text inputs, textareas, password fields, and search boxes must be masked before the data leaves the browser. The server should never receive the actual text. Second, do not capture personal data in the DOM. Email addresses, phone numbers, and names that appear in the page content must be redacted. Third, do not use cookies or persistent identifiers. The replay should be anonymous — not tied to a user profile. If you do all three, session replay can be GDPR compliant without a consent banner in most jurisdictions.

How Dashly does privacy-safe replay

Dashly records replay data using viewport-relative coordinates — it tracks where on the screen the mouse moved and what was clicked, not the actual DOM content. Input fields are redacted at the browser level before any data is sent. The replay reconstructs the session using the page structure and the recorded interactions, without ever storing page text, form values, HTML, or media. Replays are not tied to user profiles — they are anonymous sessions identified by a daily-changing hash. This means Dashly replays cannot be used to identify a specific person, even with a subpoena.

What to redact: a checklist for your legal team

If you are evaluating a session replay tool, check these items: (1) Are all <input> and <textarea> fields redacted before data leaves the browser? (2) Are password fields completely blocked, not just masked? (3) Is email addresses, phone numbers, and credit card numbers in page content automatically detected and redacted? (4) Are replays tied to anonymous session IDs, not user profiles? (5) Is the data stored in the EU if you have EU users? (6) Is there a clear privacy policy disclosing replay recording? (7) Can users opt out? If the answer to any of these is no, the tool is likely not GDPR compliant.

Hotjar vs Dashly vs Microsoft Clarity: privacy comparison

Hotjar uses cookies, requires a consent banner in the EU, and captures form inputs unless you manually configure redaction. It was ruled non-compliant by the Austrian DSB. Microsoft Clarity is free but masks data server-side, not browser-side — meaning the data leaves the browser before masking. It also uses cookies. Dashly redacts at the browser level (data never leaves the device unredacted), uses no cookies, and does not tie replays to user profiles. For GDPR compliance, Dashly is the safest option. For a free option, Clarity is acceptable if you enable masking and disclose it in your privacy policy.

Do you need a consent banner for session replay?

It depends on the tool. If the tool uses cookies (Hotjar, FullStory, LogRocket), yes — you need a consent banner under the ePrivacy Directive. If the tool is cookieless and redacts all personal data at the browser level (Dashly), you typically do not need a consent banner, because no personal data is collected. However, you should still disclose replay recording in your privacy policy. Some strict interpretations (Germany, France) argue that any recording of user behavior requires consent. Always consult legal counsel for your specific situation.

FAQ