Session replay: Hotjar, Clarity and others require consent

A session replay tool records a visitor's complete journey: mouse movements, clicks, scrolling, and sometimes even what is typed into forms. All of it can be replayed as a video. These solutions are installed on a considerable share of French websites, often in a few minutes, and almost always without their legal status having been examined. The CNIL (the French data protection authority) has just taken up the matter.

What are we talking about

Session replay refers to tools such as Hotjar, Microsoft Clarity, Contentsquare, or equivalent features built into some analytics suites. They do not count visits: they reconstruct individual journeys.

It is this granularity that causes the problem. An audience counter produces aggregates; a session replay produces a recording of a person's behavior, potentially including what they typed before changing their mind. The difference in nature justifies a difference in treatment.

What the CNIL draft provides

On February 25, 2026, the CNIL opened a public consultation on a draft recommendation on these tools, which closed on April 22. The text addresses both ends of the chain: the vendors of the solutions and the websites that deploy them.

The direction is clear. Session replay is not seen as a general-purpose tool for observing behavior, but as a technology reserved for limited purposes (bug fixing, ergonomics, user support), subject to prior consent and accompanied by reinforced minimization safeguards.

The draft also specifies practical arrangements: the level of information to display, the wording that can be used to collect consent, and the use of consent management platforms to obtain it. In other words, the CMP (consent management platform) is explicitly identified as the expected vehicle.

At the date this article was published, the final version has not yet appeared. The principles above come from the draft submitted for consultation; they may change at the margins, but the consent requirement itself is hardly in doubt.

Why the "audience measurement" exemption does not apply

Many publishers put session replay in the same category as their statistics tool, relying on the exemption enjoyed by strictly necessary audience measurement. This is a reasoning error.

That exemption is narrow: it assumes a purpose limited to producing anonymous statistics, without cross-referencing, without individual tracking, and without transmission to third parties. A replayable recording of an individual journey meets none of these conditions. The fact that the tool is used to improve the site does not make it necessary for the service requested by the user.

The concrete risk: form inputs

This is the point most often underestimated. Depending on their configuration, these tools can capture the content of the fields filled in by the visitor, including what was typed and then erased. On a contact form, this is still uncomfortable. On a checkout funnel, a health area or a job application form, we enter a different category of data.

Serious solutions offer masking of sensitive fields, but it is rarely enabled beyond the default settings, and never audited. Three checks are worth doing today:

• Is input masking active on all forms, and not only on password fields?
• Are sensitive pages (payment, customer account, patient area) excluded from recording?
• Is the retention period of the recordings configured, or left at the maximum offered by the vendor?

What to do

The procedure comes down to four points:

1. Take inventory. Check whether a replay tool is running on your site. It was often added by a marketing team or a service provider, with no trace in the technical documentation. A cookie scan reveals it immediately.
2. Take it out of the "audience measurement" category of your banner and attach it to a category subject to consent, described explicitly.
3. Block it before consent. The script must not load until the visitor has accepted: this is the role of your CMP's automatic blocking.
4. Document the choice, through the consent log, to have the proof required by Article 7 of the GDPR.

In practice with Consenteer

The scanner identifies the replay tools present on your pages and shows them to you with their vendor and likely purpose. Automatic blocking prevents them from loading until consent is given, without any change to your code. And if the visitor sends a GPC signal, the refusal is applied without them even having to interact with the banner.

Session replay is a good tool. It simply deserves to be treated for what it is: individual tracking of behavior, which requires asking for consent.