CNIL publishes final rules for session replay tools

What the CNIL says

The CNIL treats these tools as trackers under Article 82 of the French data protection act. It says no exemption in that article applies, so prior consent is required. Its main points:

• Refusing must be as easy as accepting. People must be able to refuse, and to withdraw consent, as simply as they gave it.
• Say it at the first level of the banner. The final version recommends specific information about session replay on the first screen of the consent interface.
• Decide the purpose before you collect. Purposes must be set before the tool is deployed.
• Collect less. Use a masking tool, limit the number of sessions recorded, limit the use of identifiers, and keep recordings for a very short time.
• Mask what people type. For improving user experience, fields where people enter personal data should be masked.
• Protect authentication codes. The final version adds masking mouse movements in certain areas so codes are not captured by accident.
• Mask chatbot conversations. Replay tools used on chatbots should be able to hide the content of the chat, because questions and answers can reveal sensitive data.

The recommendation is for two groups: the companies that build these tools and the website or app owners who use them. The CNIL says it will support professionals in the coming months, including with a webinar, and that people can complain to it if the rules are not followed.

Which websites are affected

Any site that uses a session replay or heatmap tool, such as Microsoft Clarity or Hotjar. These two are our examples; the CNIL pages do not name products. This is French guidance and does not bind other countries directly, but the GDPR applies across the EU, so the questions are worth asking on any site.

What to check on your site

1. Does the tool load before the visitor agrees? If yes, change that first.
2. Does your consent banner mention session replay clearly, and is refusing as easy as accepting?
3. Are form fields masked, including contact, checkout and login forms?
4. If you have a chat widget, is the conversation text hidden in recordings?
5. Can you state why you record sessions, and how long you keep the recordings?

This is general information, not legal advice. For a specific site, ask a qualified data protection adviser.