France’s CNIL publishes its recommendation on session replay tools

What the CNIL published on session replay

On 5 November 2026 the CNIL, France’s data protection authority, published its final recommendation on session replay tools. It was formally adopted on 8 October 2026.

These tools use trackers to record or rebuild a visitor’s journey through a website or mobile app: mouse movements, taps, clicks, scrolling and, in some cases, what people type into forms. The result is played back as video. Businesses typically use them to find faults and improve page layout and usability.

The recommendation is aimed at two groups: the companies that build session replay tools, and the businesses that run them on their own sites and apps. It follows a public consultation held between February and May 2026.

Why consent and masking now apply to replay tools

The CNIL says session replay falls under article 82 of France’s data protection law, which covers trackers such as cookies, and that none of that article’s exemptions apply. In practice, a replay tool should not record anyone until they have agreed, under the consent rules the CNIL already applies to cookies.

The main points of the recommendation, some of them added after the consultation:

• the first layer of the consent banner should say specifically that session replay is used, and the CNIL suggests wording;
• the purposes for recording must be set before the tool is switched on, not after data is collected;
• data that is not relevant should be masked, including mouse movements in areas where people enter authentication codes;
• where replay runs inside a chatbot, the tool should be able to mask the conversation, as questions and answers may reveal sensitive data;
• the number of sessions recorded and the use of identifiers should be limited to what the purpose needs.

This matters if your website, online store or app uses session replay and has visitors in France. The recommendation is written under French law, and the CNIL’s announcement says nothing about UK rules. If you do not use session replay at all, nothing here changes for you.

What to check on your site or app

The CNIL’s announcement gives no compliance deadline and no date for the webinar it plans to run for businesses. If you use session replay, it is worth checking now:

• ask whoever runs your site or app whether any session recording tool is installed, including within analytics or chatbot add-ons;
• confirm it only starts recording after a visitor consents, and that your banner names it in the first layer;
• write down why you record sessions, before you record any more;
• switch on masking for form fields, login and verification-code areas, and chatbot conversations;
• record only as many sessions as that purpose needs.

Watch for the CNIL’s webinar date if you want its own explanation of the measures. Cognivise offers ongoing support and ownership for sites and apps whose tracking settings need checking and keeping up to date.