Session replay and heatmap tools — Hotjar, Microsoft Clarity, FullStory, and similar — occupy a slightly odd position in most companies' compliance thinking. They're usually installed by a product, UX, or design team looking to understand user behavior, not by whoever's responsible for marketing trackers or ad pixels. Which means they often never enter the conversation when someone configures a cookie banner, even though they're trackers in exactly the same regulatory sense as a Facebook Pixel.
What these tools actually record
This is worth being specific about, because "session replay" undersells how much data is involved:
- Mouse movement, clicks, and scroll behavior across the entire session, not just aggregate stats
- Form field interaction, and depending on configuration, sometimes the actual values typed — most tools mask password fields by default, but not necessarily every sensitive field (an email field, a name field, a search box) unless specifically configured to
- Full visual page recordings, functionally a screen-recording of what the visitor saw and did
- Device, browser, and often approximate location data, the same as most analytics tools
The combination of mouse/keyboard behavior and visual recording makes these tools meaningfully more data-intensive than a standard analytics pageview — and correspondingly, several DPAs have specifically flagged session replay as deserving particular attention in consent reviews, not just a generic "it's a cookie, treat it like any other" classification.
The masking question is the one that actually matters
Every major session replay tool includes some form of automatic masking for sensitive fields — but the defaults vary significantly between tools, and what counts as "sensitive" in the default configuration is often narrower than what a specific site actually collects. A support form with a free-text "describe your issue" field, for instance, isn't masked by most defaults, and visitors sometimes paste sensitive information (an account number, a health detail, a password they typed somewhere by mistake) into exactly those kinds of fields. Whether your specific site's forms are adequately masked is a configuration question worth actively checking, not assuming is handled by the tool's defaults.
Does this need consent like any other tracker?
Yes — session replay tools set cookies or use similar storage mechanisms to maintain a session identity, and they collect data well beyond what qualifies as "strictly necessary" for the site to function. They fall under the same ePrivacy/GDPR consent requirement as analytics or advertising trackers. The common mistake isn't disagreeing with this in principle — it's that because these tools are installed by a different team than the one managing the cookie banner, nobody connects the two, and the tool ends up firing unconditionally, pre-consent, the same as any other overlooked script.
What to check on your own site
- Confirm the tool is actually routed through your consent platform — installed via your CMP's script-blocking mechanism, not pasted directly into the page template, which is a common shortcut during initial setup that bypasses the banner entirely
- Check masking configuration specifically for your site's forms, not just the tool's documented defaults — any free-text field is worth reviewing individually
- Load the site in an incognito window and check the Network tab before interacting with the banner — the same check as any other tracker audit; look for requests to
hotjar.com,clarity.ms,fullstory.com, or your specific tool's domain - Click reject and confirm the recording session actually stops, not just that the banner closes — this is the same reject-behavior check that applies to every other tracker (see our piece on reject buttons that don't actually reject)
Why this category gets missed so often
Session replay tools solve a real, legitimate problem — understanding where visitors struggle on a site — and the team installing them is usually thinking about UX research, not data protection. That's a reasonable place for their attention to be; it's just not a substitute for someone also checking the compliance side, which in practice means treating these tools as full trackers in any audit, not a separate, lower-priority category.
Run a free scan of your site and check whether your session replay tool is firing before — or after — visitors make a consent choice.