Session Replay and GDPR: Configuring Hotjar, Clarity and FullStory

On November 5, 2026, France's CNIL published its final recommendation on session replay and heatmap tools, adopted by the CNIL's board on October 8. If your site runs Hotjar, Microsoft Clarity, FullStory, or any tool that records how visitors move through a page, the recommendation settles a question CRO and analytics teams have debated for years: does watching someone use your site require the same consent as a tracking cookie? The CNIL's answer is yes, with no exemption, and it comes with specific expectations about what you record and how long you keep it.

Session Replay and GDPR: Configuring Hotjar, Clarity and FullStory

What the CNIL Recommendation Says

Session replay tools capture mouse movement, clicks, scrolling and form input, then reconstruct it into a video-like playback of an individual visit. Heatmaps aggregate the same signals across many sessions into a single view. Both read from and write to the visitor's device to do this, which is why the CNIL grounds its recommendation in Article 82 of the French Data Protection Act, the French implementation of the ePrivacy Directive's Article 5(3) and the same provision that governs ordinary tracking cookies.

Article 82 only exempts a tracker from consent if it's strictly necessary to provide the service the visitor asked for, or if it exists solely to carry an electronic communication. The CNIL's recommendation applies that test to session replay directly: publishers could run their sites without it, and it has nothing to do with transmitting a message, so neither exemption applies. Prior consent is required before the tool starts capturing data, the same way it's required before an analytics or advertising cookie fires.

Because a reconstructed session also identifies an individual directly or indirectly, GDPR applies on top of the consent requirement, particularly the Article 6 legal basis for whatever processing happens after the recording is made.

The CNIL also draws a line on acceptable purposes. It names three: detecting and fixing technical errors, identifying friction points to improve the user experience, and supporting a specific customer support request. It says session replay should not be used for advertising retargeting, on the basis that less intrusive alternatives, basket-reminder cookies, for instance, exist, and the practice fails data minimisation.

Why "It's Just Analytics" Doesn't Hold Up

The instinct for a lot of teams is to fold session replay consent into the existing analytics toggle. The CNIL's recommendation works against that instinct in two ways. First, each of the three purposes above needs its own short label and description in the consent interface, not a single bundled "analytics" checkbox. Second, and new in the final text published this month, the CNIL now recommends a further short, plainly worded notice at the first layer of the banner, shown separately from those purpose labels, that specifically names session replay as the technology in use. The reasoning is that awareness of session replay among visitors is low: most people clicking "accept" on a cookie banner have no idea a tool is reconstructing their mouse movements and keystrokes afterward.

This is consistent with how the CNIL has approached other specific tracking technologies it has looked at individually, such as email tracking pixels, where it has set purpose-level consent as the standard rather than accepting a single bundled checkbox. For how that principle gets applied in a CMP, see custom purposes for consent beyond standard frameworks, which already lists session_recording as an example purpose outside IAB TCF's scope.

It also means revisiting setups that predate this recommendation. If Hotjar, Clarity or FullStory on your site is currently wired into a general "Performance / Analytics" category alongside tools like Google Analytics, that was a reasonable setup before the CNIL's final text. It isn't now. Re-tag session replay to its own purpose rather than leaving it bundled in.

What Changes After Consent

Consent gets you in the door, but the CNIL recommendation spends most of its length on what happens after that, organised around three familiar GDPR principles.

On minimisation, the CNIL wants publishers to limit which sessions get collected in the first place rather than recording every visit by default, through random sampling, recording only when a defined trigger like an error occurs, or deleting sessions promptly once it's clear they weren't needed. Masking sits alongside this: form fields, account information, text inputs and images should be masked by default, and the final text adds two categories that weren't in the draft version published earlier this year, mouse movements and clicks on on-screen keypads, which can reveal login codes, and chatbot conversation content, since question-and-answer exchanges can reveal sensitive data on their own. Session and user identifiers should also avoid linking a visitor's activity together indefinitely by default.

On storage limitation, the CNIL's own appendix table gives a sense of what "no longer than necessary" means purpose by purpose: a few hours after the session ends for support cases, and a few months for error detection and UX improvement. Publishers need the ability to delete one visitor's sessions individually, not just age everything out on a blanket retention window, both to honour a GDPR access or erasure request and because withdrawing consent requires deleting the data already collected unless another legal basis justifies keeping it.

On security, passwords and payment details should never reach the recording at all, masked or not, and access to whatever is recorded should run through permissions that get reviewed periodically, the same baseline the CNIL expects for any internal system handling personal data.

Configuring Hotjar, Clarity and FullStory

Each tool handles consent a little differently, but the goal is the same for all three: nothing should capture a visitor before they agree, and capture should stop again if they withdraw.

Microsoft Clarity

Clarity is the most straightforward of the three because it has a built-in two-way consent signal, and UniConsent talks to it automatically. Turn off "set cookies by default" in your Clarity project settings, and UniConsent tells Clarity to start or stop based on whichever purpose or category you've assigned to session replay. Full setup is in the Microsoft Clarity consent mode tutorial. Clarity also has its own masking option for hiding fields like account details from the recording.

Hotjar

Hotjar doesn't pick up a CMP signal on its own, so UniConsent's Custom Purposes feature is used to start it explicitly: create a dedicated session replay purpose, write the first-layer description the CNIL expects, and wire that purpose to tell Hotjar to start recording once a visitor agrees. Hotjar also supports masking specific form fields and account information by default, rather than needing every sensitive field blocked one at a time.

FullStory

FullStory works the same way as Hotjar: it stays off by default, and a dedicated session replay purpose tells it to start capturing once consent is granted. FullStory's own masking controls let you record a page while excluding specific fields from ever reaching its servers.

Step-by-step setup for connecting a Custom Purpose to a third-party script is in the Custom Purposes tutorial and the UnicScript tutorial.

Setting Retention and Deletion

Deleting one visitor's sessions on request runs through each vendor's own deletion tools, API or support channel, and your Data Processing Agreement with the vendor should specify how fast that happens. What UniConsent can do directly is give you the evidence trail the CNIL recommendation assumes exists: every grant and withdrawal of the session replay purpose is written to the Consent DB with a timestamp, so when a visitor asks what they agreed to and when, you have an answer that doesn't depend on the session replay vendor's own records.

Where This Leaves Marketing and CRO Teams

None of this means retiring session replay. The CNIL explicitly accepts it for technical debugging, UX improvement and support, which covers the overwhelming majority of what CRO teams actually use it for. What changes is that recording can no longer be the default state of every visit, behavioral profiling repurposed for retargeting is off the table, and the consent step has to happen before the first frame is captured rather than being assumed from a general cookie banner accept.

Teams that already run a layered, purpose-specific consent banner have the easier path here: add a distinct session replay purpose, wire the three tools to it, turn on the masking defaults, and most of the recommendation is satisfied. Teams relying on a single "accept all cookies" bucket have more rework ahead, starting with separating session replay from whatever purpose it's currently hiding inside.

How UniConsent Helps

UniConsent supports session replay as a standalone Custom Purpose or as a mapped Consent Category, with a first-layer description of session replay that you write yourself, automatic signal forwarding to Microsoft Clarity's native consent API, and Custom Purpose gating for Hotjar and FullStory so recording only starts after the visitor has actually agreed, and stops when they withdraw it.

Sign up and add a session replay purpose to your consent banner in a few minutes.