Session Replay and GDPR: Consent, Masking and Risk

Session replay can be used lawfully under GDPR, but no tool is compliant by itself. You need a legal basis, a clear privacy notice, masking of personal data, sensible retention and, in many setups, consent. This is general information, not legal advice, so involve your privacy lead or counsel.

Why replay attracts scrutiny

A recording reconstructs a person’s behavior in detail: what they read, where they hesitated, what they typed. If the recorder captures names, emails, addresses or payment details, that is personal data processing, and in some cases special-category data. Regulators have focused on the gap between what visitors expect from a website and what a recorder quietly collects. The official text of the GDPR sets the principles: lawfulness, transparency, data minimisation, storage limitation and security.

The main levers

Lever	What to do	Why it helps
Masking	Mask all inputs; exclude sensitive pages	Raw personal data never reaches the vendor
Consent	Gate the recorder behind your banner where required	Provides a basis and respects choice
Notice	Mention replay and its purpose in the privacy notice	Transparency
Retention	Set the shortest workable window	Storage limitation
Access	Restrict who can watch recordings	Security and need-to-know
Vendor terms	Sign a data processing agreement; check where data is stored	Processor obligations

Masking in practice

BusinessMCP’s session replay page states that form inputs are masked by the recorder and that known bots are rejected at ingest. Treat claims like this as a starting point and verify. Run your own test: fill in every form on your site with obviously fake values, then find the recording and check whether any of the values appear. Do the same for pages that display data such as account details, order confirmations and invoices, because masked inputs do not hide text rendered elsewhere on the page.

Key takeaway: masking should be tested, not assumed. The test takes ten minutes and should happen before launch and after every major site change.

Consent and the cookieless question

Cookieless tools are popular because they avoid some storage rules, but cookieless does not mean consent-free. BusinessMCP’s own consent mode guide is cautious: it describes cookieless first-party analytics as “a strong posture with real paperwork attached,” not an exemption, and notes that some regulators may apply device-storage rules to localStorage identifiers. It also says Consent Mode transmits a visitor’s choice but does not create a legal basis, and covers only Google’s tags.

On the product side, the session replay page says that in gated consent modes the recorder and identify events wait for consent from your banner, and that in default mode the site owner is the controller. How you configure that mode is your decision and your responsibility. For the wider picture on identification, see the vendor’s visitor identification GDPR guide.

Whether you need consent depends on your jurisdiction, your tool and the data you capture. Some teams record only after consent; others rely on legitimate interests with heavy masking and take advice on the ePrivacy side. We cannot tell you which applies to you.

Retention and access

Keep recordings only as long as the purpose needs. A product team doing weekly reviews rarely needs six months. The vendor plans differ widely, as covered in session replay data retention. Also decide who may watch: a short list of named reviewers, not everyone with a login. If your tool supports it, avoid recording logged-in areas entirely.

Special cases

• Children’s sites and health, finance or legal services. Higher risk, so consider not recording at all.
• Customer support tools embedded in the page. Chat content may appear in recordings. Exclude the widget.
• Session identification. Linking a recording to a named person is a further step. Linking to a company is a different level of risk than linking to an individual, but both need a basis. See session replay for B2B websites.

Pre-launch checklist

1. Write down the purpose: what decisions will recordings inform?
2. Choose the legal basis and document it with your privacy lead.
3. Update the privacy notice and cookie or storage disclosures.
4. Configure masking and exclude sensitive pages.
5. Test masking with dummy data.
6. Connect the recorder to your consent banner if you rely on consent.
7. Set retention and reviewer access.
8. Sign the vendor’s data processing agreement and check data location.
9. Schedule a review of all of this every six months.

For tool selection with privacy in mind, our session replay software guide lists the controls to compare. And for broader reading on cookieless options, see BusinessMCP’s cookieless analytics tools comparison, keeping in mind it is a vendor page.

The honest summary

Privacy-safe replay is mostly configuration and discipline: mask, minimise, inform, delete. The legal answer on consent varies. If anyone on your team is unsure, pause recording until a qualified person has looked at your setup.

Documenting your decision

Regulators and internal auditors do not only ask whether you did something sensible. They ask whether you can show your reasoning. A short internal record, often a page or two, is enough for most session replay projects. It should state the purpose, the data captured and masked, the legal basis chosen and why, the consent mechanism, the retention period, who has access, which vendor is the processor and where data is stored, and the date of the last review.

If your reasoning relies on legitimate interests, a balancing test written down at the time is far more persuasive than one reconstructed later. If it relies on consent, keep evidence of how the banner works and that the recorder does not load before consent. Where recordings could capture special-category data, such as health information on a clinic website, ask whether recording those pages is necessary at all. Excluding them is usually the cheapest control.

Common failure points

Teams that think they are careful still trip over the same few things:

• A new form added after launch that was not masked, because masking was configured by selector and the new field used a different one.
• Rendered personal data such as an order summary or a profile page, where the text is not an input and so is not masked by input-masking alone.
• Embedded third-party content, such as chat widgets or payment frames, that appears in recordings or, conversely, is invisible and confuses reviewers.
• Access creep, where everyone in the company can open recordings because the tool shipped with broad defaults.
• Forgotten retention, where a trial plan was upgraded and the shorter window set during the trial was lost.

A calendar reminder to retest masking after each significant site release catches most of these. Record the date and the tester in your internal notes.

Where to read more

Beyond the regulation text and your regulator’s guidance, vendors publish their own positions. BusinessMCP’s page on session replay and its consent mode guide state how its product behaves, and are useful for understanding what to ask any vendor. They are not legal opinions, and they describe one product. Pair them with your own counsel. For retention specifically, see session replay data retention.