Session Recording and GDPR: How to Record Legally

Session recordings reveal how users actually interact with your site - where they click, scroll, hesitate, and abandon. This insight is invaluable for conversion optimization. But recording user sessions means capturing personal data, and under GDPR, that requires careful attention to consent, data minimization, and user rights.

GDPR applies to any business processing personal data of EU residents. Session recordings capture behavior patterns, device information, and potentially text inputs - all considered personal data. Getting this right protects both your users and your business.

What Session Recordings Capture

Types of Data Collected

Session recording tools capture DOM snapshots and mutations (page structure and changes), mouse movements and clicks, scroll behavior, form interactions (inputs, selections), keyboard events, and device and browser information.

This creates a detailed behavioral profile. Even without names or emails, this data often qualifies as personal data under GDPR because it can identify or single out individuals.

Sensitive Data Risks

Session recordings can accidentally capture highly sensitive information: passwords typed into visible fields, credit card numbers, personal messages, health information, and any text entered or displayed on screen.

Without proper masking, recordings become a data protection liability.

GDPR Requirements for Recording

Lawful Basis

GDPR requires a lawful basis for processing personal data. For session recording, the two relevant bases are consent (user explicitly agrees to recording) and legitimate interest (your interest in improving UX outweighs privacy impact).

Most privacy experts recommend consent for session recording. Legitimate interest is harder to justify given the detailed nature of behavioral data captured and the availability of less invasive alternatives.

Consent Requirements

Under GDPR, valid consent must be freely given (not coerced or bundled with other agreements), specific (clearly states that sessions will be recorded), informed (explains what's captured and why), unambiguous (requires clear affirmative action), and withdrawable (easy to revoke at any time).

Pre-checked boxes or implied consent don't satisfy GDPR. Users must actively opt in to recording.

Purpose Limitation

You can only use recorded data for the purposes disclosed when collecting consent. If you consent users for "improving user experience," you can't later use recordings for employee training, legal evidence, or marketing research without additional consent.

Define your purposes clearly and stick to them.

Data Minimization

Collect only what you need. This means recording only pages where insight is needed rather than site-wide, limiting recording duration, excluding sensitive pages like account settings or checkout, and masking unnecessary personal data.

More data isn't better under GDPR - it's higher risk with no additional legal protection.

The CNIL's 2026 Session Replay Recommendation

Update, September 2026: for the first time a major regulator has written rules specifically for session replay. On 25 February 2026 France's CNIL opened a public consultation on a draft recommendation covering tools that record and reconstruct browsing sessions, including mouse movements, clicks, scrolling and form input, on websites and mobile apps. The consultation closed on 22 April 2026 and the final text is expected once submissions are reviewed, but the draft leaves little room for interpretation. The purposes usually cited for recording, UX optimisation, technical troubleshooting and customer support, do not qualify as strictly necessary for providing the service, so recording requires consent. Each controller has to be able to demonstrate valid consent for its own purposes, contracts between the site and the tool vendor must define how proof of consent is generated, kept and shared, and the vendor cannot shift its consent obligations onto the publisher by contract.

Read against the requirements above, the draft confirms the direction this guide has taken since it was written: consent before the recorder loads, masking by default, short retention, and a processing agreement with the vendor. What it adds is the expectation that the vendor's product enforces consent rather than merely allowing it. That is the design principle behind Arktis, which does not load the recording script until the visitor consents and rejects any recording chunk on the server unless the visitor's consent flag is set. If you use a tool that records by default and relies on you to configure a consent gate, the CNIL's draft is the document to audit it against.

Implementing Compliant Recording

Consent Integration

Integrate recording consent with your consent management platform. Options include bundling with analytics consent (if your CMP supports granular categories), creating a separate "session recording" consent category, or presenting recording consent contextually on pages where you record.

Whatever approach you choose, make recording consent optional and clearly explained.

Masking Sensitive Data

Session recording tools should mask sensitive inputs by default. Configure masking for all password fields, payment information fields, personal identifiers (SSN, ID numbers), health-related inputs, any field where users enter sensitive information, and text content that might contain personal data.

Test your masking configuration thoroughly. Audit recordings periodically to ensure sensitive data isn't leaking through.

Technical Implementation

Most recording tools support privacy configurations. A typical privacy-first setup includes enabling strict masking mode by default, explicitly allowing recording only on specific page types, setting short retention periods, and disabling keystroke capture unless specifically needed.

Arktis session recordings are designed with privacy-first defaults and GDPR compliance built in.

User Rights Implementation

GDPR grants users rights over their data. For session recordings, this means access requests where users can request their recordings (provide a way to identify and export), deletion requests where users request deletion and all their recordings must be removed, and objection rights where users can object to processing even after consent.

Build processes to handle these requests within GDPR's 30-day response requirement.

Storage and Security

Data Protection

Session recordings contain personal data requiring appropriate security. This includes encryption at rest for stored recordings, encryption in transit during upload and playback, access controls limiting who can view recordings, and audit logging tracking who accessed what recordings.

Security breaches involving session recordings could expose sensitive user behavior, making strong protection essential.

Retention Limits

GDPR's storage limitation principle requires not keeping data longer than necessary. For session recordings, this typically means 30 to 90 days for active analysis, automatic deletion after the retention period, and documentation of why your chosen retention period is appropriate.

Longer retention requires stronger justification. Most UX insights come from recent recordings.

Data Location

If you use a third-party recording service, understand where data is stored. GDPR restricts transfers outside the EU/EEA unless adequate protections exist.

EU-based storage is simplest. For US-based providers, verify they have appropriate transfer mechanisms like Standard Contractual Clauses.

Third-Party Recording Tools

Vendor Assessment

When selecting a session recording vendor, evaluate GDPR compliance features (masking, consent integration, retention controls), data processing agreement availability, storage locations and transfer mechanisms, security certifications and practices, and their privacy policy and data handling.

Data Processing Agreements

GDPR requires written contracts with processors handling personal data on your behalf. These Data Processing Agreements must cover processing scope and purpose, security measures, subprocessor use, data subject rights assistance, and breach notification requirements.

Reputable recording vendors provide standard DPAs. Review them before implementation.

Processor vs Controller

You're the data controller - responsible for lawful collection and use. The recording vendor is typically a processor - acting on your instructions. But some vendors use aggregated recording data for their own purposes, which may make them joint controllers with additional implications.

Understand your vendor's role and responsibilities.

Common Compliance Mistakes

Recording Without Consent

The biggest mistake: enabling recording before implementing proper consent collection. Even "testing" without consent violates GDPR if you capture real user data.

Insufficient Masking

Default masking may not cover all sensitive fields on your site. Custom forms, dynamic content, and user-generated content need explicit masking configuration.

Ignoring Third-Party Content

Embedded content from third parties (chat widgets, social plugins) may contain personal data. Ensure these are masked or excluded from recordings.

Over-Retention

Keeping recordings "just in case" violates data minimization. Set retention periods based on actual analysis needs, not hypothetical future use.

Missing Documentation

GDPR requires documentation of processing activities. Document your recording purposes, consent mechanism, retention periods, and security measures.

Recording Without Consent - Is It Possible?

Legitimate Interest Approach

Some organizations attempt to justify recording under legitimate interest rather than consent. This requires a balancing test showing your interest in UX improvement outweighs the privacy impact, and demonstrating no less invasive alternatives exist.

This is difficult to justify for detailed session recordings. Regulators have increasingly viewed behavioral tracking as requiring consent.

Aggregated Analytics Alternative

If consent rates are too low for useful recordings, consider aggregate session analytics instead. Heatmaps, scroll depth, and click maps can provide UX insights with less personal data, potentially qualifying for legitimate interest.

But true session replay - watching individual user journeys - generally requires consent under current GDPR interpretation.

Practical Workflow

Implementation Steps

A GDPR-compliant recording implementation follows these steps: first, define which pages genuinely need recording; second, configure comprehensive data masking; third, integrate consent collection into your CMP; fourth, set appropriate retention periods; fifth, document your processing in your privacy policy; sixth, establish processes for user rights requests; and seventh, regularly audit recordings for compliance.

Ongoing Compliance

Compliance isn't one-time. Regularly audit masking effectiveness by reviewing sample recordings. Monitor consent rates and adjust collection if needed. Update privacy documentation when processes change. Train team members on proper recording access and use.

Getting Started

Evaluate your current session recording setup against these requirements. If you're recording without proper consent, stop until you've implemented compliant collection.

Arktis provides privacy-first session recordings with built-in masking, consent integration, and GDPR-compliant defaults.

Sources

1. GDPR Information Portal

2. EDPB, "Guidelines on Targeting Social Media Users"

3. UK ICO, "Guide to GDPR"

4. rrweb, GDPR in the session replay context (glossary)

5. CNIL, Session replay: the CNIL launches a public consultation on its draft recommendation

6. Clifford Chance, Session replay tools under scrutiny: CNIL launches public consultation (March 2026)

7. PPC Land, France's CNIL puts session replay tools under the privacy microscope