Session replay tools are legal to run under GDPR — but only gated behind consent, with aggressive masking, and documented in your DPIA. Auto-starting Hotjar or Clarity on page load is how sites end up in wiretapping complaints.
Why session replay is treated as high-risk
Session replay doesn’t sample analytics events — it reconstructs everything a visitor did: mouse paths, keystrokes into form fields, rage clicks on the billing page. European regulators treat that as high-risk processing that typically requires a DPIA, and in the US it has become the raw material for a wave of wiretapping claims under state laws like CIPA. We covered the case pattern in our cookie compliance lawsuits series: plaintiff firms don’t need to prove harm to send a demand letter — they need to show the recorder fired before you asked.
The one rule that matters: no recording before consent
Both Hotjar (now part of Contentsquare) and Microsoft Clarity are consent-agnostic by default: paste the snippet in and they start recording on the first pageview. That default is the compliance failure. The fix is the same for both:
- Load the recorder through your CMP or GTM, gated on an analytics consent signal — never hardcoded in the page <head>.
- If you use Google Consent Mode v2, map the recorder to
analytics_storagebeing granted, the same gating we walk through in the GTM setup guide. - Treat “consent by scrolling” as no consent. A recorder that starts while the banner is still on screen is pre-consent tracking, full stop — see the pre-consent detection checklist.
Hotjar: the settings that actually matter
- Suppression: keep keystroke and input suppression ON (default masks inputs; do not whitelist fields unless legal signs off). Add
data-hj-suppressto any container that can render user data — account pages, support widgets, order summaries. - Consent integration: fire the Hotjar snippet only after your CMP grants analytics consent. Do not rely on Hotjar’s own cookie banner detection.
- Retention: recordings should expire on the shortest cycle the plan allows; replay you keep for a year is discovery material, not product insight.
Microsoft Clarity: same idea, different switches
- Masking mode: set content masking to Strict unless you have a documented reason not to. Balanced mode still exposes rendered text.
- Consent API: Clarity exposes
window.clarity("consent")— call it only after the CMP grant, and keep the project-level “require consent” setting on so nothing runs before that call. - IP handling: Clarity discards IPs after geo-lookup, but that doesn’t make pre-consent recording lawful — the recording itself is the processing.
Verify it, don’t assume it
Every step above fails silently: a stray hardcoded snippet, a GTM trigger on All Pages, a theme update that re-injects the tag. The only reliable check is watching what actually fires before the banner is answered. CookieInspector’s free scan replays a clean visit and flags any recorder, pixel or analytics call that runs pre-consent — the exact behavior a plaintiff’s expert would screenshot. If you audit sites for clients, the law-firm workflow turns that into an evidence-grade PDF for the file.
Session replay is worth keeping. Just make it the second thing your site does after consent — never the first thing it does on load.