Microsoft Clarity Consent Mode in the EU: Setup Guide

What Microsoft changed on October 31, 2025

Microsoft Clarity is a free tool for heatmaps and session recordings. On October 31, 2025, Microsoft started to enforce consent signals. In its own words: "Starting October 31, 2025, Clarity begins enforcing consent signal requirements for page visits originating from the European Economic Area (EEA), United Kingdom (UK), and Switzerland (CH)" (Microsoft Learn, Consent Management).

Three details matter in practice:

1. Consent Mode is on by default for these visitors. Clarity's "Consent Mode" decides whether Clarity may set cookies. For visitors from the EEA, the UK and Switzerland it is on by default, and the starting state is denied until your site tells Clarity otherwise (same page).
2. Microsoft says it isn't a new legal rule. The page says the update "does not introduce new consent requirements". It enforces rules that already existed. Many sites simply never passed the signal before.
3. It's about where the visitor is, not where you are. Clarity uses the visitor's IP address to work out their location (Clarity FAQ). A US shop with Dutch customers is affected too.

Clarity treats a given consent as valid for up to 9 months, unless the visitor changes it (Microsoft Learn).

What happens without a consent signal

This is where most guides get it wrong. Without a "granted" signal, Clarity does not stop. Microsoft's table: when analytics_storage is denied, "Clarity tag loads, but only cookieless data is collected" (Microsoft Learn). No _clck or _clsk cookies are set, and Clarity gives each page view its own ID (Consent API v2).

Microsoft lists what that does to your reports (Microsoft Learn, reporting without consent):

So you still get click heatmaps and short single-page replays. You lose the things that make recordings useful for a shop: following one visitor from product page to cart, and funnels.

There is a second signal, ad_storage. When it is granted, Clarity shares data with Microsoft Ads for retargeting and conversions. When it is denied, it doesn't (Microsoft Learn). If you don't advertise on Microsoft Ads, there is no reason to grant it.

First decide: may Clarity load before someone says yes?

Clarity's consent mode is about cookies. The law in the EU is broader. Article 5(3) of the ePrivacy Directive covers storing or reading information on a visitor's device, not only cookies. The European Data Protection Board (EDPB) says this explicitly covers "JavaScript code, where the accessing entity instructs the browser of the user to send asynchronous requests with the targeted information" (EDPB Guidelines 2/2023, version 2.0, para. 33). A cookieless Clarity tag still does that.

France's regulator, the CNIL, goes further for session replay. Its final recommendation, adopted on October 8, 2026 and published on November 5, 2026, says session replay needs prior consent because none of the cookie-rule exemptions apply, and that the visitor should be told on the first layer of the banner that replay is used (CNIL announcement, in French; recommendation PDF). Clarity's cookieless mode still produces one-page recordings, so it is still replay. We summarize the recommendation in our GDPR guide.

That leaves two setups:

Microsoft's terms allowing something doesn't make it lawful for your site. For a European shop, setup A is the cautious choice. Discuss B with your DPO before you pick it.

The trap in setup A: if you only block the script until consent, Clarity still starts in denied for EEA visitors, because nobody told it that the visitor said yes. You get cookieless data from people who actually agreed. So with setup A you must also pass the consent signal. The steps below cover both.

Setting up Clarity consent with your banner

First, check the project setting. In Clarity, open your project, go to Settings → Setup and turn off cookies by default, so Clarity waits for a signal (Microsoft Learn, Consent Mode). For EEA, UK and Swiss visitors this is already the default; the setting also covers the rest of your traffic.

Then pick the route that matches your site.

Route 1: a banner that talks to Clarity for you

Microsoft lists banners (consent management platforms, or CMPs) that pass the choice to Clarity automatically. As of its September 2026 update, the list includes ABconsent (Sirdata), Axeptio, ConsentBit, Cookiebot, CookieHub, CookieYes, CookieZen, FitConsent, Ketch, My Agile Privacy, Pandectes, Real Cookie Banner, Seers AI, UniConsent, Usercentrics, WebToffee and the WP Consent API plugin. OneTrust is listed as "coming soon" (Microsoft Learn, CMPs).

Each of these has its own guide, linked from Microsoft's page. The pattern is the same:

1. Turn on the Clarity integration (often called "Microsoft Clarity Consent Mode") in your banner's settings.
2. Put Clarity in the statistics/analytics category of your banner, not "necessary".
3. If you go for setup A, let the banner block the Clarity script until consent (most banners call this auto-blocking or prior blocking).

Route 2: Shopify, Wix and WordPress

• Shopify: turn on Shopify's own cookie banner (Settings → Customer privacy). Clarity then picks up the visitor's choice. Microsoft says no further action is needed (Microsoft Learn, third-party platforms).
• Wix: turn on the Wix cookie banner; Clarity detects it (same page).
• WordPress: Microsoft points to the CookieYes plugin. Real Cookie Banner, WebToffee and the WP Consent API plugin are also on the supported list above.
• Webflow: no built-in support. Use a supported banner, Google Consent Mode or the API.

Route 3: Google Consent Mode

If your banner already sends Google Consent Mode signals (common with Google Analytics 4 and Google Ads), Clarity reads analytics_storage and ad_storage from it. Microsoft's integration page says Clarity "automatically interprets and honors GCM consent signals" with no extra configuration (Microsoft Learn, GCM).

One warning: Microsoft's own FAQ still says Google Consent Mode support is "coming soon" (Clarity FAQ), while the integration page says it works. Don't rely on either page. Test it with the console check below.

Route 4: your own banner (Clarity's consentv2 API)

If your banner isn't supported, your developer passes the choice with Clarity's API. consentv2 replaces the older consent call, which is "planned for deprecation" (Microsoft Learn, Consent API v2).

When a visitor accepts statistics cookies:

window.clarity('consentv2', {
  ad_Storage: "denied",        // "granted" only if you use Microsoft Ads
  analytics_Storage: "granted"
});

When a visitor declines or withdraws consent:

window.clarity('consent', false); // clears Clarity's cookies and ends the session

Call the "granted" line on every page load for a visitor who already agreed, not only at the moment they click. Microsoft's FAQ: "Any page using Clarity should include a call to the Consent API" (Clarity FAQ).

If you use Google Tag Manager

Many shops load Clarity through Google Tag Manager (GTM). Two settings matter:

1. In the Clarity tag's Consent Settings, require analytics_storage. GTM then only fires the tag after consent (setup A).
2. Make sure your banner sends Consent Mode signals to GTM, or add a small tag that runs the consentv2 line above after consent.

How to check it works

Open your shop in a private window, so you start without cookies.

1. Open the developer tools (right-click → Inspect) and go to Console.

2. Before you click anything in the banner, paste this line from Microsoft's docs and press Enter (Microsoft Learn, Consent Mode):

   clarity('metadata', (d, upgrade, consent) => { console.log('consentStatus:', consent); }, false, true, true);
   

3. Read the result:

   • Setup A: you get an error that clarity is not defined. Good: Clarity hasn't loaded.
   • Setup B: you see analytics_storage: "DENIED". Good: it's waiting.

4. Accept statistics cookies in your banner and run the line again. You should now see analytics_storage: "GRANTED". If it still says DENIED, the signal isn't reaching Clarity.

5. Go to Application → Cookies. After "yes" you should see _clck and _clsk. Clear cookies, reload, click "no", and check that they are not there.

6. For setup A, also check the Network tab: before you click "yes", there should be no requests to clarity.ms.

Do this on a phone-sized window too. Some banners behave differently on mobile.

How much data you'll lose

Two effects, and they add up:

• People who say no. With setup A, they're gone from Clarity completely. With setup B, they show up as one-page sessions you can't follow across pages.
• People who never answer. Visitors who ignore the banner count as "no".

Your banner's dashboard (Cookiebot, Usercentrics, CookieYes and others report this) tells you your own acceptance rate for statistics cookies. That number is the share of visitors Clarity can still follow across pages. Rates vary a lot by country, banner design and audience, so use your own figure, not a benchmark.

Hypothetical example: a shop gets 40,000 sessions a month from EU visitors, and 55% accept statistics cookies. Under setup A, Clarity sees about 22,000 full sessions. That is still plenty for heatmaps and recordings: you need dozens of sessions per page, not tens of thousands. What suffers is anything that compares small groups, like a funnel for one traffic source on mobile.

Two habits keep the remaining data honest:

• Compare like with like. Your Clarity numbers will no longer match Google Analytics or your shop's order count. That's expected: each tool counts a different group.
• Don't change the banner during a comparison. A new banner design changes who accepts, so last month's heatmap and this month's heatmap show different groups of people.

When to consider another tool

For most small shops, the answer is: keep Clarity and set it up properly. It is free, with no traffic limits (Clarity FAQ), and the steps above take an afternoon.

Reasons people switch anyway:

• Data location and use. Clarity data is stored in Microsoft's Azure cloud, with no region option (Clarity FAQ). Some clients and agencies want EU hosting in the contract. See our privacy comparison of EU-hosted tools.
• Retention. Clarity keeps recordings for 30 days (Microsoft Learn, data retention).
• You need more than heatmaps. Clarity has no A/B tests or on-site surveys.

Varly, which is in private beta, takes a different default: it shows no banner of its own, reads the choice from your existing banner and does nothing at all until a visitor accepts statistics cookies (how Varly follows your cookie banner). That's the setup A behavior out of the box. But if Clarity does what you need, the switch isn't worth it for consent alone.

For the full picture, read Microsoft Clarity alternatives for EU shops and Microsoft Clarity vs Hotjar.

FAQ

Does this apply if my shop is outside the EU? Yes, if you get visitors from the EEA, the UK or Switzerland. Clarity decides by the visitor's location.

Does Clarity still record sessions without consent? Yes, in cookieless mode. Each recording covers one page view, because Clarity can't link pages together without a cookie.

Is cookieless Clarity "GDPR-proof"? Not automatically. EU rules on device access cover more than cookies (see the EDPB quote above), and France's CNIL, in its November 2026 recommendation, says session replay always needs consent. Ask your DPO.

Which category should Clarity have in my banner? Statistics or analytics. It is not "strictly necessary".

Do I need to call the API on every page? If you use the API yourself, yes: on every page load for visitors who agreed. Supported banners and Google Consent Mode do this for you.

---

Want consent handled out of the box? Varly waits for your cookie banner by default and is in private beta. Join the waitlist.

More on this topic: GDPR and CRO: heatmaps, session recordings and A/B testing.