GDPR and CRO: Session Recordings, Heatmaps, A/B Tests

The short answer: do you need consent?

For a shop with visitors in the European Union, the safe working assumption is:

The rest of this guide explains each row, so you can judge your own setup.

Two words we'll use a lot:

• Consent: a visitor's clear "yes", given freely before tracking starts, as easy to withdraw as to give.
• CMP (consent management platform): your cookie banner and the tool behind it, such as Cookiebot, Usercentrics or CookieYes.

Why heatmaps and recordings count as "reading from the device"

Two laws work together here.

1. The ePrivacy Directive (the "cookie rule"). Article 5(3) says that storing information on a user's device, or gaining access to information already stored there, needs consent. The only exceptions: the storage is needed to transmit a message, or it is strictly necessary for a service the user explicitly asked for. Each EU country has its own version of this rule: Germany's TDDDG, France's Article 82 of its Data Protection Act, and so on.

This rule doesn't care whether the data is personal. It applies to the act of storing or reading.

2. The GDPR. Once you have the data, using it is "processing of personal data". You need a legal basis, you must keep it to what's necessary, keep it safe and delete it on time.

What about "cookieless" tools? Many vendors say their tool needs no consent because it sets no cookies. The European Data Protection Board (EDPB), where all EU regulators meet, addressed this in its guidelines on the technical scope of Article 5(3). Its final version (October 2024) says access to the device includes "JavaScript code, where the accessing entity instructs the browser of the user to send asynchronous requests with the targeted information. Such access clearly falls within the scope of Article 5(3)" (EDPB Guidelines 2/2023, v2.0, para. 33). The same guidelines cover tracking pixels and local storage.

A heatmap or recording script does exactly that: it reads clicks, scrolling and page content in the browser and sends them to a server. Whether it also sets a cookie doesn't change the question much.

Is a session recording personal data? Usually yes. A replay shows one person's visit, often with a device ID, location and what they looked at. Masking reduces the risk, but masking is not the same as anonymization.

What France's CNIL proposed for session replay in 2026

The CNIL, France's data protection authority, is the first regulator to write a full recommendation on session replay tools. It published the draft on February 25, 2026, the public consultation closed on April 22, 2026, and the CNIL says it will adopt a final version afterwards (CNIL). In early November 2026 the CNIL announced that it will adopt the recommendation "in the coming weeks", with a webinar on November 17, 2026 (CNIL event page).

The draft isn't binding. But regulators across Europe read each other's work, and it is the most concrete guidance available. The main points, from the draft text and a summary by Clifford Chance:

• Consent is the default. Session replay falls under the cookie rule. Purposes like improving the user experience or finding bugs are not "strictly necessary".
• Decide your purpose before you record. The draft names three: finding technical errors, improving the user experience (friction such as rage clicks), and customer support. You can't record first and decide later what you'll use it for.
• Record less. The CNIL recommends random sampling, or recording only when a trigger happens (such as an error), and deleting sessions you don't need.
• Mask by default. Providers should offer automatic and manual masking of images, forms, text fields and fields with account data. "In the absence of configuration, masking should apply by default."
• Block passwords and payment data. The draft asks for blocking of "any passwords, banking information" and other sensitive data.
• Use short-lived, random IDs for the UX and error purposes, so sessions can't be linked to a person or across sites.
• Keep recordings for "a few months" for UX and error analysis, and "a few hours" after the session for support use.
• Tell visitors clearly. Each purpose gets a short label in the CMP. As good practice, mention session replay on the first layer of the banner.
• Roles. If the vendor only provides the tool, it is a processor (it works for you). If it also reuses the data for its own purposes, such as improving its product, it becomes a controller for that use, and you may be joint controllers for the data collection itself.
• Never for retargeting. The CNIL says session replay should not be used to retarget visitors with ads.

What this means for you, even outside France: use consent, turn on strict masking, keep checkout and account pages out, record a share of visits instead of all of them if you have plenty of traffic, and set retention to weeks or a few months.

France's audience-measurement exemption doesn't cover replay

France allows some analytics without consent, under strict conditions (anonymous statistics, only for the site owner, limited retention). Session replay is not part of it: the CNIL's self-assessment tool for the exemption lists "Désactivation de toute fonctionnalité du type rejeu de session" (switch off any session replay feature) as a condition (CNIL self-assessment tool, July 2025). Matomo, which is widely used under that exemption, tells its own users that heatmaps and session recordings need prior consent (Matomo FAQ).

Germany: TDDDG §25

Germany's cookie rule is §25 of the TDDDG (the Telecommunications Digital Services Data Protection Act; it was called TTDSG until May 2024). It says storing information on, or reading it from, a user's device is only allowed with consent based on "clear and comprehensive information" (§25 TDDDG). The two exceptions are the same as in the EU directive: transmitting a message, or what is strictly necessary for a service the user explicitly asked for.

Heatmaps, recordings and A/B tests help you run your shop better. The visitor didn't ask for them. That's why German privacy advisors almost always put them in the consent category.

Microsoft Clarity's consent enforcement and what it changes

Microsoft Clarity is the most widely installed free recording tool. Since October 31, 2025, Clarity enforces consent signals for visitors from the EEA, the UK and Switzerland (Microsoft Learn). Without a "granted" signal, Clarity treats the visitor as "denied".

The important detail: "denied" doesn't switch Clarity off. Microsoft says that with analytics consent denied, the "Clarity tag loads, but only cookieless data is collected". Every page view becomes its own session (Microsoft Learn). Given the EDPB's view of cookieless tracking above, many EU sites choose to block Clarity entirely until the visitor says yes, and then pass the consent signal.

Our step-by-step guide covers this: Microsoft Clarity consent mode in the EU.

Can A/B tests run without consent?

This is where vendor marketing and regulator guidance drift apart.

How an A/B test touches the device. To show a visitor the same version on every page and every visit, the tool stores the assignment, in a cookie or in the browser's local storage. To measure the result, it sends events (page views, add to cart, orders) to a server. Both steps fall under Article 5(3) as the EDPB reads it.

What vendors say. Some examples, as of November 2026:

• Varify.io says it sets no cookies and stores the variant in local storage, which it says "doesn't require a consent banner" under "current ePrivacy guidance". The same page adds that whether you need consent "is up to your legal review" (Varify).
• Kameleoon lets you choose "Consent required" or "Consent not required" per project, plus options for what happens before a choice is made (Kameleoon docs).
• AB Tasty documents a mode in which short-lived technical cookies are set before consent (AB Tasty docs).
• Convert has an option that delays cookies until consent, while experiences can still show (Convert support).

What regulators say. We found no EU regulator guidance that exempts A/B testing as a category. The exemption is for what is strictly necessary for a service the user asked for. A test exists to help the shop. Local storage is still storage on the device (EDPB guidelines above).

A workable approach:

1. Run tests only for visitors who accepted statistics cookies.
2. Show everyone else the original page.
3. Keep that rule the same for every version, so the split stays fair.

The trade-off is real: your test only measures people who accept. Usually that's fine, because the group is the same for every version. But if, say, mobile visitors decline much more often than desktop visitors, your test mostly measures desktop. Check the share of each device in your test against your total traffic.

One more test-specific risk: if your banner or consent logic treats versions differently, you get a sample ratio mismatch (the split isn't the 50/50 you set). See sample ratio mismatch.

Masking, checkout and payment fields

Masking means hiding parts of the page in the recording. What matters most is where it happens:

• On the visitor's device (in the browser): hidden text never leaves the browser. The vendor never receives it.
• On the vendor's servers: the data is sent, stored, and hidden only when you watch. It still exists.

The CNIL draft asks for masking by default and for blocking passwords and payment data. In practice:

Default masking differs a lot between tools. Microsoft Clarity's default "Balanced" mode masks numbers and email addresses; input fields are always masked (Microsoft Learn). PostHog masks inputs by default but not page text (PostHog docs). FullStory's fully private mode is available on request rather than on by default (FullStory help). We compare the defaults of 13 tools in EU-hosted heatmap and recording tools: a privacy comparison.

Always test it yourself. Make a test order (or a test account) with a fake name and address, accept cookies, then watch your own recording. If you can read your fake name, so can anyone with access.

Retention: how long to keep recordings

Retention is how long the vendor keeps the data before deleting it. The GDPR says: no longer than necessary for the purpose.

The CNIL draft suggests "a few months" for UX and error analysis, and a few hours after the session for support use. For a shop, a sensible default:

• Recordings: 30 to 90 days. Long enough to analyze a change, short enough to limit risk.
• Recordings you keep for a report: longer, but only the few you need, with a reason.
• Heatmap click data: months, because heatmaps need volume and it's less detailed.
• Survey answers: as long as you actually use them; delete open answers that contain personal details.

Check that your vendor lets you delete a single recording. A visitor can ask you to.

Where data is stored and who processes it

Processor or controller? Most CRO vendors are your processor: they handle data on your behalf. You then need a data processing agreement (DPA, required by Article 28 GDPR). Read it for one thing in particular: does the vendor use your visitors' data for its own purposes, such as training AI models or improving its product? If yes, the CNIL draft says it becomes a controller for that use, and you may share responsibility for the collection.

Sub-processors. These are the companies your vendor uses: cloud hosting, CDNs (content delivery networks, which deliver the script quickly from servers near the visitor), email, AI providers. They are listed in the vendor's sub-processor list. Look for US companies in that list; most vendors have some.

EU hosting is good, but it's not the whole story. Data stored in Frankfurt can still be accessed by a US parent company or a US sub-processor. For transfers to the US, most vendors rely on the EU-US Data Privacy Framework (DPF). The EU General Court upheld it in September 2025; an appeal (case C-703/25 P) is pending at the Court of Justice as far as we could verify (WilmerHale). If the DPF falls, transfers need other safeguards.

To be transparent about our own setup: Varly stores data with Hetzner in Germany, and Cloudflare (a US company) sits in front as CDN. Many vendors have a similar mix; ask for the details.

Consent rates and what they do to your data

With consent-first tracking, your tools only see visitors who said yes. A few practical effects:

• Your numbers drop, and that's expected. Varly, Clarity with consent and your banner-gated GA4 will all show fewer sessions than your server logs or your shop's order count.
• Heatmaps and recordings still work. They need dozens of sessions per page, not every session.
• Your data has a bias. People who accept may differ from people who decline. Keep it in mind when you compare devices or countries.
• Don't redesign your banner to trick people into "yes". Dark patterns (a huge "Accept" button and a hidden "Reject") are exactly what regulators fine. A CNIL-style banner has "Accept" and "Refuse" at the same level.

Hypothetical example: a shop has 50,000 monthly sessions and 60% of visitors accept statistics cookies. Its tools see 30,000 sessions. For a heatmap on the product page template, that's more than enough. For an A/B test, use 30,000 (not 50,000) as your traffic in the sample size calculator, because only consenting visitors are in the test.

What might change: the Digital Omnibus

In November 2025 the European Commission proposed the "Digital Omnibus", which would, among other things, rewrite the cookie rule and add exemptions, including for audience measurement. In October 2026 EU governments agreed their negotiating position, which keeps the rule in the ePrivacy Directive and lists cases where consent isn't required, including "for the purpose of audience measurement" (IAPP, 22 Oct 2026). The European Parliament hasn't adopted its position yet, so negotiations haven't started.

Two things to know:

1. Nothing has changed yet. Today's rules apply until a final text is adopted and in force.
2. "Audience measurement" is unlikely to cover session replay. Even France's existing exemption for audience measurement excludes replay. Plan for consent.

Configuration checklist

Use this for every tool that records, maps clicks or runs tests.

Consent

• The tool does nothing before consent: no script, no requests (check the Network tab in your browser's developer tools)
• It's in the statistics/analytics category of your banner, not "necessary"
• "Reject" is as easy as "Accept"
• Withdrawing consent stops tracking at once and removes the tool's cookies
• Session replay is named in the banner (first layer if your recordings are extensive)

Masking and scope

• Form fields masked, keystrokes not recorded
• Numbers and email addresses masked at least; account pages fully masked
• Checkout, payment, account and order pages excluded
• Query strings stripped from recorded URLs
• You watched a test recording with fake personal data and couldn't read it

Data

• Recording retention set to what you need (weeks to a few months)
• You can delete a single recording
• IP addresses not stored (or truncated)
• Sampling considered if you have high traffic
• Only the people who need it have access

Paperwork

• DPA signed with the vendor
• Sub-processor list read and saved
• Privacy policy names the tool, purpose, data, retention and location
• Record of processing activities updated

Questions to ask any vendor

1. Does your script load or send anything before consent? Can I block it fully?
2. Which consent banners do you integrate with, and how?
3. Is masking done in the visitor's browser or on your servers?
4. What is masked by default, out of the box?
5. Do you record keystrokes? Can I turn that off completely?
6. Do you exclude checkout or payment pages by default?
7. Do you store IP addresses? Full, truncated or not at all?
8. Where is data stored, and which sub-processors are outside the EU?
9. Do you use our visitors' data for your own purposes, including AI training?
10. What is the default retention, and can I shorten it?
11. Can I delete one recording on request?
12. Can we sign a DPA, and where's your sub-processor list?

Vendors that answer quickly and in writing tend to be the easier ones to work with later.

How we approached this at Varly

We built Varly, a CRO platform that's currently in private beta, around consent-first defaults: it reads the choice from your existing banner and does nothing until a visitor accepts statistics cookies, masks text and form fields in the visitor's browser, never runs on checkout and cart pages by default, and doesn't store IP addresses (what Varly stores, recording privacy). Visitors who decline see your original pages, not a test variant. That doesn't make any setup automatically compliant; it makes the safe choice the default.

FAQ

Is Hotjar GDPR compliant? No tool is "GDPR compliant" on its own; your setup is. Hotjar (now sold as Contentsquare) stores data in the EU, but you still need consent, masking and a DPA.

Can I use legitimate interest instead of consent for recordings? For the device access itself, the cookie rule requires consent unless an exception applies, and the CNIL treats replay as consent-based. Ask your DPO before relying on legitimate interest.

Do I need consent for heatmaps if I don't record sessions? In practice, yes. The script reads clicks and scroll positions and sends them from the browser, which the EDPB counts as access to the device.

Do I need to mention session recordings in my privacy policy? Yes: what you record, why, how long you keep it, where it's stored and who processes it.

What if my shop is outside the EU? If you target EU visitors, EU rules apply to them. Clarity, for example, decides by the visitor's location.

---

Varly is in private beta. If consent-first heatmaps, recordings, surveys and A/B tests in one tool sound useful, join the waitlist.

Related: Microsoft Clarity consent mode · Privacy defaults of EU-hosted tools · Microsoft Clarity alternatives for EU shops · How to read heatmaps · A/B testing for ecommerce · Microsoft Clarity vs Hotjar