Is session replay GDPR-compliant? A practical checklist
Replay can be run legally in Europe — with consent before the script loads, masking on by default, and a retention period you can defend. What the rules actually require, and the checklist that covers you.
Two laws apply to session replay
Site owners asking "is session replay GDPR-compliant?" are usually asking about the wrong law first. Two European regimes apply at once. GDPR governs what you do with personal data — and recordings of individual visitors' clicks, scrolls and form interactions are personal data, since session identifiers and IP addresses make visitors indirectly identifiable. The older ePrivacy Directive governs something narrower and blunter: storing or reading anything on the visitor's device requires prior consent, full stop. The EDPB confirmed in its 2023 guidelines that this applies to modern tracking scripts as much as to the cookies the law was written for.
That second law is the one that decides most compliance questions. Whatever lawful basis you claim under GDPR, a replay script that starts recording before the visitor consents is already offside under ePrivacy. If the US lawsuits are a 1967 phone-tapping law applied to your website, the European version is simpler: no consent, no script.
Why consent is the only safe basis
GDPR offers six lawful bases for processing, and vendors have historically argued that "legitimate interest" — improving the product, debugging — could cover replay without asking anyone. That argument has aged badly. The EDPB's recent legitimate-interest guidelines and the French regulator's enforcement record both point the same way: for behavioral tracking of this kind, consent is the basis that survives scrutiny, and it has to be real consent — a freely given opt-in, separate from the ad and analytics toggles, obtained before the recording starts.
"Before" is not a technicality. France's CNIL fined Shein €150 million in September 2025 for exactly this pattern — tracking scripts firing before the consent banner had been answered, and continuing after visitors said no. The fine was about cookies generally, but replay scripts sit in the same category and load the same way. The compliant sequence is mechanical: consent tool first, visitor chooses, and the replay script loads only on a yes. A consent banner sitting on top of a page that's already recording is decoration.
What must never end up in a recording
GDPR's data-minimization principle does real work here: you may only collect what the purpose needs, and watching where visitors struggle doesn't need what they typed. In practice that means text inputs masked by default, passwords and payment fields never captured, keystrokes off, and account or checkout areas excluded from recording entirely. This isn't a nice-to-have — CNIL's draft recommendation on session replay, out for public consultation in early 2026, names default masking of text fields explicitly, and it's the clearest signal yet of where European enforcement is heading. Vendor defaults vary widely on exactly this point, which is why "the tool is GDPR-compliant" is never a finished sentence: the same tool can be compliant or not depending on how it's configured.
Where the recordings live matters too. EU hosting keeps you out of the data-transfer paperwork; a vendor storing recordings in the US needs standard contractual clauses and a signed data-processing agreement doing the legwork instead. And recordings can't be kept forever — GDPR requires a retention period you can justify, and 30 to 90 days covers the debugging-and-UX purpose most sites actually have. If nobody has watched a recording in three months, its compliance risk has outlived its usefulness.
For larger deployments there's one more piece of homework: a data-protection impact assessment. Systematic, large-scale monitoring of behavior is on the list of processing that can require one, and writing it forces the useful questions — what are we recording, why, for how long, and what would we say if a regulator asked.
The checklist
Tools differ in how much of this is work. Bigdelta's replays, for example, mask text inputs, passwords and payment fields automatically, store recordings on EU servers, and let you exclude pages, users or your own team from recording — which covers the technical half of the list out of the box, leaving you the consent gate and the paperwork.
What a defensible session replay setup looks like:
- Replay loads only after an explicit opt-in, through your consent tool — never before, and never after a "no".
- Replay gets its own consent toggle, not a ride-along with analytics.
- Text inputs masked by default; passwords and payment fields never captured; keystroke capture off.
- Login, account and checkout pages excluded from recording.
- A signed data-processing agreement with the vendor; EU hosting if you can get it.
- A written retention period, 30–90 days, with automatic deletion.
- Replay named in your privacy policy, with its purpose in plain words.
- For large-scale use: a documented impact assessment.
- A calendar note to re-check when CNIL's final recommendation lands — the consultation closed in April 2026, and the final text will likely set the enforcement bar EU-wide.
So — is it compliant?
Session replay is legal to run in Europe the same way it's legal to run in California: when it's deployed properly. The pattern that gets sites in trouble is identical on both continents — recording first and asking permission second, capturing what visitors type, keeping everything forever. Get the consent gate in front of the script, mask by default, put a number on retention, and what replay is actually for — watching where real visitors struggle — carries on untroubled. This post is a site-owner's map, not legal advice; if recordings touch health data, minors or anything else sensitive, that's the moment to pay a lawyer for an hour.
