Privacy-Safe Session Recording: Masking and Compliance Settings

Session Recording Is Surveillance — Configure It Carefully

Session recording tools capture every mouse movement, click, and keystroke on your website. Used responsibly, they're invaluable for UX research. Used carelessly, they can capture sensitive personal information, create GDPR liability, and violate user trust.

Our CRO team configures session recording tools with privacy as a design principle, not an afterthought. This guide covers the essential configuration for GDPR-compliant deployment.

What Needs to Be Masked

Modern session recording tools (Clarity, Hotjar, FullStory) have automatic masking for obvious sensitive fields, but require configuration to catch everything:

Auto-Masked (By Default)

• Password fields (input type="password")
• Credit card number fields
• Fields with common sensitive names (ccv, security-code, etc.)

Requires Configuration

• Name, email, phone in form fields (masked on Hotjar "Balanced" mode; on Clarity, requires CSS selector configuration)
• Date of birth fields
• National insurance / social security number fields
• Medical or health information
• Financial information (bank account numbers, income fields)
• Any field where users enter free text that might contain personal info

How to Configure Custom Masking

Most tools allow CSS selector-based masking. Add the class .data-hj-suppress (Hotjar) or configure CSS selectors in your tool's masking settings to hide entire sections of pages where sensitive data appears.

For pages with especially sensitive content (patient records, account statements, medical history), consider either masking the entire page content or excluding those pages from recording entirely.

GDPR Consent Requirements

Under GDPR, session recording constitutes processing of behavioral/tracking data. The legal basis depends on how you frame it:

• Legitimate interest: Claimed by many session recording tool providers. Defensible for analytics that don't involve sensitive data and have clear UX improvement purpose. Requires a LIA (Legitimate Interest Assessment) and must not override user rights.
• Consent: Explicit opt-in consent. Required if you cannot rely on legitimate interest, or if user is from a jurisdiction with stricter requirements (France's CNIL, for example, typically requires consent for analytics tools).

Best practice: include session recording as a "Analytics" category in your cookie/consent management platform, and only load the recording script after consent is granted. Load via GTM with a consent-triggered tag firing rule.

Data Retention Configuration

Session recordings should not be retained indefinitely. Configure:

• Hotjar: Settings → Retention. Set to 365 days maximum; 90 days for higher-sensitivity sites.
• Clarity: Retains 30 days by default. Cannot be extended (a feature, from a privacy perspective).
• FullStory: Configurable by plan. Set appropriate to your use case and legal requirements.

Privacy Policy Update

Your privacy policy must disclose session recording. Include:

• Which tool(s) are used
• What data is collected (clicks, mouse movements, page interactions)
• What is explicitly NOT collected (payment details, passwords — due to masking)
• Purpose (improving user experience)
• Data retention period
• How users can opt out (link to tool's opt-out mechanism)

Testing Your Configuration

After configuring masking:

1. Complete a test session filling in all forms on your site
2. Review the recording in your session recording tool
3. Verify all sensitive fields appear as masked (asterisks or blank)
4. Verify no sensitive text appears in move map or scroll captures

Contact our team for help configuring privacy-compliant session recording alongside your consent management setup.