Heat maps, session recordings, and the "legitimate interest" grey area

Session-recording tools (Hotjar, FullStory, LogRocket, Microsoft Clarity, Mouseflow, Smartlook) have a vendor pitch that goes: “Our data collection qualifies as legitimate interest under GDPR Article 6(1)(f). You can deploy without a consent banner.” This pitch is wrong about EU law in three independent ways. The tools themselves are not the problem; the deployment pattern is.

Why legitimate interest fails for recording

First failure: ePrivacy 5(3). The recording-script load involves storage on the user’s terminal equipment. ePrivacy 5(3) requires consent for any non-essential storage. GDPR Article 6 governs what happens to data after collection; it cannot displace 5(3) at the collection step. The EDPB has explicitly rejected the “legitimate interest for cookie storage” argument multiple times.

Second failure: balancing test. Article 6(1)(f) requires that the controller’s legitimate interest is not overridden by the interests or fundamental rights of the data subject. The EDPB’s Guidelines on Article 6(1)(f) state that fine-grained behavioral profiling, which session recording is, generally fails the balancing test for marketing-derived legitimate interests. The user’s reasonable expectations on a transactional or informational website do not include their cursor being filmed.

Third failure: special-category data exposure. Session recordings routinely capture form-input fields. Even with vendor input-masking turned on, the mask is regex-based and routinely misses sensitive inputs (health intake forms, financial application forms, ID upload pages). Article 9 GDPR forbids legitimate interest as a lawful basis for special-category data processing. The risk of inadvertent Article 9 data capture is high enough that legitimate interest is not a defensible deployment posture.

What the regulators have actually said

• CNIL (France): the 2020 guidelines and recommendation on cookies and trackers treat session-recording and heatmap tools as requiring consent. In February 2026 the CNIL went considerably further and opened a public consultation on a draft recommendation dealing specifically with session replay, naming Microsoft Clarity, Hotjar and FullStory. The consultation opened on 25 February 2026 and closed on 22 April 2026. That draft is the most detailed statement any EU regulator has published on these tools, and it is the document to read before deploying one in France.
• Garante (Italy): the 2021 cookie guidelines align with the same position, treating analytics and profiling trackers as consent-gated unless they meet the narrow strictly-necessary test.
• Bavarian DPA (Germany): Repeated guidance treating session-recording cookies as analytics-tier consent obligations.
• ICO (UK): Post-Brexit, ICO has retained the broadly aligned position. Recording tools require consent under PECR.

The convergence is consistent. The EU DPAs have not split on this question. Vendors that claim a different jurisdictional consensus are selling marketing copy, not legal analysis.

What is deliberately not on that list is a table of fines. Earlier versions of this article claimed CNIL sanctions against French sites running Hotjar, Garante action against Italian e-commerce sites running Smartlook and Mouseflow, and a 2023 Datatilsynet position paper. None of the three survived a source check, so all three are gone rather than replaced. The regulators’ position on the lawful basis is consistent and well documented; the published enforcement record aimed specifically at session-recording tools is thinner than blog posts — ours included, until this revision — usually suggest. Plan against the stated position, not against an imagined fine schedule.

What input masking does and does not solve

Every major session-recording vendor offers input masking, a regex-based filter that masks form fields matching patterns like password, email, credit card. Vendors pitch this as the “privacy-respecting” mode. It is not a consent workaround. Masking addresses one risk (literal PII capture inside form fields) and not the others:

• The recording still captures cursor paths, scroll patterns, click sequences, page navigation. This behavioral profile is personal data per recital 30.
• The masking regex is imperfect. Forms with non-standard input names (a health intake form’s “diagnosis” field, an application’s “condition” field) are captured unredacted.
• Client-side masking does close the obvious hole: text the regex catches never leaves the browser, so a vendor breach cannot expose it. What a breach or a subpoena does reach is everything the mask did not catch, which is most of the recording, the DOM of every page the visitor saw, the cursor and scroll trace, the click sequence, and every URL visited, including anything your own application put in a query string.
• The recording is associated with a session identifier the vendor can correlate across sessions if the same identifier persists in localStorage.

The deployment pattern that actually works

Session recording is not banned in the EU. It is consent-gated. The compliant deployment pattern:

1. Load the recording script post-consent only. Atype="text/plain" attribute on the script tag at first render, flipped to text/javascript after the user clicks accept on the analytics category. Every major CMP supports this.
2. Enable input masking even with consent. Defense-in-depth. Consent does not entitle the controller to special-category data.
3. Document the legal basis as Article 6(1)(a) consent. Not legitimate interest. Vendor templates and policy generators often default to legitimate interest; override.
4. Add the recording tool to the cookie policy and subprocessors page. The vendor is processing personal data on the controller’s behalf. Article 13/14 transparency requires disclosure.
5. Honor reject and delete requests. Recordings created under consent are deletable on Article 17 request. The vendor must support this and you must wire your support process to forward the requests.

Veracly’s flag

Veracly’s tracker registry is a hand-curated list of 69 vendors. Five of them carry the session-replay category: FullStory, LogRocket, Mouseflow, Crazy Egg and SessionStack. Hotjar and Microsoft Clarity are in the registry too, categorised as analytics rather than session-replay, both rated high privacy risk, both carrying a note that their recordings and heatmaps are personal data requiring explicit consent. If a vendor is not among those 69 entries, Veracly does not see it: the list is curated by hand between releases, not pulled from a live feed.

When one of those endpoints is requested before consent, the scan raises a pre-consent tracker finding with the request URL and a DevTools recipe you can re-run yourself. Three limits are worth stating. Veracly loads the page and watches it; it does not scroll, hover or click, so a recorder that only starts on interaction is never exercised. It never clicks the banner — a click is itself a consent gesture and would pollute the pre-consent reading — so there is no post-consent pass and nothing in the report tells you whether a consent choice is honoured after it is made. And a self-hosted or first-party-proxied recorder served from your own domain is invisible to the scan entirely. The jurisdictional note attached to each vendor is a short static string we wrote, not a live index of enforcement decisions.

See also: Tracking pixel audit · Cookies, localStorage, IndexedDB consent