Session replay tools: the CNIL's recommendation requires consent and masking
On 5 November 2026 the CNIL published its recommendation on session replay tools: prior consent, purposes set in advance, masking and short retention.
On 5 November 2026 France's data protection authority, the CNIL, published its final recommendation on session replay tools. These tools record what a visitor does on a website or in an app (mouse movements, taps, clicks, scrolling and sometimes form input) and replay it as a video. The recommendation is aimed at the companies that build these tools and at the publishers that use them. It follows a public consultation held between February and May 2026.
What the CNIL expects
- Consent first. Session replay tools work with trackers, so Article 82 of the French Data Protection Act applies. None of its exemptions fits, so the visitor's prior consent is required, and refusing or withdrawing must be as easy as accepting.
- Purposes set in advance. The purposes must be determined before the tool is deployed, not after the data is collected.
- Clear information. The CNIL recommends specific information about session replay from the first level of the consent banner.
- Masking and minimisation. Mask data that is not relevant, block passwords and bank details, limit the number of sessions recorded and the use of identifiers. Mouse movements should be masked in some areas so authentication codes are not captured, and conversations in chatbots should be maskable.
- Short retention and access control. Retention periods should be set per purpose, with role-based access to recordings.
The roles matter too. A provider that does not reuse the data for its own purposes acts as a processor; one that reuses it, with the publisher's agreement, is a controller for that reuse. The CNIL will support professionals in the coming months, including with a webinar, and says it will carry out checks where people complain.
What to do now
If your website or app uses session replay, check that it only starts after consent, that sensitive fields are masked and that recordings are deleted on time. Record the tool as a processing activity, review the provider as a processor and assess whether a DPIA is needed.
Dazr Compliance keeps the Article 30 record of processing, a DPIA register and vendor reviews with their review dates, so this assessment has an owner and a next check.
Sources
- CNIL: Outils de rejeu de session, la CNIL publie sa recommandation pour guider les acteurs (5 November 2026)
- CNIL: Outils de rejeu de session, Recommandation (PDF)
- CNIL: Rejeu de session, ces outils qui enregistrent votre activité en ligne (5 November 2026)
For information only, not legal advice. Last updated 9 November 2026.
Also available in: Français