What Session Replay GDPR Compliance Actually Requires of You

Is session replay GDPR compliant?

The honest answer to a session replay GDPR question is that the tool is neither compliant nor non-compliant on its own, because compliance is a property of a specific deployment and four separate tests decide it. A replay script does not film a screen. It serialises the DOM in the visitor's browser, streams mutations, and reconstructs the session later, which means it touches the device, produces data about an identifiable person in most configurations, and can sweep up categories the GDPR treats as prohibited by default.

The four tests, in the order they apply:

1. Article 5(3) of the ePrivacy Directive, on storing or accessing information on the visitor's device.
2. Article 6 of the GDPR, on a lawful basis for the processing that follows.
3. Article 9 of the GDPR, on special categories of personal data.
4. Article 35 of the GDPR, on whether a data protection impact assessment is mandatory.

Which law applies first, the GDPR or ePrivacy?

ePrivacy applies first, because it governs reaching into the device rather than the processing that follows. The consolidated text of Article 5(3) of Directive 2002/58/EC, as amended in 2009, reads:

"Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service."

Two words in that text do the work. It says "information", not personal data. And it covers "gaining of access to information already stored", not just writing a cookie.

The EDPB closed the usual escape routes in Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0, adopted on 16 October 2024. Paragraph 10 quotes the Court of Justice in Planet49 (Case C-673/17, paragraph 70): "That protection applies to any information stored in such terminal equipment, regardless of whether or not it is personal data". Paragraph 12 concludes that the notion "includes both non-personal data and personal data, regardless of how this data was stored and by whom".

Paragraph 33 names the exact mechanism a replay recorder uses: "Additional examples would include JavaScript code, where the accessing entity instructs the browser of the user to send asynchronous requests with the targeted information. Such access clearly falls within the scope of Article 5(3) ePD."

Paragraph 53, in a section titled Local processing, kills the argument that a recorder is safe because it builds its payload in the browser: "If at any point and for example in the client-side code, the processed information is made available to a third-party, for example sent back over the network to a server, such an operation ... would constitute a 'gaining of access to information already stored'. The fact that this information is being produced locally does not preclude the application of Article 5(3) ePD."

Paragraph 56 adds the nuance that matters: applicability is not the same as a consent requirement, and "in each case it would have to be assessed if a consent is needed or whether an exemption under Article 5(3) ePD could apply". The two available exemptions are transmission and strict necessity, and a recorder kept so a product team can watch sessions later is not strictly necessary to deliver the page the visitor asked for.

What lawful basis can you use for session replay?

Article 6(1) of the GDPR says processing "shall be lawful only if and to the extent that at least one of the following applies", and the two candidates for replay are:

"(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes"

"(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."

The ePrivacy answer constrains the GDPR answer. If Article 5(3) requires consent to run the script at all, resting the later processing on legitimate interests does not rescue you, because the collection was unlawful before the balancing test started. Consent also has a defined shape: Article 4(11) requires "any freely given, specific, informed and unambiguous indication of the data subject's wishes ... by a statement or by a clear affirmative action", and Article 7(3) adds that "It shall be as easy to withdraw as to give consent", which for replay means a live kill switch in the script rather than an email address in a policy. The same logic is worked through for measurement tools in GDPR consent requirements for web analytics.

When does a recording capture special category data?

Whenever a visitor types it into a field you did not mask. Article 9(1) is a prohibition, not a risk factor:

"Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited."

Article 9(2)(a) lifts the prohibition only on "explicit consent", a higher bar than the Article 6(1)(a) consent that covers ordinary data. A symptom checker, an insurance quote form or a union membership renewal produces Article 9 data the moment the keystroke is serialised, and masking by default is the only configuration that keeps it out of your storage. That default varies enormously between libraries, which is the subject of PII redaction in session replay. Whether an IP address alone makes a recording personal data is a separate question, covered in is an IP address personal data.

Does session replay trigger a DPIA?

Often, and the test is in Article 35(1): a DPIA is required "Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons".

Article 35(3) then lists three cases where one "shall in particular be required":

Recording every visitor by default on a site that handles Article 9 inputs lands on (b) without much argument. Recording a masked sample for bug reproduction may not reach the Article 35(1) threshold at all, but that conclusion is one you document rather than assume.

What have supervisory authorities actually said?

Less than you would expect, and the clearest statement is not from an EU authority.

The UK ICO's guidance on the use of storage and access technologies, published 20 December 2024 and finalised on 29 April 2026, states that "Regulation 6 of PECR applies whenever the use of scripts and tags accesses or stores information on a user's device". It then rules replay out of the analytics carve-out that the Data (Use and Access) Act added to UK law: "The statistical purposes exception does not allow you to monitor or track individual visitors to your service. You must obtain consent for: logs or recordings of individual visitors to your website and the actions they took (if not obtained for the purposes of security)". That is a regulator naming the practice and putting it on the consent side of the line, with a narrow security exception attached.

The caveat is jurisdictional. That statistical purposes exception exists in UK PECR and has no counterpart in the EU ePrivacy Directive, so the UK is more permissive about ordinary analytics while still requiring consent for recordings.

In the EU, the CNIL publishes conditions under which audience measurement escapes consent, and they are drawn tightly enough to exclude replay by construction. The trackers must be "utilisés pour une finalité strictement limitée à la seule mesure de l'audience du site ou de l'application", must "servir à produire des données statistiques anonymes uniquement", and must not "permettre le suivi global de la navigation de la personne utilisant différentes applications ou naviguant sur différents sites web". The CNIL adds a thirteen month cap on the tracker lifetime and a twenty five month cap on the resulting data. A per-visitor recording is not anonymous statistics, so it fails the second condition before the retention caps matter.

What is missing is an enforcement decision. Searching the CNIL's own site for the phrase "session replay" returned zero results on 13 September 2026, and no EDPB guideline or EU authority decision naming the practice surfaced in this research. The enforcement record that does exist sits in United States courts under wiretapping statutes, a separate body of law covered in session replay wiretapping lawsuits. Treat the absence of an EU decision as untested precedent, not permission.

Frequently asked questions

Does session replay always need consent in the EU?

Almost always, because Article 5(3) of the ePrivacy Directive catches the script before the GDPR asks anything. The only exits are the transmission exemption and the strict necessity exemption, and a recorder kept for later analysis is not strictly necessary to provide the service the visitor requested.

Does masking every input remove the need for consent?

No. Article 5(3) covers "information", not personal data, and the EDPB confirmed in paragraph 12 of Guidelines 2/2023 that the notion "includes both non-personal data and personal data". Masking reduces your Article 9 exposure and your breach blast radius. It does not take the script outside ePrivacy.

Can I rely on legitimate interests for session replay?

Only for processing that follows a lawful collection. Article 6(1)(f) is a balancing test between your interests and the visitor's "interests or fundamental rights and freedoms", and it cannot cure a device access that Article 5(3) required consent for in the first place.

Do I need a DPIA before turning on session replay?

If you record at scale on pages where visitors enter Article 9 data, Article 35(3)(b) makes it mandatory. Outside that case, run the Article 35(1) test on nature, scope, context and purposes, and write down the conclusion either way so you can show the reasoning later.

Has any EU regulator fined a company over session replay?

No such decision surfaced in this research, and the CNIL's own site search returns nothing for the phrase. The closest regulator statement is the UK ICO's, which requires consent for "logs or recordings of individual visitors to your website and the actions they took".

Does client-side processing keep a recorder outside ePrivacy?

No. Paragraph 53 of EDPB Guidelines 2/2023 addresses exactly that argument and answers that "The fact that this information is being produced locally does not preclude the application of Article 5(3) ePD" once the result is sent back over the network.

Can the strict necessity exemption cover session replay?

No. The exemption is meant for access that is required to deliver the service the visitor asked for, and a recorder kept so a product team can review sessions later does not meet that bar. The UK ICO carves out one narrow exception for logs kept purely for security purposes, but a general product analytics recording falls outside it.

Does the CNIL's audience measurement exemption cover session replay?

No. That exemption requires trackers used strictly for anonymous statistical measurement, and a per-visitor recording fails that condition before the retention caps even apply. CNIL's own conditions rule out anything that lets you follow an identified visitor, which is exactly what replay does.

Is session replay regulated the same way in the US as in the EU?

Not by the same instrument. EU and UK rules run through ePrivacy, PECR and the GDPR, while the US enforcement record so far sits in court rulings under state wiretapping statutes rather than a data protection regulator. Treat the two as separate bodies of law with separate exposure, not one compliance program that covers both.

What is the difference between explicit consent and ordinary consent for session replay?

Ordinary consent under Article 6(1)(a) is the "freely given, specific, informed and unambiguous indication" required for most personal data. Explicit consent under Article 9(2)(a) is the higher bar needed once a recording captures special category data, such as health information typed into an unmasked field, and it is the only route that lifts the Article 9(1) prohibition.