TL;DR, Quick Answer
7 min readA session replay shows one visit end to end, and a heatmap merges many visits into one colored overlay on a page screenshot. The less obvious difference is plumbing. Hotjar says its heatmaps "rely on Recordings data", so deleting a recording deletes its heatmap data. Datadog draws heatmaps "overlaid on Session Replay data" and requires Session Replay to be on. PostHog captures heatmap data as separate events behind the enable_heatmaps setting. Microsoft Clarity keeps recordings for 30 days but heatmaps for up to 9 months, and FullStory shows heatmaps only for sessions still inside its replay retention window.
What is the difference between session replay and heatmaps?
The practical difference in session replay vs heatmaps is scope, since a replay shows one visitor's visit from start to finish while a heatmap merges thousands of visits into one colored overlay on a single page screenshot. A replay answers "what happened to this person?". A heatmap answers "where does everyone click, scroll and stop?".
Both definitions have their own pages. How session replay works covers DOM snapshots, masking and storage, and the guide to every website heatmap type covers click, scroll, move, confetti and attention maps. This page covers the part neither one does. In most tools the two features share a script, a data pipeline and often a retention clock, and that decides what you can still see months later.
| Session replay | Heatmap | |
|---|---|---|
| Unit | One session | Many sessions on one URL |
| Output | Playback of the rebuilt page | Colors over a screenshot |
| Keeps the individual path | Yes | No |
| Shows cause | Often, by watching what preceded a failure | No, only where interaction concentrates |
| Typical question | Why did this checkout fail? | Does anyone reach the pricing table? |
| Personal data risk | Everything the recorder captured and did not mask | The screenshot plus coordinates |
Are heatmaps built from session replay data?
It depends on the vendor. Some build heatmaps from the same recordings you watch, and some capture a separate event stream. The documentation of five tools, read on 25 September 2026, splits three ways.
| Vendor | Heatmap data source, in the vendor's words | Consequence |
|---|---|---|
| Hotjar | "Heatmaps rely on Recordings data in order to generate heatmaps on demand" | No recordings on a URL means no heatmap for it |
| Datadog | "a visualization of your user's interactions overlaid on Session Replay data" | Session Replay must be enabled first |
| FullStory | Heatmaps "accessible for sessions within your plan's Session replay retention" | Heatmaps shrink as replays expire |
| PostHog | Captured with enable_heatmaps, "along with other events" | Works without recording sessions |
| Microsoft Clarity | Created "based on element attributes and not the content of the element" | Heatmaps last up to 9 months, recordings 30 days |
Hotjar is the plainest case. Its Heatmap FAQs say "Heatmaps are based on sessions, which means you need to have captured Recordings on pages that you want to view a Heatmap", and the troubleshooting advice for an empty heatmap is to "check to see if you have any Recordings for the URL."
Datadog lists prerequisites. Enable Session Replay, run Browser SDK v4.40.0 or later for click maps and v4.50.0 or later for scroll maps, and set trackUserInteractions: true in the SDK initialization. Its docs add that "Heatmaps are only supported for Browser Session Replay", so mobile app replays produce none.
PostHog separates the two. You switch heatmaps on with enable_heatmaps in the JavaScript SDK config or in project settings, and PostHog says the data "is captured along with other events, so it doesn't contribute to your bill." The clickmap depends on autocapture and the scrollmap on pageleave events. A PostHog project can run heatmaps on every visit and record only a sample of sessions, or none.
What happens to a heatmap when recordings are deleted or expire?
A heatmap built from recordings loses data when those recordings go, and one built from separate aggregates does not. This is where the plumbing reaches the dashboard.
Hotjar: "If you delete a Recording, then any associated Heatmap data will be deleted." Because a recording can span several pages, deleting one visit removes it from the heatmap of every page that visit touched. Hotjar's data retention article also gives heatmaps and recordings identical retention periods.
FullStory ties the view to the replay window but keeps the numbers. Page Insights and Heatmaps Explore "will be accessible for sessions within your plan's Session replay retention. However, underlying analytics data will remain for the length of your Product analytics retention."
Microsoft Clarity runs the other way. Its FAQ gives recordings 30 days ("Clarity retains recordings for 30 days from the time of recording") and heatmaps longer ("You can access heat maps for up to 9 months"). A Clarity heatmap from five months ago still shows where people clicked, but the sessions behind those clicks are gone, apart from favorites and the random sample Clarity keeps. The retention windows for session replay differ enough across vendors that it pays to check both clocks before you plan a before-and-after comparison.
Where does the heatmap's background screenshot come from?
In the replay-based tools, the screenshot under the colors is usually taken from a recording. Hotjar: "Screenshots are taken from the last recording found in the date range you've selected for your heatmap." If there is no cached screenshot for a custom date range, Hotjar "will generate one from the latest date that has an available Recording."
Datadog offers three sources: an existing screenshot, "Take new screenshot" from the live application, and "Grab from replay", which picks a frame from a recorded session. Screenshots from the last two options "are automatically saved and become the default view for anyone in your organization who opens the heatmap." PostHog captures heatmap screenshots with Browserless, from its own IP addresses, and also offers a "View heatmap" button above a recording.
That source matters for accuracy. A screenshot taken from one visitor's recording shows that visitor's variant, login state and banner. Clicks from everyone else get painted onto that one layout. PostHog's recording-mode clickmap addresses this by attaching counts to "actual DOM elements in the snapshot" instead of x and y positions, which it says "can drift onto non-clickable areas."
Flowsery
Start Your 14-Day Free Trial
Real-time dashboard
Goal tracking
Cookie-free tracking
Do heatmaps and session replay carry the same privacy risk?
No. A heatmap stores less about any one person, but the screenshot under it can still show personal data, and the controls differ. Microsoft Clarity says it builds heatmaps from element attributes rather than element content, and it also says it "doesn't support excluding or suppressing specific elements on your webpage while generating a heat map." Datadog lets you pick "a masking level to prevent sensitive data from appearing in your heatmap screenshot", and element-level privacy settings in code "still take precedence."
In the tools that build heatmaps from recordings, the heatmap inherits every privacy decision you made for replay, because it comes from the same captured sessions. Masking rules set for the recorder protect both at once. In PostHog, heatmap events follow your event capture settings, not your recording settings, so check them separately.
Which one should you open first?
Open the heatmap to find where a page underperforms, then open replays filtered to that page and element to learn why. The heatmap narrows a page of thousands of sessions to one region. The replays in that region show the cause, such as a button hidden behind a sticky header or a form that rejects valid input without saying so.
Two Hotjar details show why the heatmap alone misleads. "Showing x sessions" counts "all tracked sessions where the user visited the Heatmap target page, even if that user did not interact", so a map labelled 1,000 sessions may hold clicks from far fewer. And on mobile, Hotjar heatmaps "are only able to record a tap or scroll action", so horizontal carousel swipes never appear.
Replays have the opposite weakness. Nobody can watch all of them. Flowsery's AI session replay reviews each recording and turns what is breaking into ranked, reproducible issues, dropping you at the exact moment in the recording. Repeated clicks on one element are the signal that ties the two views together, and frustration signals explains how rage clicks and dead clicks get detected.
Frequently asked questions
Can I have heatmaps without recording sessions?
In some tools. PostHog captures heatmap data separately through enable_heatmaps. Hotjar builds heatmaps from recordings, and Datadog requires Session Replay to be enabled, so both need recordings first.
Why is my Hotjar heatmap empty?
Hotjar builds heatmaps from recordings, so a URL with no captured recordings has no heatmap data. Hotjar also suggests checking the exact URL match, including trailing slash and protocol, and the tablet and mobile tabs.
Does deleting a recording change my heatmap?
In Hotjar it does. Deleting a recording deletes its heatmap data for every page that session visited. In Microsoft Clarity, heatmaps outlast recordings, 9 months against 30 days.
Which Datadog SDK version do heatmaps need?
Click maps need Browser SDK v4.40.0 or later and scroll maps need v4.50.0 or later. Session Replay must be enabled, and click maps need trackUserInteractions: true.
Is a heatmap enough to diagnose a conversion drop?
No. A heatmap shows where interaction concentrates or stops, not why. Filter replays to the element or scroll depth the heatmap flagged and watch those sessions to find the cause.
Do heatmaps work on mobile?
On mobile web, yes, with limits. Hotjar records taps and vertical scrolls but not horizontal swipes, and Clarity generates heatmaps for PC, tablet and mobile by default. Datadog supports heatmaps only for Browser Session Replay, not mobile app replays.
How long does Microsoft Clarity keep heatmaps?
Clarity keeps heatmaps for up to 9 months and recordings for 30 days. An old heatmap still shows where people clicked, but the sessions behind those clicks are gone, apart from favorites and the random sample Clarity keeps. Check both clocks before you plan a before-and-after comparison.
Where does the background image of a Hotjar heatmap come from?
Hotjar takes it from the last recording found in the date range you selected. If there is no cached screenshot for a custom date range, Hotjar generates one from the latest date that has an available Recording. The layout you see is therefore one visitor's version of the page.
Are heatmaps safer for privacy than session replay?
A heatmap stores less about any one person, but the screenshot under it can still show personal data. Datadog lets you pick a masking level for heatmap screenshots, while Microsoft Clarity says it doesn't support excluding specific elements when it generates a heat map. In tools that build heatmaps from recordings, your replay masking rules protect both.
Should I check the heatmap or the replays first?
Start with the heatmap to find where a page underperforms. Then open replays filtered to that page and element to see why. The heatmap narrows thousands of sessions to one region, and the replays in that region show the cause.
Flowsery
Start Your 14-Day Free Trial
Real-time dashboard
Goal tracking
Cookie-free tracking
Was This Article Helpful?
Let us know what you think!
See us more often in Google
One click marks Flowsery as a preferred source, so our articles sit higher in your Top Stories, AI Mode, and AI Overviews.
Before you go...
Flowsery
Revenue-first analytics for your website
Track every visitor, source, and conversion in real time. Simple, powerful, and cookie-free.
Real-time dashboard
Goal tracking
Cookie-free tracking
Related Glossary Terms
Every Website Heatmap Type, and What Each One Measures
The phrase website heatmap covers five overlays: click, scroll, move, confetti and attention. Here is what each one measures and where each one misleads.
What a Scroll Map Shows About Where Readers Stop
Each band of a scroll map is colored by the share of visitors who reached it. Learn the fold line, the drop-off column, and where page height misleads.
The Four Frustration Signals and What Each One Means
The four frustration signals are rage clicks, dead clicks, error clicks and thrashed cursors. Each one fires on a threshold your tool sets, not on a guess.
What Seven Vendors Publish on Session Replay Data Retention
Session replay data retention compared from vendor docs: FullStory, Hotjar, Clarity, LogRocket, PostHog, Sentry and Datadog, plus what GDPR requires.
What rrweb Records, and How Its Privacy Options Work
How rrweb records a session as a DOM snapshot plus mutations, not video: its npm packages, MIT licence, and privacy options like maskAllInputs and blockClass.
How a Session Replay Sampling Rate Works in Sentry, PostHog and Others
A session replay sampling rate sets what share of visits get recorded. See how Sentry, PostHog, LogRocket, Datadog and Clarity document it.
Related Articles
What Session Replay GDPR Compliance Actually Requires of You
A session replay GDPR review turns on four things: an Article 6 lawful basis, Article 9 special category data, ePrivacy Article 5(3) consent, and a DPIA.
Where Rage Clicks vs Dead Clicks Actually Differ
The rage clicks vs dead clicks split is about cause, not severity. Detection thresholds published by PostHog, Hotjar, FullStory, LogRocket and Clarity.
Where PII Redaction Session Replay Defaults Leave Data Exposed
PII redaction session replay defaults vary wildly: rrweb masks only passwords, Sentry masks all text, Clarity masks numbers and emails.