How to use session recordings under GDPR: masking, consent, retention
6 min read
Session recordings are considered a privacy minefield — unfairly so. Configured correctly, they can be used in a GDPR-compliant way; configured badly, they are a real risk. The difference comes down to a handful of decisions you have to make cleanly once, and document.
This guide walks through those decisions in practice: legal basis, consent implementation, masking, IP anonymisation, retention periods, DPA and DPIA — based on what German expert sources and the supervisory authorities say (as of July 2026).
This article is for general information and is not legal advice. For binding guidance, consult a lawyer or data protection officer. As of July 2026.
Step 1: Establish the legal basis — consent is the default
Session recordings are assessed on two levels: § 25 of the German TDDDG governs technical access to the end device (cookies, localStorage and the like), while the GDPR (Art. 6) governs the subsequent processing of personal data. You need an answer on both levels.
German expert sources agree: legitimate interest does not carry behavioural recording. eRecht24 and avalex classify recording tools as requiring consent — consent before execution, via a consent banner (as of July 2026). The German Data Protection Conference's guidance goes further still: it does not even classify simple reach measurement as consent-free across the board. That applies all the more to detailed behavioural recording — our editorial assessment, not a DSK quote.
The practical consequence: consent under § 25 (1) TDDDG plus Art. 6 (1)(a) GDPR before anything is recorded. Everything else is thin legal ice.
Step 2: Implement consent properly on the technical level
Between “we have a cookie banner” and valid consent lies engineering. These five points decide:
- Load order: recording starts only after opt-in — not “already loaded, sends later”. Before consent there must be zero events, recordings or fingerprints.
- Active consent: no pre-ticked checkboxes — settled by the CJEU (Planet49) and Germany's Federal Court of Justice.
- A dedicated consent category: do not hide recording and heatmaps under “statistics”. The DSK requires a granular assessment per function, not for the website as a whole.
- Withdrawal as easy as granting: a permanently reachable link, such as “change cookie settings” in the footer.
- Respect “Do Not Track”: a set DNT signal should stop tracking entirely.
Step 3: Masking — client-side, before data leaves the browser
The core principle: masking that only happens on the server is not masking — the data was already in transit. Masking has to happen in the visitor's browser, before sending. A good setup covers five surfaces:
- Sensitive fields, always: password, email, phone, card and IBAN fields must never appear in plain text in any mode.
- PII patterns in captured text: email addresses, credit card numbers (Luhn-checked), phone numbers, IBANs and tokens are replaced client-side before being sent.
- Forms without field values: capture the label, order and timing (focus, dwell time, abandonment) — never the entered value.
- Slim down URLs: query parameters can contain PII. visz.ai keeps only utm_ parameters in page URLs; every other query value is discarded.
- identify() pseudonymised only: never transmit raw PII, only a non-reversible hash computed client-side.
Step 4: IP anonymisation and data location
The IP address is personal data — the industry standard is truncation before storage. visz.ai zeroes the last octet for IPv4 (/24) and truncates IPv6 to /48; the GeoIP lookup runs offline and before truncation, the full address is never persisted, and geo resolution stays at country and region — no city.
Data location decides how many extra construction sites you have: EU-only processing including all subprocessors eliminates the third-country chain entirely — no transfer impact assessment, no dependency on the EU-US Data Privacy Framework, no CLOUD Act exposure. To stay honest: EU hosting does not replace consent. § 25 TDDDG applies regardless of server location — including for visz.ai.
Step 5: Define retention periods — and enforce them automatically
The GDPR demands storage limitation (Art. 5 (1)(e)): keep data only as long as the purpose requires. The honest question is how long you really need raw replays — for UX analysis that is usually weeks, not years.
As an anchor: Microsoft Clarity deletes recordings after 30 days (per datenrein.de, as of July 2026); visz.ai likewise deletes raw replay data automatically after 30 days — data minimisation as system behaviour rather than good intentions. Per-session deletion matters too: recordings must be deletable individually, or you cannot serve erasure requests under Art. 17 GDPR.
Document the period in your privacy policy and your record of processing activities — a retention period that is written down nowhere does not exist for the supervisory authority.
Step 6: DPA, privacy policy, DPIA
Finally, the paperwork — the first thing requested in an audit:
- Sign a DPA: a data processing agreement under Art. 28 GDPR with the vendor is mandatory, not optional.
- Extend your privacy policy: describe purposes, legal basis, recipients, retention, the right to withdraw and the right to lodge a complaint for the recording tool.
- Plan a DPIA: extensive tracking of user behaviour is on the DSK's mandatory list — for session recordings you should carry out and document a data protection impact assessment under Art. 35 GDPR.
- Assign responsibilities: who on the team may watch replays, who answers data subject requests, who maintains the consent texts?
The short checklist
For ticking off — if all eight points are in place, you are in far better shape than average:
- Consent BEFORE the script loads (§ 25 (1) TDDDG + Art. 6 (1)(a) GDPR).
- A dedicated consent category for recording/heatmaps + easy withdrawal in the footer.
- Client-side masking; sensitive fields (password, card, IBAN) masked in every mode.
- Form analytics without field values — only label, order, timing.
- IP truncation before storage; the full IP is never persisted.
- EU-only processing including subprocessors — or third-country transfers properly safeguarded.
- DPA signed + privacy policy section + a documented, short retention period with per-session deletion.
- DPIA carried out and documented (DSK mandatory list).
See it on your own website
Session replay, funnels, heatmaps and frustration signals. GDPR-first, EU-hosted in Germany, and visz.ai is 100% free.
Start for free