Microsoft Clarity is free — but what happens to the data?

Microsoft answers that itself — in the officially recommended privacy wording that Clarity users are asked to adopt into their own privacy policy, according to Microsoft's setup documentation. It states that you partner with “Microsoft Clarity and Microsoft Advertising”, that usage data is captured “using first and third-party cookies”, and that this information is used “for site optimization, fraud/security purposes, and advertising” — explicitly including advertising (learn.microsoft.com, privacy disclosure docs, as of July 2026).

Microsoft's recommended short site notice goes one step further: “We improve our products and advertising by using Microsoft Clarity […] By using our site, you agree that we and Microsoft can collect and use this data.” Visitor data does not only flow to the website owner — by Microsoft's own wording, it also flows to Microsoft itself.

Fairness requires the distinction: by its own account, Microsoft does not sell this data to third parties. The model is a trade — an excellent free tool in exchange for usage data that improves Microsoft's products and advertising ecosystem. That is legitimate. Nobody should just be surprised by it.

According to the FAQ, Clarity recognises returning visitors through a unique identifier stored in a first-party cookie — with a twelve-month lifetime, according to German legal publisher eRecht24. In addition, the FAQ states explicitly: “Any third-party cookies used by Clarity are to support operational purposes like advertising” (as of July 2026).

For use in Europe, that means consent is mandatory — and by now Microsoft says so itself. The FAQ explains that in the EEA, the UK and Switzerland “explicit user consent is required before placing cookies”, and since the consent-signal enforcement change, Microsoft requires webmasters to pass the consent state via the Consent API or a CMP.

Microsoft also openly documents the consequence of missing consent: without it, Clarity cookies cannot be used, “funnel tracking and session recordings might be impacted”, and Clarity can no longer stitch a continuous user journey — one visitor turns into fragmented separate sessions. At its core, Clarity is a cookie-based tool; without cookie consent it loses part of its substance.

On storage location, Microsoft's FAQ only says: “Your data is stored in the Microsoft Azure cloud service.” Microsoft does not name a specific region. What is documented: EU customers contract with Microsoft Ireland Operations Limited, which has standard contractual clauses (SCCs) in place with Microsoft Corporation in the United States, allowing cross-border data transfers — the US transfer is officially part of the construction (as of July 2026). Microsoft is also certified under the EU-US Data Privacy Framework (per eRecht24 and avalex).

The role question is legally remarkable: Microsoft's own FAQ calls Clarity GDPR-compliant “as a data controller” — an independent controller. German legal blogs such as eRecht24 and avalex classify Microsoft as a processor instead and call for a data processing agreement. This ambiguity is itself the finding: a service that, per its own recommended disclosure, uses data for its own purposes such as advertising sits between two stools — a pure processor would not have this problem.

If you use Clarity, clarify these points with your data protection officer — the construction is neither flatly “unproblematic” nor flatly “forbidden”.

Two limits are clearly stated in Microsoft's docs. First, retention: recording playback data is available for 30 days only, click and heatmap data for 9 months — after that, per the retention documentation, it is deleted irrecoverably, backups included (docs updated 2026-06-30). For long-term before-and-after comparisons, that is tight.

Second, deleting individual users: asked how to delete the data of a single visitor — say, for an erasure request under Art. 17 GDPR — the FAQ answers that you need to delete the entire project. There is no granular per-subject deletion tool. Operationally, that is a real disadvantage for GDPR processes.

A sober look demands the other side too — and it is strong. Clarity has points that hardly any other tool offers in such absolute terms:

With Clarity, the business model behind the price tag is written in its own docs: usage data flows to Microsoft, where it is also used for advertising and product improvement. If you can live with that — say, because your audience sits outside the EU or your consent setup is solid — you get an exceptionally powerful free tool.

If, on the other hand, you want behavior analytics without advertising reuse, without a US-transfer construction and with granular deletion, you need a tool whose business model is not built on your visitors' data.

The honest visz.ai angle: visz.ai is free as well — and we use your visitors' data for nothing but your analysis. EU hosting with Hetzner in Germany, no advertising partnership, and the snippet sets no cookies. But the same honesty applies to us: you need consent for session recordings, and we do not have an AI copilot like Clarity's. Both tools are free — they just pay for themselves differently.