CNIL session replay checklist: consent, masking and retention, purpose by purpose

Session replay records what a visitor actually did on your page: mouse moves, clicks, scrolling, typing. On 8 October 2026 the CNIL, the French data protection authority, adopted deliberation 2026-114, its recommendation on session replay tools, published on 5 November 2026. It applies to every site or app that replays sessions of visitors in the EU. This page turns that recommendation into a checklist you can hand to whoever installs or reviews such a tool: your agency, your DPO or yourself.

This is a factual reading of the CNIL text, not legal advice. The CNIL states, and we repeat, that session replay is not exempt from consent rules. Whether and how your site records sessions is your decision to make with your own legal advisor. Nothing here promises compliance, for us or for you.

Last updated: 13 Νοεμβρίου 2026

What the CNIL recommendation asks

These are the requirements that matter for anyone installing or checking session replay, read from the recommendation itself:

  • Prior consent, with no exemption. Session replay reads and writes information on the visitor's device, so it is a tracker under article 82 of the French data protection law (and ePrivacy). The CNIL says no exemption applies, so the visitor must consent before the replay starts.
  • Purposes decided before deployment. You choose the purposes first, in writing, and the tool must not be used for anything else. The recommendation names three acceptable purposes: detecting and fixing technical errors, improving user experience, and customer support.
  • Consent collected through an updated consent platform (CMP). Your existing cookie tool works, but its first layer must name session replay separately and its purpose descriptions must reflect what the replay really does.
  • Effective withdrawal. Stopping must actually stop capture, and recordings already taken must be deleted when no other legal basis keeps them.
  • Most protective defaults. Article 25 of the GDPR: the safest configuration must be the one that ships by default, not the one you opt into.
  • Measures that match the purpose. The recommendation's annex gives a matrix per purpose (sampling, masking, identifiers, retention), split into technical errors, UX and support. Use the matrix for the purposes you chose; the rest of this page follows it.

CMP wording: what to ask your consent platform for

The CNIL expects each purpose to appear on the first CMP layer as a short title, with a fuller description on the second layer, and a separate first-layer mention that session replay is used. The recommendation gives its own example wording, quoted below (French), with a plain English rendering. The quoted text is the CNIL's own example; it is not legal advice and we are not recommending one specific sentence over another.

First layer: one short title per purpose, plus a separate session replay mention

The CNIL asks that each purpose be shown as a short title on the first level and described in more detail on the second level, and that session replay get its own short, explicit mention, presented separately from the purposes, because most visitors do not know these tools exist. The recommendation's own example purpose titles are "Détection et compréhension des erreurs ou problèmes techniques", "Amélioration de l'expérience utilisateur (« UX »)" and "Support et assistance pour gérer les demandes clients".

Purpose 1: detecting and understanding technical errors

CNIL example, French: « [Nom de l'éditeur] enregistre et visualise vos actions pendant votre navigation pour résoudre d'éventuels problèmes techniques. »

English rendering: "[Publisher] records and reviews your actions while you browse, so that possible technical problems can be fixed."

Purpose 2: improving user experience (UX)

CNIL example, French: « [Nom de l'éditeur] enregistre et visualise vos actions pendant votre navigation pour identifier les difficultés rencontrées et améliorer la navigation et l'ergonomie du site [ou de l'application]. »

English rendering: "[Publisher] records and reviews your actions while you browse, to identify difficulties and improve how easy the site [or app] is to navigate and use."

Purpose 3: customer support

CNIL example, French: « [Nom de l'éditeur] enregistre vos parcours de navigation et visualise la ou les session(s) de certains utilisateurs afin d'identifier les problèmes et répondre aux demandes adressées aux équipes de [Nom de l'éditeur]. »

English rendering: "[Publisher] records your browsing paths and reviews the session(s) of certain users, so that problems can be identified and requests sent to [Publisher]'s teams can be answered."

The separate first-layer session replay mention

Separate from the purpose list, the first layer should carry a short, explicit sentence that session replay is in use. The CNIL does not prescribe one sentence. A plain example, in the same spirit as its wording, would be: "We record a sample of browsing sessions to understand errors and improve the site. You can refuse or withdraw at any time." Label your own sentence as your publisher wording, not CNIL wording. For Hitsteps sites, remember that consent selects what a replay reveals, not whether it runs: a refusal or withdrawal switches the visit to masked recording, and recording stops only through the visitor opt-out page, Do Not Track, or excluded pages and IP addresses.

Withdrawal must be as easy as acceptance, and capture must really stop when the visitor withdraws. Ask your CMP provider to wire refusal and withdrawal to the recording tool, and to be able to prove consent was collected.

Masking checklist: what the replay does not need to see

The CNIL lists the categories that should be masked by default (measure M0 in its annex): images, forms, text fields, dynamically filled fields such as account information, mouse movements and clicks on numeric keypads, and chatbot conversations. Masking should apply by default (measure M0) before any configuration. Go through this list for your site:

  • Images, forms and text fields on the page, masked by default.
  • Fields that are filled in dynamically, for example account data that appears when a visitor signs in.
  • Clicks and mouse movement on numeric keypads, so a PIN or card code cannot be read back from the replay.
  • Chatbot conversations and any third-party iframe content where the visitor could type or where personal data appears.
  • Passwords and payment details, always excluded, with any other sensitive data your site collects.

Where Hitsteps stands on masking

  • Masking happens in the visitor's browser before anything is stored. The default level, Protected, masks page text in the visitor's browser; visible text exceptions can reveal selected text, and Flexible and Uncover reveal more.
  • Passwords and payment details always stay masked, whichever masking level a site chooses.
  • You can also mask or block specific page elements and exclude pages and IP addresses, in that site's Experience settings. Per-zone pointer masking is not available today, so exclude pages with numeric keypads or PIN entry from recording. For chat widgets, check a test recording, then block the widget or exclude the page if chat content shows.

Retention checklist: how long the replay may be kept

The CNIL ties the retention period to the purpose: a few months for technical errors and UX, and only a few hours after the session ends for customer support. Anyone reviewing the tool should check the configured period against the chosen purpose:

  • Technical errors and UX: keep sessions for a few months at most, to fix problems with the current version of the site, and delete them when they are no longer needed.
  • Customer support: sessions may be kept only a few hours after the session, because they exist to answer a specific request. Hour-level retention means the tool cannot be used for support if its shortest setting is longer than that.
  • Deleted on request and on withdrawal: the tool must allow a single session to be removed, and recordings must be deleted when consent is withdrawn and no other legal basis keeps them.

Where Hitsteps stands on retention

Hitsteps Experience removes recordings automatically after the retention period chosen in that site's Experience settings, which is 30 days by default and can be set to as little as 1 day. Because the CNIL expects hours for customer support and the shortest Hitsteps retention is 1 day, Hitsteps recordings are not suited to the support purpose today. Use them for the technical errors and UX purposes, where the CNIL asks for a few months.

Where Hitsteps stands: consent controls what a replay reveals

We would rather be straight with you than win a checklist. Here is what Hitsteps Experience does today, against the recommendation:

  • Recording stays off until someone with permission enables it for that website, and only visits after that point can be replayed. Nothing is recorded before that.
  • Recording runs once someone with permission has switched it on for that site and the visit is part of the daily sample. Consent controls what a recording reveals: until a visitor says Yes in the built-in consent popup, or after they decline, the visit is recorded with identifying information masked. Experience respects Do Not Track by default, and the site can exclude pages and IP addresses in its Experience settings.
  • Hitsteps records a daily sample of visits, not every visit, and recordings are removed automatically after the retention period chosen (30 days by default). The shortest retention is 1 day, which is why we say recordings are not suited to the CNIL's customer-support purpose.
  • Masking happens in the visitor's browser before anything is stored. The default level, Protected, masks page text in the visitor's browser; visible text exceptions can reveal selected text, and Flexible and Uncover reveal more. Passwords and payment fields stay masked. The publisher still owns the checklist: per-zone pointer masking is not available today, so exclude pages with numeric keypads or PIN entry from recording, and check a test recording for chat widgets.
  • Withdrawal switches that visit to masked recording immediately: capture continues, but identifying information is masked and pending identifying details are not stored. Recordings already stored are not deleted automatically; they are removed at the end of the retention period, and someone with manage rights can delete a single recording.
  • One popup Yes covers all enabled recording uses. There is no choice per purpose.
  • Recordings are linked to the analytics visitor. There is no session-only identifier option.
  • A site that relies on its own consent platform cannot connect it yet, because the HitstepsExperienceConsent hook has no public documentation. Recording runs in every privacy mode; when consent is not given, identifying information is masked in the browser before anything is stored.

We do not claim CNIL compliance, an exemption, or that a site can skip a consent banner. The CNIL asks for consent before a replay starts and says masking does not replace it, and we repeat that rule. Here is the honest gap: Hitsteps today records eligible visits whether or not the visitor has accepted, with identifying information masked in the browser, and a site cannot be set to record only after consent. Recording stops only through the visitor opt-out page, Do Not Track, or excluded pages and IP addresses. If you use Hitsteps for visitors in the EU, setting up consent, wording and masking remains your call, and we are happy to walk you through the settings.

What you can do next

  • Read the recommendation yourself: the CNIL page and the 12-page PDF are linked in the sources below.
  • Give the CMP wording examples above to whoever manages your consent platform, and ask for the separate first-layer session replay mention.
  • Run the masking checklist against your site, especially numeric keypads (exclude those pages), chat widgets and dynamically filled account fields.
  • Check where to report or ask more: the Experience privacy FAQ covers retention, masking and consent; contact us and we will answer plainly.

Common questions

Does session replay need consent under the CNIL rules?

Yes. Session replay reads and writes information on the visitor's device, which makes it a tracker under article 82 of the French data protection law. The CNIL recommendation explicitly says no exemption applies, so prior consent is required before a replay starts.

Which consent tool can I use?

The CNIL accepts the usual interfaces for collecting valid consent, including consent management platforms. The tool must be updated so the first layer names session replay separately and shows each purpose with a short title, plus a fuller description on the second layer.

How long can I keep recordings?

The CNIL recommends a few months for the technical errors and UX purposes, and only a few hours after the session ends for customer support. If your tool's shortest retention is longer than that, do not use it for the support purpose. Hitsteps Experience offers 30 days by default with a 1-day minimum, so we recommend it for the errors and UX purposes.

Is masking enough to be compliant?

No. Masking limits what the replay shows, but the CNIL says consent is still required because session replay is a tracker, and masking does not replace it. Mask by default (images, forms, text, dynamic fields, keypads, chat), keep passwords and payment details out, and check that capture stops when the visitor withdraws, as the CNIL asks. Masking is one part of the recommendation, not a substitute for consent.

Where can I read the CNIL sources?

The CNIL announcement and the recommendation PDF (outils de rejeu de session, adopted 8 October 2026) are linked in the sources section, and the deliberation is published on Légifrance.

Sources

The recommendation requirements above read from these CNIL publications (all current on 12 November 2026). Product facts describe the Hitsteps tracker itself as documented in the live Experience FAQ:

CNIL guidance applies to French law and the ePrivacy rules as implemented in France. Other EU data protection authorities publish their own positions; check with yours.