The French Data Protection Authority (CNIL) has launched a public consultation on its draft recommendation for session replay technologies. These tools let organizations record and review every detail of how people browse websites or mobile apps, raising important privacy questions.
What exactly are session replay tools?
Session replay solutions capture a user’s complete journey on a site or app and turn it into a watchable video. They record actions such as mouse movements, taps, clicks, scrolling, and — in some cases — what people type into forms. Companies typically use them to spot bugs, improve user experience, or optimise layouts.
Because these tools create an extremely detailed picture of individual behavior online, they can feel highly intrusive and may affect people’s privacy rights.
New guidance for responsible use
The draft recommendation is aimed at two main groups:
- Tool providers — the companies that design, build, and configure these solutions
- Website and app publishers — the organizations that actually deploy them
Developed after discussions with industry players and civil-society organizations, the document provides practical, concrete advice on how to comply with data-protection rules. It focuses particularly on:
- Applying the principle of data minimization (collect only what is strictly necessary)
- Clearly informing users about the technology
- Obtaining valid consent, including best practices for consent-management platforms (CMPs), where to display notices, and suggested wording
How to take part
The public consultation runs until 22 April 2026. After that, the CNIL will review all feedback and publish a final version of the recommendation.
Anyone can contribute — tool vendors, website operators, ordinary internet users, and civil-society groups are all encouraged to share their views. The CNIL asks organizations in the same sector or company to coordinate and submit a single, consolidated response where possible.
Participate here: CNIL public consultation form
Read the draft recommendation (PDF, 435 KB): Download here
This consultation gives the digital ecosystem a chance to help shape clear, balanced rules that protect privacy while allowing legitimate uses of session replay for improving online services. Contributions are welcome until mid-April.
