Session Recording Privacy Considerations
What Session Recording Tools Actually Capture
Session replay tools (FullStory, Hotjar, Microsoft Clarity, PostHog Session Replay) work by recording DOM mutations and user input events in the browser (via libraries like rrweb) and reconstructing them server-side into a replayable video-like session, rather than recording actual screen pixels. This means by default they can capture everything rendered in the DOM — form field input as it's typed, text displayed on screen, and in the worst misconfigurations, content that was never meant to leave the user's browser at all, like credit card numbers, passwords typed into misclassified fields, or another user's personal data rendered in a support or admin view.
Default Masking Is Never Sufficient for Regulated Data
type="email"), but default masking is based on heuristics and HTML attributes, not a guarantee. A custom-built form field, a contenteditable div, or a data table rendering sensitive values in plain text will not be caught by default rules. Treat default masking as a starting baseline requiring active configuration, never as sufficient compliance coverage on its own.Legal Exposure: Wiretap and Recording Statutes
Session recording has drawn genuine litigation in the US under state wiretapping and electronic communications statutes (notably California's CIPA and Pennsylvania's Wiretapping Act), with plaintiffs arguing that recording a user's in-session behavior without clear, specific consent constitutes unlawful interception of electronic communication. Several class-action suits have specifically targeted companies for deploying session replay tools without adequate disclosure. This is a materially different legal exposure category than standard analytics cookie consent — generic cookie-banner language covering 'analytics cookies' has been argued in court as insufficient disclosure for session-level behavioral recording specifically.
Configuring Selector-Based and Attribute-Based Masking
Beyond default field-type masking, every mature session replay tool supports explicit masking rules keyed to CSS selectors, data attributes, or element text patterns — this is where the real compliance work happens. The practice is to audit every screen that could render sensitive data (billing forms, account settings, admin/support views showing other users' data, any free-text field) and explicitly mask or block capture at the element level, rather than relying on the tool to infer sensitivity.
posthog.init('phc_YOUR_PROJECT_KEY', {
session_recording: {
maskAllInputs: true, // mask every input field by default; opt in
// specific non-sensitive fields explicitly
// rather than opting sensitive ones out
maskTextSelector: '[data-sensitive], .ssn-field, .card-number',
blockSelector: '[data-pii-block]', // fully excludes the element's
// subtree from the recording,
// not just visually masked
},
});
// Mark any element rendering another user's PII (support/admin views)
// <div data-pii-block>{customer.fullAddress}</div>Server-Side PII Redaction Is a Stronger Guarantee Than Client-Side Masking
Consent Requirements Vary by Jurisdiction and Should Not Default to Implicit
GDPR treats session recording as requiring the same lawful basis analysis as any other personal data processing — legitimate interest can sometimes apply for essential functional purposes, but using replay data for broader UX research or marketing analysis typically needs explicit consent. Several US states now require specific disclosure of session recording/replay technology distinct from general analytics disclosures. Work with legal counsel to draft consent language that explicitly names session recording rather than folding it silently into a generic 'we use analytics cookies' statement — generic language is precisely what recent litigation has targeted as inadequate.
Retention and Access Control
Session recordings are a concentrated trove of sensitive behavioral and potentially identifying data, which means retention policy and internal access control matter as much as capture-time masking. Set an explicit retention window (most tools default to 30-90 days but allow configuration), restrict replay viewing access to roles that genuinely need it (not all-engineering-access-by-default), and audit-log who views which sessions if your compliance posture requires it.
What's Next?
Session recordings are most valuable as a qualitative companion to quantitative CRO research — pairing what the replay shows with structured user-testing methodology turns an interesting anecdote into an actionable, prioritized finding.
I build these systems professionally.
Whether it's a RAG pipeline, analytics migration, or AI workflow — let's talk.