What is Session Replay?

Session replay tools — offered by vendors such as Hotjar, FullStory, Microsoft Clarity, and LogRocket — inject a JavaScript snippet that captures DOM changes and user interactions as they happen. Teams use the playback to diagnose UX problems, debug checkout errors, and understand why visitors abandon funnels. Used carefully, it is a legitimate and valuable optimization tool.

The privacy problem is what the recorder can sweep up. A replay script captures form fields as the visitor types, which can include names, addresses, email addresses, payment details, health-related search terms, and anything else entered on the page. Vendors provide masking and redaction controls, but they are configuration options — sites that deploy the default snippet frequently record more than they intend.

Legally, session replay sits at the center of the CIPA litigation wave. Plaintiffs characterize the recording as an interception of the contents of a communication in transit under Penal Code section 631, with the replay vendor cast as a third-party eavesdropper and the website as its accomplice. Similar suits have been filed under Florida, Pennsylvania, and Massachusetts wiretap laws. Exposure under CIPA is $5,000 per violation with no proof of harm required.

Two mitigations matter most: consent-gate the replay script so it never records a visitor who has not opted in, and configure aggressive masking so sensitive fields are never captured even after consent. Auditing what your replay vendor does with recordings — whether it uses them for its own product improvement — is the third, because vendor data use is what pushes a tool from 'tape recorder' to 'eavesdropper' in court.