Session replay: the CNIL launches a public consultation on its draft recommendation

What is a session replay tool?

These tools make it possible to recreate the full browsing journey of an internet user on a website or a mobile application. They can be used to identify and fix technical issues or to improve the design and user experience of a website or mobile application.

In practice, they allow website and app operators to record user interactions such as mouse movements, screen touches, clicks, page scrolling and, in some cases, forms inputs. This data is then used to replay and visualise a user’s journey, through video replays, offering a detailed view of their navigation on a website or a mobile application.

These tools, in that they offer detailed visibility into what people are doing online, can potentially be intrusive and infringe on users’ privacy.

Professionals: A draft recommendation to regulate the use of session replay tools

Who is this draft recommendation aimed at?

The draft recommendation is aimed at two groups of stakeholders:

• providers of session replay tools, who design the technical solutions and define their settings and features;
• website or mobile application operators that use them.

What are the objectives of the recommendation?

This draft recommendation was developed following discussions with professionals and civil society organisations. These discussions contributed to a better understanding of the uses of session replay tools and their associated implications.

It provides practical guidance on legal and technical challenges related to data protection rules. It answers questions concerning the application of the principle of minimisation – which involves collecting information that is useful for the purpose pursued – and enables stakeholders to understand their obligations.

It also sets out the requirements professionals must meet when informing users, as well as how consent can be obtained in practice, through the use of a consent management platform (CMP), the level at which information should be provided, the wording that may be used to obtain consent, etc.

What is the timeline for the consultation, and who can contribute?

This public consultation will close on 22 April 2026.

At the end of the consultation period, the CNIL will review the contributions received and adopt a final version of the recommendation.

Any interested party may take part in the consultation. The CNIL particularly encourages participation from the stakeholders addressed by the draft recommendation, as well as the audiences directly concerned (internet users and mobile application users) and civil society organisations.

The CNIL invites stakeholders from the same organisation or sector to consolidate their comments into a single submission, in particular by coordinating with their representatives, networks, federations, associations, etc.

Participate in the consultation