Privacy / Regulation / Analytics
CNIL publishes final recommendation on session replay tools, confirming prior consent is required
The French regulator's guidance covers tool providers and site or app publishers, and asks for masking of irrelevant data, limits on sessions recorded and masking of chatbot conversations.
France’s CNIL has published its final recommendation on session replay tools. These tools use trackers to record or reconstruct a user’s full journey on a website or app, including mouse movements, taps, clicks, scrolling and sometimes form entries. The recommendation is aimed at both tool providers and the publishers that deploy them.
The CNIL states that these tools fall under article 82 of the French Data Protection Act and that no consent exemption applies, so prior consent is required under its existing cookie rules. Purposes must be set before deployment, not after data is collected. Recommended measures include masking irrelevant data, limiting the number of sessions collected and limiting the use of identifiers.
After a public consultation held between February and May 2026, the final text adds specific first-layer consent information, masking of mouse movements in some areas to avoid capturing authentication codes, and masking of chatbot conversations. The CNIL plans to support organisations, including through a webinar.
Why it matters
The CNIL treats session replay tools as trackers that need prior consent, with no exemption, and expects their purposes to be fixed before deployment. Privacy and analytics owners should inventory where these tools run, confirm they fire only after consent, and record the purposes defined before deployment. Masking settings are now a governance control: form fields, authentication areas and chatbot content need to be masked by configuration, not left to defaults.
Status: Published. Final version after public consultation from February to May 2026
What to check
- Identify every website and app where a session replay tool is deployed and confirm it loads only after the user has given prior consent.
- Check that the consent interface mentions session replay specifically at the first layer of information, as the final recommendation now advises.
- Review masking settings so that irrelevant data, form entries, authentication areas and chatbot questions and answers are not captured.
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Institutions
Who should care
- DPO
- Legal & compliance
- Analytics and product teams
- CISO