GDPR Compliant Session Replay: What Cookieless Does and Doesn't Fix

GDPR compliant session replay is a matter of how you configure and disclose recording, not a property of the tool. You need a lawful basis, clear notice, masked sensitive fields, a processor agreement and sensible retention. Cookieless capture can reduce what sits on a visitor’s device, but it does not replace consent where consent is required. This is general information, not legal advice.

Why session replay draws scrutiny

A recording can reproduce what a visitor saw, clicked and typed. That is personal data when it relates to an identifiable person, and it can become sensitive if a page shows health, financial or account information. Regulators in the EU look at purpose, necessity, transparency and minimisation. The European Commission’s data protection pages are the official starting point for the framework.

Two separate legal layers usually apply. One concerns personal data processing under GDPR. The other concerns storing or reading information on a visitor’s device, handled in the EU through national rules implementing the ePrivacy Directive. A tool that sets no cookie may reduce the second layer’s footprint but it leaves the first layer fully in place.

Key takeaway: a tool can help you comply by masking inputs, waiting for consent and offering a processing agreement. It cannot comply on your behalf.

What cookieless and consent-aware capture means

BusinessMCP’s session replay page describes its tracker as cookieless, setting no cookie. It adds that, in gated consent modes, the recorder does not start until the consent banner reports consent, and identify events also wait. In the default mode, the page says the site owner is the controller and chooses the legal basis. It also states that the recorder masks form inputs and drops known bots at ingest. Those are vendor claims; verify them on your own site by recording a test session.

The same vendor documents a consent mode guide and a visitor identification and GDPR guide, and it offers a GDPR page. Comparison pages say it provides a data-processing agreement and a public sub-processor register.

How common tools differ on consent

Tool	Cookies per vendor pages	Consent handling
Microsoft Clarity	First-party cookies	Consent handled by the site owner
Hotjar (Contentsquare)	Sets its own cookies	Consent handled by you
BusinessMCP	Cookieless script	Consent-aware, recording can wait for consent in gated modes

This table reflects statements on BusinessMCP’s comparison pages; other vendors may describe their products differently, so check their documentation.

A pre-launch checklist

1. Define the purpose. Write down why you record: improving usability, finding errors. Avoid vague or secondary uses.
2. Choose a lawful basis. Consent or legitimate interest, decided with your counsel and consistent with your consent banner.
3. Update your privacy notice. Mention session recording, the provider, purposes and retention.
4. Mask by default. Confirm that input fields, payment forms and account pages are masked. Replay a test session to check.
5. Exclude sensitive pages. Do not record checkout payment steps, health forms or login screens unless you have a strong reason and safeguards.
6. Sign a processing agreement. Review sub-processors and data location.
7. Set retention. Keep recordings only as long as needed. Plans differ: BusinessMCP lists 7, 30 or unlimited days by tier, and a workspace can choose a shorter window. See session replay data retention.
8. Test consent gating. Open the site in a fresh browser, decline consent and confirm that recording does not start where you require that.
9. Handle rights requests. Know how to find and delete a visitor’s data on request.
10. Review regularly. Rules and guidance change.

Self-hosting and GDPR

Hosting on your own infrastructure keeps recordings out of a third party’s hands, but you take over security, retention and access control. We discuss when that is sensible in open source Hotjar alternatives.

Company-level identification

Resolving a visitor to a company from network data is a different activity from recording behaviour. It still needs thought: an IP address can be personal data in some contexts, and a company match is a hypothesis about an account, not a person. Read identifying companies in session recordings before you turn that on.

Choosing a tool with privacy in mind

Ask each vendor:

• Does it set cookies, and which?
• Can recording wait for consent?
• What is masked by default, and can I add more?
• Where is data stored, and which sub-processors are used?
• Can I limit retention and delete data?
• Is there a signed DPA?

Put the answers in a table and keep it with your records of processing. If you are evaluating replacements for Hotjar, the answers help decide whether a switch reduces your risk. Our migration checklist includes a privacy review step.

Verdict

Treat “GDPR compliant” on a vendor page as a feature list, not a guarantee. Cookieless, masked, consent-gated recording is a good foundation, but the lawful basis, the notice and the retention policy are yours. For jurisdiction-specific questions, ask a qualified lawyer.

Practical scenarios

A marketing site with a cookie banner. If recording only starts after the visitor accepts, check that declining really prevents the recorder from loading. A tag manager misconfiguration is the most common failure: the banner works, but the recording script fires on page load anyway. Test it in a fresh browser profile with network tools open.

A SaaS app with logged-in users. The risk goes up, because pages show account data. Mask the app by default and unmask only specific safe elements, instead of the other way around. Consider not recording settings, billing and messaging screens at all.

A checkout flow. Payment fields should never be captured. Confirm masking on every input, including those inside embedded frames, and check that error messages do not echo card or personal details back into the page.

A support or HR portal. Often the right answer is not to record. The benefit of watching sessions rarely outweighs the sensitivity of the content.

Documenting your decision

Keep a short record: what you record, why, on which pages, with which masking, under which legal basis, with which retention and which processor. When a regulator, customer or colleague asks, you can answer in a minute. Vendors help with the paperwork; BusinessMCP, for example, lists a DPA and a security page among its public pages. Whether those satisfy your own requirements is for your counsel and security team to decide, not for a vendor’s marketing page.