Session replay is the most invasive thing an ordinary website does to its visitors, and the consent question around it is more interesting than the one about counting them. Two separate rules apply, most tools satisfy neither by default, and satisfying the first does not get you out of the second.
This is how the rules work in practice, not legal advice. If your pages show health, financial or children's data, ask somebody qualified.
Two questions, not one
Does it store anything on the visitor's device? That is Article 5(3) of the ePrivacy Directive, and it is the question a cookie banner answers. It is about the act of writing to or reading from someone's machine, whatever the technology: a cookie, localStorage, or a fingerprint.
Is what it captures personal data, and what is your lawful basis? That is the GDPR, and it applies whether or not anything was stored. A replay of somebody filling in a form, moving a mouse and scrolling through their own order history is personal data about them by any reading. So a tool can be genuinely storage-free and still need a lawful basis for the recording itself.
Most discussion of this only covers the first question, because the first question is the one with a banner attached to it.
The first question - what recording usually stores
To stitch several page views into one replay, a tool has to recognise the same browser across those page views. The usual way is an id in a cookie or in localStorage, which is storage on the device and needs consent in the EEA and the UK.
It does not have to be. The identifier can be derived on the server from what the request already carries, and rotated so it cannot survive the day, the same mechanism as cookieless analytics. A replay assembled that way never touches the visitor's machine, and Article 5(3) has nothing to bite on.
What that costs is real and worth stating: recordings cannot be joined across days, so "show me everything this person did last week" is not a question that tool can answer. For finding out why a checkout leaks, it does not matter. For following one named customer's whole history, it does.
The second question - a lawful basis, whatever you stored
Recording still processes personal data, so under the GDPR you need a basis for it. In practice that is either consent or legitimate interests, and legitimate interests means doing and keeping a balancing test, writing down why your interest in improving the page outweighs the visitor's interest in not being filmed using it.
That assessment gets harder the more the replay captures, which is why what a tool records by default matters more than the banner does:
- Form fields. A replay that captures typing captures passwords, card numbers, medical answers and anything else somebody types. No balancing test survives that. Any tool worth using masks input contents and does not offer it as an option.
- The words on the page. Separate from what people type, and more easily missed. An account page, an order confirmation or a patient record shows personal data to the visitor, and a replay showing it to you is a copy of that data in a different system.
- Special categories. Health, religion, sexual orientation, trade union membership. If a page can display any of these, replay of that page needs a different conversation, and usually it needs switching off for that page.
What to check in whatever tool you use
- Are form fields masked, and can that be turned off? The right answer to the second half is no.
- Is page text captured, and is that your decision? A tool that decides it for you has made a legal choice on your behalf.
- Can you exclude a page or an element? You will need it for at least one page.
- Does it store an id on the device? If it does, the banner is not optional.
- Does it honour Global Privacy Control? GPC is a legally recognised opt-out in several US states, and it arrives as a request header whether or not your tool reads it.
- How long are recordings kept, and can you delete one?
How Skomi answers those
Form field contents are never recorded, in any configuration. That is not a default in Skomi's session recording. There is no setting for it, in any mode.
How much page text is captured is a per-site choice, and there are three answers. Strict captures no text at all, so a replay shows layout, structure and interaction with no words. Balanced masks what looks like personal data: numbers and anything resembling an email address. Relaxed captures page text and is the default, on the reasoning that a replay with no words in it is very hard to act on. A site whose pages display personal data wants one of the first two, and that is a decision only the site owner can make.
Anything can be excluded. A data-skomi-mask attribute masks a region and data-skomi-unmask exempts one inside it, the skomi-block class stops an element being captured at all, and a site can list CSS selectors that are never recorded.
Global Privacy Control is honoured per site, and it is off until you turn it on. When it is on, a request carrying Sec-GPC: 1 is answered with nothing recorded, checked on the server, so it works for every browser regardless of what the page has cached. It applies to recordings and heatmaps only: the analytics half stores no address and no cross-site identifier, which makes it a poor fit for a signal aimed at cross-context tracking.
Nothing is stored on the visitor's device by default, so on the default setting the first question above does not arise. The second still does. You still need a basis for recording, and that is yours to hold rather than ours.
Recordings expire before anything else. The window is part of your plan and is the shortest of the three retention periods Skomi keeps.
Heatmaps are the same question, smaller
A heatmap is built from the same capture (clicks, movement and scroll depth against a page) so the storage question is identical. What differs is the second question: an aggregate of where a thousand people clicked is much easier to justify than a video of one of them, and a heatmap built without device storage and without page text is about as unobtrusive as behavioural measurement gets.
If you are weighing whether to run replay at all, that difference is the useful one: when you need session recordings and when you do not.
Behavior is where both run in Skomi, with masking applied to inputs by default rather than as a setting you remember. If you are weighing tools on exactly this point, Microsoft Clarity documents a consent requirement of its own for EU visitors, and what happens without it.