French regulator says session replay tools need prior consent

French regulator says session replay tools need prior consent

5 November 2026: France's data protection authority, the CNIL, has published its final recommendation on session replay tools. These are the scripts that record a visitor's mouse movements, taps, clicks, scrolling and sometimes form entries, then rebuild the visit as a video. The CNIL's position is that they run on trackers, fall under article 82 of the loi Informatique et Libertes, and need the visitor's prior consent, because none of that article's exemptions applies. A French site that loads one before the visitor agrees is outside the rule.

Not yet independently verified. The CNIL page gives no date by which sites must comply, and a recommendation is guidance rather than a new rule; we read the page, not the full PDF. We will update this when it can be confirmed, and remove this note.

Two audiences: the vendors and the sites

The recommendation is addressed to two groups. The first is the providers that design the tools and decide their settings and features. The second is the publishers of websites and mobile apps that deploy them to study how people use their service. The CNIL says it helps each work out its role under the law, and it applies the consent rules it already set out for cookies. Purposes have to be fixed, explicit and legitimate, and decided before the tool is switched on, not after the data has been collected.

What changed after the consultation

A draft went out for public consultation between February and May 2026. The final version adds four things the CNIL lists on its page:

• wording for consent banners that separates first-level from second-level information;
• a requirement that the use of session replay itself is named at the first level, so that consent is informed;
• masking of mouse movement in certain areas of a page, so that authentication codes are not captured by accident;
• for replay tools used inside chatbots, the ability to mask the content of the conversation, questions and answers alike, because it can reveal sensitive data.

Its technical measures also include a masking tool for data the analysis does not need, a cap on the number of sessions collected for each purpose, and limits on the use of identifiers.

What a site running replay should check

A business with French visitors can check three things against the recommendation. Does the replay script wait for consent, rather than loading with the analytics tag? Does the first layer of the banner name session replay? Are form fields, login screens and chat windows masked by default? The CNIL says it will run a webinar for professionals. Its page sets no date by which sites must comply. We list 10 web analytics products, the category where most replay tools are sold.

Related on TrustList:

• CNIL fines Fnac Darty €7m over an app tracker used without consent
• Norway's NOK 92m fine on Microsoft's Xandr is final

Sources

• CNIL: Outils de rejeu de session : la CNIL publie sa recommandation pour guider les acteurs, 5 November 2026
• CNIL: Recommandation relative aux outils de rejeu de session (PDF), 5 November 2026