What Changed
- CNIL issued a recommendation in November 2026 guiding professionals on transparent and compliant deployment of session replay tools.
- Publishers are required to obtain prior consent, enable simple consent refusal and withdrawal, provide clear dedicated information, and mask personal data form fields.
- CNIL will assist professionals during an initial implementation period before conducting checks and enforcing corrective measures upon complaints.
### Background and Overview of Session Replay Tools
When individuals navigate websites or use mobile applications, publishers and developers frequently utilize tools known as session replay tools (*outils de rejeu de session*). These software tools record user interactions across digital platforms, including mouse movements, touch interactions, clicks, page scrolling, and, in certain instances, text entered into form fields. These recorded actions are aggregated into individual sessions that enable publishers to recreate and view user journeys as video-like recordings. Primarily, publishers deploy these technologies to diagnose and resolve technical issues on their sites or applications and to analyze digital user experience.
However, session replay tools present significant privacy risks. By facilitating continuous tracking of browsing activity across websites and mobile applications, these tools can collect extensive details regarding an individual's private life, including sensitive personal data. If uncontrolled, session replay technology can lead to intrusive tracking and non-compliant data collection. To address these risks, the French data protection authority, the *Commission nationale de l'informatique et des libertés* (CNIL), published a specific recommendation in November 2026 aimed at professionals. The recommendation seeks to increase visibility around session replay practices and establish clear operational rules for professionals, thereby enhancing individuals' ability to understand and decide how their personal data is processed.
### Core Legal and Practical Requirements for Professionals
CNIL's November 2026 guidance details specific operational and technical measures that website and mobile application publishers must implement when deploying session replay tools:
1. **Prior and Informed Consent**
- **Consent Requirement:** Publishers must obtain user consent prior to deploying session replay tools.
- **Specific Purpose Presentation:** Each purpose or objective for which the tool is deployed must be presented to the user before consent is requested, enabling users to understand the full scope of their choice.
- **Ease of Refusal and Withdrawal:** Users must be able to refuse or withdraw consent just as easily as giving it, utilizing the same consent management interfaces.
- **Clear Transparency:** Information provided to users must be accessible, understandable, and presented at the appropriate time. It must enable users to identify the purposes of processing and recognize that trackers will be deposited on their devices. CNIL specifically recommends that publishers provide dedicated information regarding session replay tools to ensure transparency.
2. **Data Minimization and Usage Limits**
- **Purpose Specification:** Tools must be carefully configured and used for specific, predetermined purposes established in advance by the publisher to avoid excessive collection.
- **Data Limitation:** Processing must adhere to key principles under the General Data Protection Regulation (GDPR / *RGPD*). Collection must not be indiscriminate and must be strictly limited to what is necessary for the intended purpose.
- **Masking Sensitive Inputs:** Where a publisher uses session replay tools to enhance user experience, the publisher is required to mask form fields in which users input personal data to prevent unintended data capture.
### Practical Implications and Regulatory Oversight
For professionals and digital platform publishers, CNIL's recommendation necessitates an immediate review of technical configurations and consent management practices. Over the coming months, CNIL announced that it will accompany professionals to help them integrate these rules and guarantees into their operations. Following this initial support period, CNIL will monitor compliance through formal checks and investigations. Where non-compliance is identified, CNIL is empowered to adopt appropriate corrective measures to protect personal privacy effectively.
For individuals, the guidance clarifies their rights to understand when session replay tracking occurs, to choose whether to permit such tracking, and to easily revoke consent at any time.
### Frequently Asked Questions
**Q1: What are session replay tools and why do publishers use them?**
*Answer:* Session replay tools record user interactions on websites and mobile applications—such as mouse movements, touch actions, clicks, scrolling, and form entries—reconstructing them into video representations of user sessions. Publishers primarily use them to resolve technical issues and analyze user journeys to improve site or application performance.
**Q2: Must users give consent before session replay tools are deployed?**
*Answer:* Yes. Consent must be requested before session replay tools are deployed. Publishers must present each specific purpose for using the tool prior to obtaining consent, and users must be able to refuse or withdraw consent as easily as giving it.
**Q3: How must personal data entered into web forms be handled under CNIL's guidance?**
*Answer:* To respect privacy and prevent excessive data collection, publishers using session replay tools (such as for user experience improvements) must mask form fields where users enter personal data.
**Q4: What actions can individuals take if a website or application fails to observe these rules?**
*Answer:* Users who observe non-compliance with these rules can submit a complaint directly to CNIL. CNIL will conduct relevant checks and apply necessary corrective measures to protect individual privacy.
Who May Be Affected
Website and mobile application publishers using session replay tools, software developers, consent management solution providers, and digital platform users in France and the EU.
Cross-Border Context
Applies to digital platform publishers operating in France or targeting users in France under GDPR scope.
What to check next
- Consult CNIL's published recommendation text for technical implementation guidance on session replay tool configuration and form masking.
- Review current website and mobile application consent management tools to verify compliance with CNIL's consent withdrawal and purpose presentation standards.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.