What Changed
- CNIL adopted final recommendation Délibération n° 2026-114 following public consultation conducted between February and May 2026.
- The authority confirmed that session replay tools require prior user consent under Article 82 of the French Data Protection Act with no legal exemptions.
- CNIL mandated operational safeguards including first-level transparency, mouse movement masking for authentication areas, and conversation masking for chatbots.
On 5 November 2026, France’s data protection authority (CNIL) published its final recommendation (Délibération n° 2026-114 of 8 October 2026) regarding session replay tools. These tools rely on trackers to visually record or reconstruct user navigation sessions on websites and mobile applications. Although used to detect technical glitches and optimize user experience, CNIL highlighted that session replay tools carry elevated privacy risks, including the unauthorized collection of unnecessary personal data.
**Scope and Affected Entities**
The guidance addresses two key operational groups:
1. **Tool Providers:** Entities designing the technical solutions, features, and default configurations.
2. **Website and Mobile Application Publishers:** Organizations deploying these tools to monitor and analyze user behavior.
**Legal Framework and Prior Consent Rules**
CNIL clarified that session replay tools operate via trackers governed by Article 82 of the French Data Protection Act (loi Informatique et Libertés). Because no statutory exemptions apply to these tools, publishers must secure prior, informed, and explicit user consent in accordance with standard cookie rules before activating them. Furthermore, the purposes for using session replay tools must be specified and documented prior to data collection.
**Technical and Transparency Requirements**
Following a public consultation conducted between February and May 2026, CNIL introduced concrete compliance measures:
- **First-Level Information:** Specific details regarding session replay tools must be disclosed at the primary level of consent interfaces to ensure informed consent.
- **Data Masking Mechanisms:** Deployers must implement tools to mask non-relevant data. This includes masking mouse movements in specified interface zones to prevent the accidental capture of authentication codes.
- **Chatbot Protections:** For tools deployed in conversational chatbots, the text content of conversations (questions and answers) must be masked to prevent revealing sensitive personal data.
- **Data Minimization:** Entities must restrict the volume of recorded user sessions to what is necessary for their defined purpose and minimize the use of persistent identifiers.
CNIL announced it will support professionals with compliance implementation through upcoming webinars.
Who May Be Affected
Providers of session replay software tools and website/mobile application publishers deploying session replay technologies targeting users in France.
Cross-Border Context
Applies to foreign and domestic businesses utilizing session monitoring technologies on digital platforms accessible to users within the French jurisdiction under EU data protection law.
What to check next
- Check Délibération n° 2026-114 of 8 October 2026 on Légifrance for exact regulatory text.
- Monitor CNIL website for schedules regarding upcoming educational webinars for professional compliance.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.