Session Replay

What is session replay?

Session replay is a way to record what a visitor does on a website or in an app and play it back later like a video. A script on the page captures clicks, scrolls, mouse movements, typing and the page content the person saw. The tool then rebuilds the visit so the company can watch it.

Companies use it to find bugs and confusing screens. The privacy issue is how much it can capture. Unless the tool is set to hide them, a recording can include what people type into forms, messages, account details and other personal data on the screen.

When session replay is run by an outside analytics company, the recording data leaves the website and goes to a third party, much like a tracking pixel does.

What it looks like in a vendor's terms

A typical clause reads like this:

We use analytics tools that record how you interact with our websites and services, including clicks, mouse movements, scrolling and pages viewed. We use these recordings to improve our services and fix problems. Our analytics providers process this information on our behalf.

• "Record how you interact": this is session replay, even if the policy does not use the term.
• "Websites and services": check whether it covers the logged-in product, where your customers' data is on screen.
• "On our behalf": the provider is meant to act as a service provider that may use the data only for the vendor.

Why it matters to you

• Your customers' data on screen. If a vendor records sessions inside its product, recordings can capture your customer records, not just your team's clicks.
• A new party in the chain. The replay provider becomes another company holding that data. Check whether it appears on the vendor's subprocessor list.
• Lawsuit risk. Plaintiffs in California have filed class actions over website tracking tools under the state's wiretapping and surveillance law, the California Invasion of Privacy Act (CIPA). A 2026 amendment, SB 690, limits one kind of claim, but wiretapping claims still apply, with damages of $5,000 per violation. A replay script also sends visitor activity to a third party. If you run one on your own site, the risk sits with you. See CIPA pixel lawsuits.

What to check

• Search the vendor's privacy and cookie policies for "session recording," "replay," "heatmaps" and "record your interactions."
• Ask whether recording runs inside the logged-in product or only on the marketing site.
• Ask whether form fields and on-screen personal data are masked before anything is sent.
• Check that the replay provider is on the subprocessor list and bound by contract to use the data only for the vendor, as the CCPA's service provider definition requires.
• Ask how long recordings are kept.

How Venpo helps

Venpo watches your vendors' privacy policies, cookie policies and subprocessor lists, and emails you a plain-English alert when session recording language or a new analytics provider appears.