CNIL issues guidance on session replay tools to ensure GDPR compliance

What happened

The French data protection authority CNIL published a recommendation on session replay tools that record user interactions on websites and mobile apps. It clarifies that these tools require prior consent and must respect data minimisation, purpose limitation and transparency obligations under French law and the GDPR. The guidance provides technical and organisational measures such as masking irrelevant data and limiting session collection.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The guidance helps providers and publishers align session replay technologies with privacy rules, reducing risk of unlawful personal data collection.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.
3. Revisit retention schedules and data minimisation for the data involved.
4. Inventory AI or automated decision systems in scope and their assessments.