CNIL issues guidance on session replay tools, urging transparency, consent and data minimisation

What happened

The French data protection authority CNIL published a recommendation on session replay tools used by websites and mobile apps. It requires clear information, explicit consent and the ability to refuse or withdraw consent, and mandates limiting data collection to what is strictly necessary. The guidance also stresses compliance with the GDPR and short retention periods.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The guidance aims to protect user privacy by tightening consent and data‑minimisation rules for session replay technologies.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.
3. Revisit retention schedules and data minimisation for the data involved.