Session replay without recording personal data

Session replay is one of the most useful tools in analytics: instead of guessing why visitors drop off, you watch it happen — the rage clicks, the dead clicks, the form that no one can finish. But replay also has a real privacy risk. Recorded carelessly, it can capture exactly the data you should never store.

The privacy problem with session replay

A naive recorder captures everything on the page, including what people type: names, emails, phone numbers, passwords, and payment details. That turns a helpful UX tool into a serious liability — sensitive data sitting in your analytics, subject to breach and to privacy law. Getting replay right is entirely about what you don't capture.

Masking before capture, not after

The single most important detail is where masking happens. Some tools record the raw data and mask it later on the server. That means the sensitive values still left the visitor's browser and reached a third party — the risk already happened. The safe approach is to mask inputs in the browser, before anything is transmitted, so private values are never sent at all.

If the password reached the server before it was masked, it wasn't really masked.

What should always be masked

A privacy-safe replay tool masks these by default, not as an afterthought you have to remember to configure:

• All form inputs and typed text, by default.
• Passwords, email, and telephone fields.
• Payment card numbers and CVV.
• One-time codes (OTP) and authentication tokens.

Cookies and consent still matter

Masking solves the content problem, but replay tools that rely on cookies still raise the consent question (see do you need a cookie banner). Cookieless replay with in-browser masking keeps both problems in check: no persistent identifier on the device, and no sensitive content leaving it. Tools like Hotjar and Microsoft Clarity popularized replay, but check how each handles cookies and masking against your privacy requirements.

A checklist for privacy-safe replay

• Are inputs masked in the browser before being sent? (Not just server-side.)
• Are passwords, email, phone, card, and OTP fields masked by default?
• Is the tool cookieless, or does it add to your consent burden?
• Can visitors' recordings be deleted on request?

VisitVerity's replay masks all inputs in the browser before capture — passwords, email, telephone, card, and OTP fields never reach our servers — and it's cookieless, so you get the 'why' behind your metrics without the privacy trade-off. Try it free.