# Session replay and data protection: using mouse recordings properly

> Session replay shows how visitors use a page. Where it helps, where the data protection risks lie and which safeguards you need.

Quelle: https://whovisit.app/en/blog/session-replay-data-protection-mouse-recordings
Veröffentlicht: 2026-11-07
Herausgeber: Whovisit (ARAVILO, Innsbruck)

A mouse video, known in specialist circles as *session replay*, is not a film of the screen. In the visitor's browser, a record is kept of how the page is built and changes, where the mouse moves, when scrolling happens and where clicks land. On your server this is turned into a playback that looks like a video. You see what the visitor saw and did.

That is powerful. Precisely for that reason it is sensitive. This article shows what mouse videos are good for, where the risks lie, which safeguards you should put in place and when you are better off doing without. It does not replace legal advice.

## What it is useful for

Figures tell you that a page is being abandoned. A mouse video can show why. Typical cases:

- **Usability problems.** Visitors click repeatedly on something that is not a link at all. Or they are visibly searching for a menu item that does not exist.
- **Form abandonment.** You see at which field someone gives up, even without knowing the content.
- **Paths through the site.** Which pages are visited one after another, where is there long reading, where is there skipping?
- **Display errors.** A layout that breaks only on a particular screen size is immediately obvious in the video.

The benefit stands or falls with volume. Anyone who watches one video from start to finish learns something about one visitor. You only recognise a pattern across many. Ask yourself beforehand which concrete question you want to answer. Without a question, mouse videos are just curiosity.

## Where the risks lie

The recording is complete as long as you exclude nothing. That means:

- **Visible page text.** Everything on the page is in the video. On a public product page that is harmless. On a page with names, addresses or orders it is not.
- **Input.** What someone types into a field can be recorded. Passwords, account numbers, health information, free text in contact forms: none of that ever belongs in a video.
- **Logged-in areas.** Customer accounts, checkouts and internal tools show personal data, even if nobody types anything.
- **Embedded content.** Third-party content in iframes, such as payment windows, maps, videos or chat widgets, has its own rules and should not end up in your video.
- **Re-identification.** Anyone watching can link a visit with other data, such as an email that happens to be open. The video itself provides the occasion, your systems the rest.

## Safeguards as a checklist

You should tick off these points before you switch on mouse videos:

1. **Mask inputs.** All input fields are made unrecognisable in the browser, before anything leaves the visitor. Blacking out only on the server is too late.
2. **Hide areas.** Cookie banners, chat windows, payment windows and anything that shows personal content are excluded by selector.
3. **Block paths.** Checkout, basket, account and order pages are not recorded in the first place.
4. **Short deletion period.** Videos are not an archive. The shorter the period, the smaller the risk. Set it and really delete.
5. **Inform separately.** Mention mouse videos expressly in the privacy policy and state the purpose, legal basis and deletion period. One sentence on "statistics" is not enough.
6. **Switch on only after a decision.** The tool should not run everywhere, but only where you have a question. Test on one page, not on the whole website.
7. **Consider a data protection impact assessment.** Whether one is needed (Art. 35 GDPR) depends on scope, type of data and visitor group. For systematic recording, have this deliberately examined and document the result.
8. **Clarify contracts.** If a service provider runs the recording for you, you need a data processing agreement (Art. 28 GDPR).

Two things also belong to good practice. First: check the playback yourself by clicking through as a test visitor and looking in the video at what becomes visible. Second: whoever has access to the videos should have a role you can name. Not everyone in the house needs to see everything.

## Assessment for Germany, Austria and Switzerland

Two questions have to be answered separately. The answers depend on the individual case; the following assessment is an overview.

**Access to the end device.** A script that stores or reads information on the visitor's device generally requires consent in Germany under [§ 25 TDDDG](https://www.gesetze-im-internet.de/ttdsg/__25.html) (the German Telecommunications Digital Services Data Protection Act), unless an exception applies. The exception for strictly necessary services is interpreted narrowly. You should not answer optimistically whether a recording script falls under it. In Austria, [§ 165 para. 3 TKG 2021](https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20011678) regulates this in a similar way.

**Processing of personal data.** A mouse video can contain personal data even if no name appears in the picture. The [GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) then applies and you need a legal basis under Art. 6. More on this and on choosing between consent and legitimate interest: [Consent or legitimate interest: how to decide](https://whovisit.app/blog/einwilligung-oder-berechtigtes-interesse). You will find the overall picture in [Visitor identification and GDPR: a sober assessment](https://whovisit.app/blog/besuchererkennung-dsgvo).

**Switzerland.** The [revised Data Protection Act](https://www.fedlex.admin.ch/eli/cc/2022/491/de) relies less on consent than on transparency. You must inform people which data you process for which purpose. Visitors can object to the processing. A recording with visible content and input without clear information is hardly justifiable there either. For cookies and similar techniques, the information duties under telecommunications law apply in addition.

All sources were retrieved on 06.11.2026. Laws change; check the current state before making a decision and speak to your legal adviser if in doubt.

## When you should do without

There are areas where the benefit does not outweigh the risks:

- **Health.** Health data is especially protected (Art. 9 GDPR). Even the fact of which page someone reads can reveal something.
- **Finance.** Applications, account balances, credit comparisons: too much information with too little control.
- **Children and young people.** If your site is aimed at minors, no recording should run.
- **Logged-in areas.** Anyone who has logged in expects that nobody is watching.

Where you do without, other ways remain open to you: surveys, tests with real people who consent, or figures without individual reference.

## How a tool can handle this

An example of how the safeguards can be implemented: with Whovisit, you record mouse videos only for visits by identified companies and switch them on or off per website. All input fields are masked in the browser. Iframes and embedded videos stay out. You hide further areas yourself. You block sensitive paths such as the checkout. Videos are deleted after 30 days by default. How to set this up is described in the help section under [Switching mouse videos on, restricting and viewing them](https://whovisit.app/hilfe/mausvideos-einstellen-und-ansehen). That does not make mouse videos harmless: even masked recordings show page content and behaviour. The legal assessment remains with you.

## In brief

Mouse videos answer concrete questions about usability when you use them in a targeted and time-limited way. Mask input in the browser, block sensitive areas, delete early and inform separately. Check consent for device access and a legal basis for the processing. Do without where health, finance or children are concerned.