Who Offers GDPR-Compliant Session Replay Tools With Masking Features? 5 Best Options (2026)

Five session replay tools take GDPR seriously enough to shortlist in 2026: Clicktics, Matomo, Mouseflow, PostHog and Microsoft Clarity. All five mask sensitive data inside the visitor's browser, so the masked values never reach the vendor's servers. Where they differ is what gets masked by default, where your recordings are stored, how consent is handled, and how long recordings are kept. Below is each tool compared on exactly those points, with the masking classes you'd actually type, the catch for each one, and a 15-minute test you can run on any vendor before you trust it with real visitors.

What makes a session replay tool "GDPR-compliant"?

Strictly speaking, no software is GDPR-compliant on its own — your use of it is. Under GDPR the website owner is the controller and the replay vendor is a processor. What a good vendor does is make the compliant setup the easy one. When we evaluate a session replay tool for privacy, we look for six things:

1. Masking that happens in the browser. Sensitive values should be replaced before anything is sent. Masking on the server, or only in the player, means the vendor still receives the raw data.
2. Safe defaults. Form inputs should be masked out of the box. You shouldn't have to remember to protect the card-number field.
3. Element-level controls. A class or attribute to mask text (an address, an account number) or block a whole element from being captured.
4. A consent gate. In the EU and UK, the ePrivacy rules require consent before a non-essential script reads or stores anything on the device. The tool should be easy to hold back until your consent banner says yes.
5. EU hosting and paperwork. Where recordings live, a data processing agreement (DPA), and a list of sub-processors.
6. Retention you can rely on. Recordings deleted automatically after a fixed period, so you're not holding years of behavioral data you never look at.

If you want the legal background first — consent rules, the US wiretapping lawsuits, and what must never be recorded — read our guide to whether session recording is legal under GDPR. This article focuses on the tools.

The 5 tools at a glance

Competitor details come from each vendor's own documentation and pricing pages as of October 2026. Plans change — check before you buy.

1. Clicktics — privacy-first by default, with masking you can verify

Disclosure: we build Clicktics, so weigh this section accordingly. We've kept it to what you can check yourself — including a test we ran on a real checkout form, shown below.

Clicktics records sessions as a reconstruction of the page (not a screen video), and every form field is masked inside the visitor's browser before the recording is sent. That covers inputs of every type, text areas and dropdowns — names, emails, phone numbers, card numbers, expiry dates, free-text notes. Here's what a visitor saw on a demo checkout, with the form already filled in:

And here is the Clicktics replay of that same visit:

We didn't just look at the player. We searched the stored recording for every value on that form — the name, the email, the phone number, the card number, the expiry date, the note — and none of them were there. Pre-filled values like these are the hardest case, because they're already on the page when the recorder takes its first snapshot; values typed live are masked the same way. That's the difference between masking in the browser and hiding data in the player: the raw values never leave the visitor's device.

Privacy controls in Clicktics

• Masked by default: every form field, in the browser. Password, card and other sensitive fields are also never saved when a form is submitted.
• Three classes for everything else: add clicktics-mask to replace an element's text with asterisks (addresses, account numbers, order details), clicktics-block to keep an element out of the recording entirely, and clicktics-ignore to skip a field's input events.
• Consent gate: add data-require-consent="true" to the script tag and nothing records — no replay, no analytics, no chat — until your consent banner sets the go-ahead (code below).
• Do-Not-Track honored: visitors whose browser sends Do-Not-Track are not recorded.
• No cookies: Clicktics uses no third-party cookies and sets no cookies at all; it keeps a first-party visitor ID in the browser's local storage. Under EU rules that is still "storage on the device", so gate it behind consent like any analytics.
• Recording rules: leave out visitors by IP or IP range, country, city, landing page or referrer — either dropping the visit completely or keeping it in reports and skipping only the replay. You can also start recording only when a visitor reaches your checkout or triggers one of your events, so ordinary browsing leaves no replay behind.
• Retention: recordings are deleted automatically after 60 days.
• Hosting and paperwork: recordings are stored on servers in the EU, and a DPA template with Standard Contractual Clauses is available.

The catch: page text (as opposed to form fields) is recorded as-is unless you mark it with clicktics-mask, and there's no single "mask all text" switch. On pages that display personal data — an account dashboard, an order confirmation — add the class, or use a "no replay" rule for those pages as in the screenshot above. Also, if you use Clicktics' lead capture, the answers visitors submit in your forms (not passwords or card details) are saved as a lead, so mention that in your privacy policy.

Best for: websites and agencies that want session replay, heatmaps, funnels, live chat and lead management in one tool with privacy-safe defaults. Price: a 14-day free trial with every feature (no credit card), then $19 per website per month with 10,000 sessions per site — see pricing.

2. Matomo — the pick if you need to self-host

Matomo is the open-source analytics platform many European public-sector and privacy-first teams already use. Session recording and heatmaps come as a premium plugin, and the big draw is control: run Matomo On-Premise and recordings never leave your own servers. Matomo Cloud is hosted on AWS in Frankfurt, with backups in Dublin, and Matomo holds ISO/IEC 27001 certification.

• Masking: keystrokes aren't captured at all by default. Passwords and common card fields are always masked. Add data-matomo-mask to hide an element's content, or data-matomo-unmask to allow a field or form you're sure is safe.
• Consent: Matomo's cookieless, consent-exempt reputation does not extend to session recording. Matomo itself says heatmaps and recordings need prior consent, so wire the plugin to your consent banner.
• Retention: Matomo Cloud keeps recordings for three months. Self-hosted installs keep them until you set up raw-data deletion — remember to configure it.
• Price: Matomo Cloud from 29 a month; the On-Premise plugin costs €219 a year for one to four users.

The catch: page text is recorded unless you mask it, and self-hosting makes you responsible for security, updates and storage. Best for: organizations that need recordings on their own infrastructure.

3. Mouseflow — EU data region and a mature privacy toolkit

Mouseflow has been doing heatmaps and session replay for over a decade and has one of the more complete privacy toolkits. Your data region is set by where you sign up — EU customers' data is stored in the EU — and IP addresses are masked by default.

• Masking: fields containing personal data are masked by default, locally in the browser. mf-masked hides an element (add mf-listen to keep its click counts), mf-excluded keeps it out entirely, and data-mf-replace swaps content for text you choose. A visual privacy tool lets non-developers set this up.
• Consent: set window.mouseflowAutoStart = false and call mouseflow.start() after consent; there are documented setups for OneTrust, Cookiebot and Cookie Information. A "Disable cookies" option switches to browser storage, though Mouseflow notes this doesn't remove your consent obligations.
• Retention: one month on the free plan, up to 12 months on Premium.
• Price: a free plan with 500 recordings a month; paid plans start with Essential (25 a month for 5,000 recordings), with up to 35% off annually.

The catch: recording starts automatically unless you set up the consent hold yourself, and Mouseflow's ISO 27001 and SOC 2 references describe its infrastructure provider and an audit engagement rather than certificates in Mouseflow's own name. Best for: teams that want EU-stored data and strong form analytics.

4. PostHog — for product teams that want EU cloud hosting

PostHog bundles session replay with product analytics, feature flags and experiments. It offers an EU cloud (AWS Frankfurt) alongside the US one, and on EU Cloud, IP capture is off by default for new projects. PostHog is SOC 2 Type 2 audited and generates a DPA on request.

• Masking: all inputs are masked by default, in the browser. Page text is not — set maskTextSelector: "*" to mask all text, or add ph-no-capture to replace an element with a same-size block.
• Consent: opt-in and opt-out methods plus a cookieless mode for analytics; PostHog's own guidance indicates replays are off without cookie consent.
• Retention: one month on the free tier, three months on paid usage.
• Price: 5,000 free recordings a month, then $0.005 per recording, falling with volume.

The catch: page text and captured network requests can include personal data unless you configure masking and scrubbing. Self-hosting exists but is unsupported, and paid features are cloud-only. Best for: SaaS product teams with developers to configure it.

5. Microsoft Clarity — good masking, but not a GDPR-first pick

Clarity is free, has no traffic limits, and its masking is genuinely good: input fields are always masked, and the default "Balanced" mode also masks numbers and email addresses (switch to "Strict" to mask all text). Masked content is never uploaded. Use data-clarity-mask="True" and data-clarity-unmask="true" for individual elements.

The GDPR questions are about data and consent rather than masking. Data is stored in Microsoft's Azure cloud with no EU-only region; EU customers contract with Microsoft Ireland, which transfers data to Microsoft in the US under Standard Contractual Clauses. Microsoft states it has access to the data, and if ad storage consent is granted, data is shared with Microsoft Advertising. Since 31 October 2025, Clarity enforces a consent signal for visitors in the EEA, the UK and Switzerland — without it, only limited, cookieless data is collected. Recordings are kept for 30 days.

Best for: sites outside Europe, or teams with no budget that accept the data-sharing trade-off.

What about Hotjar?

Hotjar would normally be on this list — it masks keystrokes in the browser by default and hosts data in Ireland. But Hotjar is no longer open to new accounts: hotjar.com now sends new sign-ups to Contentsquare, and existing accounts are being moved to Contentsquare's Growth plan. If you're a current Hotjar customer deciding whether to migrate or switch, our guide to Hotjar alternatives compares your options.

How to test any tool's masking in 15 minutes

Don't take a vendor's privacy page on trust — ours included. Here's the test we ran on Clicktics, and you can run it on any tool during a free trial:

1. Build a test page with the fields your real site uses: a name, email, phone number, a card-number field, and a free-text box. Include one paragraph of personal text marked with the tool's mask class, and one box marked with its block class.
2. Test typed values. Fill in the form by typing, with recognizable dummy values (use a public test card number such as 4242 4242 4242 4242, never a real one).
3. Test pre-filled values. This is the case most often missed: browsers autofill forms and restore them when a visitor presses Back, so values can already be on the page when the recorder takes its snapshot. Reload the page with values filled in by script before the tag loads, and check those too.
4. Check the replay — every field should be masked, the masked text starred out, the blocked box empty.
5. Check what was actually sent. Open the browser's developer tools, filter the Network tab by the vendor's domain, and search the request payloads for your dummy values. If a value appears, it left the browser — whatever the player shows.
6. Test consent. Load the page without accepting your banner and confirm the network tab shows no recording requests until you do.

Running this on a real page also shows you which fields on your site need an extra class — the replay is the fastest way to see what visitors do on your website and what your tool keeps of it.

Setting up Clicktics for GDPR in five minutes

Add the consent attribute to the tracking script, then tell Clicktics when your banner gets a yes:

<script async src="https://app.clicktics.com/clicktics.js"
        data-api-key="pk_live_your_key"
        data-require-consent="true"></script>

<script>
  // Call this from your consent banner's "accept analytics" callback,
  // and on page load for visitors who already accepted.
  function clickticsConsentGranted() {
    window.__clickticsConsent = true;
    if (window.clicktics && window.clicktics.start) window.clicktics.start();
  }
</script>

Then mark anything personal that isn't a form field:

<p class="clicktics-mask">Jordan Avery, 14 Linden Street</p>   <!-- shown as asterisks -->
<div class="clicktics-block">Loyalty account #AC-2291</div>  <!-- never recorded -->

Finally, in Settings → Tracking, add "no replay" rules for pages that show personal data, and list Clicktics in your privacy policy as a processor for session recording and analytics.

A short GDPR checklist for session replay

• Hold the replay script until the visitor consents (EU, UK, and the US all-party-consent states).
• Confirm form fields are masked in the browser — run the test above.
• Mask or block personal text that isn't in a form field.
• Exclude pages where replay adds little and risk is high (account areas, payment steps).
• Disclose session recording in your privacy policy and name the vendor.
• Sign the vendor's DPA and keep its sub-processor list on file.
• Use a retention period you can justify — weeks or months, not years.

Frequently asked questions

Which session replay tools are GDPR-compliant?

Clicktics, Matomo, Mouseflow and PostHog all support a GDPR-compliant setup with in-browser masking, consent controls, EU hosting options and a DPA. Microsoft Clarity masks well but stores data in Microsoft's Azure cloud without an EU-only option. In every case, compliance also depends on your setup: consent, disclosure and retention.

Do I need cookie consent for session replay?

In the EU and UK, yes. The ePrivacy rules require consent before a non-essential script stores or reads information on the visitor's device — and that includes local storage, not just cookies. Session replay is not considered strictly necessary, so it needs consent even when a tool sets no cookies.

What is input masking in session replay?

Input masking replaces what a visitor types into a form field with placeholder characters, such as asterisks, inside the browser, before the recording is sent. The replay shows that a field was filled in, but not what was typed. Good tools mask all form fields by default and let you mask other page text with a class.

What's the difference between masking and blocking an element?

Masking keeps the element in the recording but replaces its text with asterisks, so the layout still makes sense in the replay. Blocking leaves the element out of the recording entirely, showing only an empty placeholder of the same size. Mask things like addresses; block things that should never be captured in any form.

Where does Clicktics store session recordings?

On servers in the EU. Recordings are deleted automatically after 60 days, form fields are masked before data leaves the visitor's browser, and a DPA template with Standard Contractual Clauses is available.

Try privacy-first session replay

Clicktics gives you session replay with every form field masked by default, a built-in consent gate, recording rules and 60-day retention — plus heatmaps, funnels, live chat and lead management in one script. Run the masking test above on your own site during the free trial.

Start your 14-day free trial → No credit card needed, or compare more options in our roundup of the best session recording tools.