Cybersecurity Policy Report, Online Recording Tools Examined by France’s CNIL, (Apr 11, 2025)
By Tony Foley
The French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), has launched a consultation that it says will help it to better understand the legal, technical, ethical, and societal issues associated with the use of browsing session recording and replay tools.
Publishers of websites and mobile apps use these tools to record user interactions like mouse movements, touch interactions, clicks, page scrolling, and, in some cases, form entries, CNIL explained in a news release yesterday.
The data is then used to reconstruct and visualize a user’s online journey, in the form of videos, providing a detailed review of their experience. The tools are designed to analyze the browsing path of Internet users, and may be used to detect and fix bugs or optimize the structure or ergonomics of the website or app, CNIL said.
CNIL claimed that session replay tools offer unprecedented possibilities for tracking and analyzing the behavior of users, thereby leading to the likelihood of higher risks to their rights and freedoms. Specifically, the tools collect large volumes of browsing data that often includes sensitive personal information, without users being aware of it, and make it possible to deduce information about the private lives of a large number of users such as their habits, beliefs, and interests.
The consultation seeks to develop practical recommendations for both session replay tool providers and website and mobile app publishers, enlightening them on the applicable rules and guiding them in the development of privacy-friendly tools. In addition to consulting these stakeholders, CNIL also will seek input from civil society associations to provide a complementary perspective on ethical and societal issues.
Although the news release does not specify the time period for which the consultation will be open, CNIL said it expected to publish rules and recommendations based on the consultation in the second half of 2025.
News: InternationalLegislation DataPrivacy