Session Replay.

A UX-analytics technique that records the DOM, clicks, scrolls, and keystrokes of a real user session so it can be replayed and analysed later. It belongs to the Identity & Access category of cybersecurity.

A UX-analytics technique that records the DOM, clicks, scrolls, and keystrokes of a real user session so it can be replayed and analysed later.

Session replay tools instrument a website to capture user interactions — mouse movements, clicks, scrolls, form inputs, and DOM mutations — and reconstruct full playback of the visit. Vendors such as FullStory, Hotjar, LogRocket, and Microsoft Clarity use it to debug bugs and study UX. The same capability can leak personal data: poorly masked recordings may include passwords, payment details, health data, or session tokens, which is why GDPR, ePrivacy, CCPA, and HIPAA classify it as high-risk processing requiring consent and masking. Defences include strict allow-listing of fields, server-side scrubbing, redaction of all input fields by default, consent management, and contractual data-protection terms with the vendor.

Defences for Session Replay typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Session recording, User session replay.