Session replay: when an app records its users’ screen
On 5 November 2026 the CNIL published its recommendation on session replay tools, the technologies that record and replay a user’s complete journey, screen by screen. The text explicitly targets mobile app publishers, where these tools capture touch interactions, keystrokes and screen content, and it reiterates that such recording relies on a tracker, and therefore on the user’s prior consent. It sets out the expected measures: masking by default, blocking passwords and banking data, short retention and information at the first level of the banner.
On 5 November 2026 the CNIL, France’s data protection authority, published a recommendation on session replay tools, adopted by its deliberation no. 2026-114 of 8 October 2026. It follows exchanges with the professionals concerned and civil-society representatives, and a public consultation held between February and May 2026. These tools, the CNIL writes, are “technologies for capturing and visualising the complete browsing journey of a user of a website or mobile app”. They are not limited to the pages or screens visited: they replay the whole session, action by action. The recommendation addresses two parties, the provider that designs the tool and the publisher that deploys it on its site or app.
The text is not written for the web alone. It names the mobile app at every step, from the definition of the tool to the technical measures, and notes that, in an app, the tracker is not a cookie but one of the “mobile identifiers within mobile apps”. For an app publisher, it says three things. Recording a user’s navigation is a read-and-write operation on their device, subject to their prior consent. What is recorded is their gestures, their keystrokes and the content of their screens, which the tool must be able to mask. And none of this can be checked from outside the app: only the phone shows it.
What a session replay tool records in an app
A conventional analytics tool counts screens and events. A session replay tool, by contrast, reconstructs the session so it can be watched again. The CNIL sets out its reach: beyond collecting information about the pages or screens visited, it makes it possible “to view all navigation actions, such as mouse movements, clicks or touch interactions, page scrolling, user input and other interactions”. In an app, that means taps, swipes, the text typed into fields and whatever is on screen at the moment the user acts.
Two risks, the CNIL writes. First, continuous tracking of navigation, which yields precise information about people’s private lives, their habits, their interests, and in some cases sensitive data. Second, excessive collection, beyond what the original purpose requires. The level of risk depends on the nature of the service: a health or dating app does not expose what a game exposes. The CNIL had already set out the mobile ground in its recommendation on mobile apps; session replay is a particularly intrusive case of it.
A recording, so prior consent
The CNIL attaches these tools to Article 82 of the French Data Protection Act, which transposes Article 5(3) of the ePrivacy Directive and governs any reading or writing of information on a user’s device. The conclusion is direct: “the purposes pursued by the deployment of session replay tools are subject to the prior consent of users”, because the recording is neither aimed at the communication nor strictly necessary to the service, which the publisher could provide without it.
Still, one has to know why one is recording. The recommendation allows three purposes: detecting and understanding technical errors, improving the user experience, and handling customer support requests. They must be “specified, explicit and legitimate”, defined before the tool is deployed, and the CNIL closes a door: they “cannot be determined after the data has been collected, nor depend on what the controller happens to see through the tool”. In other words, one does not deploy a broad recording and decide afterwards what to do with it.
Minimisation goes further. The controller must first “prefer the use of alternative tools that process less data” where they achieve the same goal. And the CNIL names the use to rule out: “a session replay tool should not be used for advertising retargeting”, since less intrusive solutions exist for that.
Between publisher and provider, the roles are set. The publisher that chooses to place the tool in its app determines its purposes and means: it is the controller. A provider that merely supplies the solution is a processor; if it reuses the collected data for its own needs, for instance to improve its tool, it becomes a joint controller of the read-and-write operations, in line with the Fashion ID case law. A clause making the publisher alone responsible for obtaining consent is then not enough.
Masking by default, and what must never be collected
This is the technical heart of the recommendation, and it is where mobile changes everything. The CNIL asks that a “masking tool” be “systematically made available”, to remove from the recording what is not necessary: images, forms, text fields, dynamically filled fields (those containing account information), mouse movements and clicks on numeric keypads, and the content of exchanges with a conversational agent. The fallback rule is clear: “in the absence of configuration, masking should by default apply to all the categories considered”. The mask is applied first; it is lifted screen by screen, not the other way around.
Two functions admit no exception. The security of processing requires “blocking the collection of any password, banking information, or other data subject to special conditions of collection”. And under data protection by default (Article 25 of the GDPR), the CNIL recommends that the provider “always [offer] the most protective default configuration possible”.
In an app, these requirements play out screen by screen. A forgotten input field, an unmasked payment screen, a messaging view left visible, and the recording carries away what it should never see, with nothing to signal it to the publisher. The recommendation adds safeguards on duration, from a few hours for support to a few months for error detection, and on identifiers, randomly generated per session, pseudonymised by hashing or limited to one domain, to avoid linking the sessions of a single person.
Information, at the first level of the banner
Information conditions the validity of consent, and the CNIL insists on it because these tools remain little known: “users of websites or mobile apps have little awareness of their existence and how they work”. It therefore recommends “specific information about session replay tools from the first level” of the consent management platform: a short, explicit notice, presented separately from the purposes, pointing to a more detailed description.
In an app, that means the banner already in place must be updated, and that withdrawing consent must be as easy as giving it. Above all, withdrawal must be effective: “read and write operations can no longer take place after the user withdraws consent”. A recording that continues after a refusal or a withdrawal is exactly the failure the CNIL has penalised elsewhere, on an app whose tracker stayed active after “continue without accepting”.
Why an app is harder to check
On the web, part of this can be inspected from a browser: you read the page’s code, you see the fields marked as masked, you follow in the developer tools the requests going out to the replay provider. In an app, none of that is within reach. The replay tool is a third-party component compiled into the binary, its masking is set view by view in the code, and what it sends leaves encrypted for its servers. The publisher sees neither what is captured, nor what is masked, nor when the recording starts relative to the user’s choice: end to end, it is harder to check than on the web.
Add what is specific to mobile: an installed version cannot be fixed remotely. Masking added today only protects the users who will update the app; the versions already on phones keep recording as they were compiled. The question is therefore not only “is the tool set up correctly?”, but “was it, version after version, and what did it actually send?”.
What the recommendation asks you to check
For a DPO, the recommendation comes down to a few questions to ask at every version of an app that embeds a session replay tool. Does the recording start before any consent, or only after? Does it really stop after a refusal or a withdrawal? Which servers receive the sessions, and what do they take away? Are the sensitive screens, input fields, payment, messaging, masked, or left visible by default? And does the banner mention the tool at the first level?
These questions are answered on the phone. Skanopy automatically drives the Android app on a real device, accepts or refuses in the banner as a user would, then records every third-party actor the phone contacts, including a session replay tool’s server, what it receives and when relative to the choice. It reads the stored consent string and compares it with the actors actually contacted, version after version. That is the whole point of a mobile app analysis: it does not state the law, it supplies the dated evidence the law is applied to.
Sources
Every finding in this article refers to one of these documents.
- Reco ’26Session replay tools, recommendationCNIL, deliberation no. 2026-114 of 8 October 2026, published on 5 November 2026 (in French)
- CNIL ’26Session replay tools: the CNIL publishes its recommendation to guide the playersCNIL, 5 November 2026 (in French)
- Summary ’26Summary of contributions to the public consultationCNIL, consultation held between February and May 2026 (in French)
- LégifranceDeliberation no. 2026-114 of 8 October 2026 adopting a recommendation on session replay toolsOfficial Journal of the French Republic (in French)
- CNIL ’25Recommendation on mobile applicationsCNIL, deliberation no. 2025-024 of 27 March 2025 (amended version published on 8 April 2025, in French)
- CNIL ’20Cookies and other trackers: guidelines and recommendationCNIL, deliberations no. 2020-091 and no. 2020-092 of 17 September 2020 (in French)
Frequently asked questions
It is a technology that captures and replays a user’s complete journey on a website or mobile app: beyond the pages or screens visited, it makes it possible to watch back all actions, mouse movements, clicks or touch interactions, scrolling and keystrokes. The CNIL published a recommendation on these tools on 5 November 2026 (deliberation no. 2026-114 of 8 October 2026). Because they rely on trackers, they fall under Article 82 of the French Data Protection Act, and their purposes are subject to the user’s prior consent.
Yes. The CNIL’s recommendation explicitly targets mobile app publishers and recalls that recording a session is a read-and-write operation on the device, subject to prior consent under Article 82 of the French Data Protection Act. The permitted purposes are limited (detecting technical errors, improving the user experience, handling support requests), defined before deployment, and the tool must not be used for advertising retargeting. Specific information about session replay must appear at the first level of the banner.
The CNIL recommends that a masking tool be systematically made available and, in the absence of configuration, apply by default to all categories: images, forms, text fields, dynamically filled fields (account information), clicks on numeric keypads and the content of exchanges with a conversational agent. The collection of any password or banking information must also be blocked, and the default configuration must be the most protective possible, under data protection by default (Article 25 of the GDPR).