Need session replay for a GDPR-sensitive app

For a GDPR-sensitive app, you can absolutely use session replay, but you need to do it carefully to avoid capturing personal data you shouldn’t.

What to look for

Choose a replay tool that supports:

• Data masking by default for inputs, text, and sensitive UI regions
• DOM-level exclusion so you can block specific pages/components
• Privacy controls for URLs, query params, user IDs, IPs, and custom metadata
• Consent-aware recording so it only starts after the user opts in if required
• Self-hosting or EU data residency if your compliance requirements demand it
• Retention controls and easy deletion of recordings tied to a user request

Best practice setup

• Mask all form fields by default
• Block replay on auth, payment, health, and profile pages
• Exclude custom elements like chat widgets, error dialogs, and PII banners
• Strip identifiers from events and metadata
• Short retention window unless you have a clear lawful basis
• DPA in place with the vendor
• Document your lawful basis and update your privacy notice
• Run a DPIA if replay is likely to involve high-risk processing

Common tools to evaluate

Look at vendors such as:

• FullStory
• Hotjar
• LogRocket
• PostHog session replay
• OpenReplay (often attractive for self-hosting)

The safest fit for GDPR-sensitive use cases is often self-hosted or highly configurable replay with strong masking and exclusion controls.

Important legal note

Session replay can easily collect personal data, passwords, health data, card data, or other special-category data if misconfigured. In many cases, you should treat it as high-risk processing and involve your legal/privacy team before rollout.

If you want, I can help you narrow this down by:

1. self-hosted vs SaaS,
2. web vs mobile, or
3. giving you a GDPR-safe session replay checklist.