Session Recordings Capture Keystrokes: Consent, Masking, and the Check You Skipped

A session recording shows a shopper typing their address into your checkout, and the recording captures every keystroke. If the address field is not masked, that recording now contains a real person's home address, stored on a vendor's server, watched by anyone on your team with access to the tool.

Most stores turn on session recordings and never check what they capture. The tool defaults mask nothing, the cookie banner does not mention recordings, and the retention is indefinite. That combination is a privacy incident waiting for a complaint, and the complaint will ask questions the store cannot answer.

What a recording actually captures

A session recording is a video of the shopper's screen, reconstructed from the page and their interactions. It captures mouse movements, clicks, scrolls, and everything they type, including in fields you never thought about: the gift message, the discount code, the address line, the password. The tool stores the recording and the keystrokes together, and anyone with access to the tool can replay them.

The risk is not theoretical. Recordings have captured card numbers typed into the wrong field, passwords entered in plain text, and health information typed into a notes box. The shopper does not know any of this is happening, because the recording is silent and the cookie banner, if it mentions analytics at all, does not mention that their keystrokes are being watched.

Consent, masking, and retention: the three settings

Consent comes first. Under the GDPR and many US state privacy laws, session recordings need consent before they start, because they collect personal data. A generic cookie banner that says we use cookies does not cover recordings. The banner needs to name session recordings specifically, and the recordings must not start until the visitor accepts.

Masking comes second, and it is the setting teams skip. Every recording tool lets you mask fields by CSS selector or by input type, and the minimum is to mask all password fields, all card fields, and any field that could contain an address or a phone number. Masking should be verified by watching a test recording, not assumed from the settings page, because a misconfigured selector masks nothing and the tool will not warn you.

Retention comes third. Recordings should be deleted after 30 days unless there is a specific reason to keep one, and the deletion should be automatic. A recording from six months ago is a liability with no value: the insight it contained is stale, and the personal data it contains is still personal.

The check to run this week

Open your recording tool, watch a recording of a checkout, and look at what is visible. If you can read an address, a phone number, or a password, the masking is wrong. Check the consent banner for the words session recording. Check the retention setting. Three checks, ten minutes, and the store either passes or it has a privacy incident that has been running since the day the tool was installed.

Frequently asked questions

Do I need consent for session recordings?

Yes, in most cases. Session recordings capture personal data, including anything a visitor types, and privacy laws like the GDPR and many US state laws require consent before collecting it. A cookie banner that does not mention recordings does not cover them.

What is masking in session recordings?

Masking replaces sensitive content with asterisks or blocks in the recording, so the viewer sees that a field was filled but not what was typed. Email addresses, passwords, card numbers, and addresses should all be masked by default, and most tools let you mask specific fields or the whole page.

Can session recordings capture passwords?

They can, if the password field is not masked. A recording tool that captures keystrokes will record the password as the user types it, and that recording is then stored on the tool's servers. Masking password fields is the minimum, and it should be verified, not assumed.

Are session recordings allowed under GDPR?

They are allowed with a legal basis, usually consent, and with safeguards: masking of sensitive fields, a retention limit, and a data processing agreement with the tool vendor. Recordings without consent and without masking are the combination that draws complaints.