Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Acoustic Experience Analytics is a session replay and digital experience analytics tool, formerly Tealeaf, that records visitor sessions, clicks and form interactions to build detailed behavioural data.
Acoustic Experience Analytics, with heritage in the IBM and Tealeaf session replay technology, is a digital experience analytics tool that reconstructs how visitors use your site. It records sessions, capturing page views, mouse movements, clicks, scrolling and form interactions so teams can replay journeys and spot friction. Because it watches real interactions, it processes far more detail than ordinary page analytics.
The tool sets cookies to identify sessions and returning visitors and records a stream of interaction events tied to those identifiers. Recordings can include text typed into forms, on screen content, IP address and device details, which means they can inadvertently capture sensitive information such as health data, payment details or credentials. This high level of detail is what makes session replay a significant privacy concern.
Session replay is a systematic and intrusive form of monitoring under the GDPR, and the cookies it relies on are non essential, so the ePrivacy Directive requires prior consent. Regulators treat the capacity to record sensitive input as a high risk to data subjects. You must mask sensitive fields, limit what is recorded and be able to demonstrate that the monitoring is necessary and proportionate.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Recording should begin only after the visitor gives freely given, specific, informed and unambiguous consent, because legitimate interest is hard to justify for such intrusive capture. The consent request should explain plainly that interactions will be recorded and that sensitive fields are masked. Visitors must be able to refuse without losing access to the site and to withdraw consent as easily as they gave it.
Given the United States and IBM heritage, processing commonly involves United States infrastructure, although regional hosting options may be available. Because recordings can hold rich and sensitive personal data, any transfer to the United States or another third country must rest on Standard Contractual Clauses or the EU US Data Privacy Framework and a documented transfer impact assessment. Confirm the actual data location in your contract.
Carry out a data protection impact assessment before going live and configure aggressive masking so passwords, payment fields and free text are excluded at source. Gate recording behind consent, set a short retention period and restrict who can view replays. Sign a data processing agreement, secure the transfer mechanism for any United States processing and disclose the tool clearly in your privacy and cookie notices.
Websites using Acoustic Experience Analytics must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment is strongly recommended and often mandatory because session replay is a systematic monitoring of individuals that can capture sensitive personal data. Assess what the recordings can see, including keystrokes, payment fields and free text, and confirm that sensitive inputs are masked at source before they leave the browser. Evaluate the consent mechanism, the retention period for recordings, the access controls within the platform and the transfer of data to the United States. Document the necessity and proportionality of the recording, the safeguards applied and the residual risk to data subjects.
Sample consent text
With your consent we use Acoustic Experience Analytics to record how you interact with this site, including clicks and form activity, so we can improve the experience. Sensitive fields are masked. Recording starts only if you accept, and you can decline or withdraw consent at any time.
Third-party domains contacted
goacoustic.comtealeaf.comacoustic.coCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| TLTSID | Analytics | Session | Identifies the current session so the session replay tool can stitch interaction events into a single recording. Set only after consent. |
| TLTHID | Analytics | 12 months | Recognises a returning visitor across sessions to link recordings over time. Set only after consent. |
| CoreID6 | Analytics | 24 months | Assigns a persistent visitor identifier used for behavioural experience analytics. Set only after consent. |
Acoustic Experience Analytics collects user analytics data — you legally need a consent banner. Try FlowConsent free.
The tool sets analytics cookies that identify the current session and a returning visitor so it can stitch interaction events into a coherent recording. These cookies are non essential and tie the replay to a visitor identifier. They should load only after the visitor has given consent.
Yes. Session replay is intrusive and the cookies are non essential, so recording should only begin after freely given, specific, informed and unambiguous consent. Legitimate interest is hard to justify because the tool can capture sensitive input. Visitors must be able to refuse and to withdraw consent easily.
Consent under Article 6(1)(a) GDPR is the appropriate basis given how intrusive the recording is and the non essential cookies involved. Relying on legitimate interest is risky because replays can capture sensitive data. Document the basis and the necessity and proportionality of the monitoring.
Given its United States and IBM heritage, processing commonly involves United States infrastructure, though regional hosting options may exist. Because recordings can be rich and sensitive, transfers must rely on Standard Contractual Clauses or the EU US Data Privacy Framework plus a transfer impact assessment.
Almost always yes. Session replay is systematic monitoring that can capture sensitive personal data, which typically triggers the requirement for a data protection impact assessment. Assess what is recorded, the masking applied, the retention period and the United States transfer before going live.
Complete a DPIA, then configure strict masking so passwords, payment fields and free text are excluded at source. Gate recording behind consent, apply a short retention period and restrict who can view replays. Sign a data processing agreement and secure the transfer mechanism for United States processing.
Other session replay and experience analytics tools include Hotjar, Contentsquare, Microsoft Clarity and FullStory. When comparing them, prioritise default masking, the hosting region, retention controls and the consent model rather than the depth of recording alone.
Disclose that you use a session replay tool, list its cookies with purpose and duration, and explain that interactions are recorded and sensitive fields are masked. State the legal basis, the retention period and how visitors can withdraw consent, and review the entry whenever the configuration changes.