Inspectlet
Inspectlet is a session recording and heatmap tool that replays how visitors move, click, scroll and type on a website, and shows where they drop off. Site owners use it to find usability problems and debug errors. Its script records interactions and sets cookies to identify sessions, so it requires prior consent, and form fields with personal data should be masked.
What does Inspectlet do?
Inspectlet is a session recording and heatmap analytics service operated by Spectrum Group Holdings LLC in the United States. It records detailed visitor sessions including mouse movements, clicks, scrolling, key strokes and form interactions, and presents the data as session replays, heatmaps, scroll maps and conversion funnels.
What Inspectlet does
Inspectlet loads a JavaScript snippet that captures the DOM and user interactions in near real time, sends them to the Inspectlet platform and replays them in a video like interface. It also generates heatmaps, conversion funnels and an A/B test analyser. Recordings can be filtered by URL, referrer, country, device, custom event or user identifier sent through the JavaScript API.
Data and cookies collected
Inspectlet writes the __insp_uid, __insp_sid, __insp_targetref and similar first party cookies (one year). It collects IP address, user agent, browser version, screen size, page URL, referrer, every mouse and keyboard event, every input change and a serialised DOM snapshot. Without explicit masking, it can capture data typed in forms, including names, email addresses and free text fields. Credit card numbers and password fields are masked by default.
GDPR and ePrivacy implications
Session replay is classified as a high risk tracker by the CNIL and by the EDPB. Art. 5(3) ePrivacy requires prior consent before Inspectlet sets cookies or reads the DOM, and Art. 6 GDPR requires a valid lawful basis for processing the recorded personal data. The only realistic lawful basis is explicit consent. The EDPB Guidelines 03/2022 on dark patterns prohibit any pre selected acceptance.
Data transfers to the United States
All recordings are transferred to and stored in the United States on AWS infrastructure (us east 1, Virginia). The transfer requires an appropriate safeguard under Chapter V GDPR. The options are: Standard Contractual Clauses combined with supplementary technical and contractual measures, or reliance on the EU US Data Privacy Framework if Inspectlet is certified. A Transfer Impact Assessment must be documented in any case.
Practical compliance steps
Block Inspectlet behind the marketing or statistics consent category of your CMP. Mask every input that may contain personal data using the data inspectlet sensitive attribute or the dashboard masking rules. Disable key stroke capture unless strictly necessary. Sign the Inspectlet Data Processing Agreement. Document Inspectlet in your records of processing and in your privacy notice with the US transfer and the retention period. Conduct a DPIA before going live.
Inspectlet and the GDPR
Inspectlet is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive). Session replay tracks identifying behaviour, may capture form data and constitutes monitoring of natural persons in the meaning of Art. 35(3)(c) GDPR, so prior explicit consent is required.
- Risk level
- high
- Applicable regulations
- GDPR, ePrivacy Directive, TDDDG, LSSI CE, CCPA/CPRA, EU US Data Privacy Framework, EDPB Guidelines 03/2022 on dark patterns
What Inspectlet sets and contacts
- Tracking method
- JavaScript snippet that records full session replays (mouse movements, clicks, scrolling, keystrokes, form input) and aggregates them into heatmaps. Recordings are streamed to Inspectlet servers and replayed in the Inspectlet dashboard.
- Server location
- Inspectlet (Spectrum Group Holdings LLC), United States. Recordings and event data are stored in Amazon Web Services data centres in the United States (us east 1, Virginia).
- Data transferred outside the EU
- All session recording data, including potentially personal data captured from forms, is transferred to and stored in the United States. Transfers require Standard Contractual Clauses, supplementary measures and a Transfer Impact Assessment, or reliance on the EU US Data Privacy Framework if Inspectlet is certified.
Cookies set (5)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| __insp_uid | first_party | 1 year | Unique visitor identifier used to link recordings to the same person across sessions. |
| __insp_sid | first_party | Session | Session identifier that groups the events of a single browsing session. |
| __insp_targetref | first_party | Session | Stores the referring URL that brought the visitor to the site. |
| __insp_norec_sess | first_party | Session | Flag that disables recording for the current session when the script is paused. |
| __insp_slim | first_party | Session | Timestamp of the last activity used to compute the session duration. |
Third-party domains contacted (3)
inspectlet.comcdn.inspectlet.comhn.inspectlet.com
Frequently asked questions about Inspectlet
Can't find your question? Write to us, we answer fast.
Which cookies does Inspectlet set?
Inspectlet writes first party cookies on your own domain, including __insp_uid (visitor identifier, one year), __insp_sid (session identifier), __insp_targetref (referrer), __insp_norec_sess (recording state) and a few internal flags. All require prior consent under Art. 5(3) ePrivacy as none of them is strictly necessary for the website.
Is consent required for Inspectlet?
Yes. Inspectlet captures behavioural data and may record personal data typed in forms, so it requires explicit, prior, granular and freely given consent under Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy. The script must be blocked until the visitor has accepted statistics or marketing cookies.
What is the legal basis for processing Inspectlet data?
The only realistic legal basis is consent (Art. 6(1)(a) GDPR). Legitimate interest is not appropriate because the recording is intrusive, can capture sensitive information, and the visitor cannot reasonably anticipate it. The CNIL and the EDPB have repeatedly confirmed that session replay tools require consent.
Is data transferred to the United States?
Yes. All session recordings, heatmaps and event logs are stored in the United States on AWS infrastructure. The transfer must rely on Standard Contractual Clauses combined with supplementary measures, or on the EU US Data Privacy Framework if Inspectlet has self certified. A Transfer Impact Assessment is mandatory.
Do I need a DPIA for Inspectlet?
Yes. Session replay constitutes systematic monitoring of natural persons within the meaning of Art. 35(3)(c) GDPR and appears on the CNIL list of processing operations requiring a DPIA. The DPIA must cover the recording scope, masking strategy, retention, US transfer, lawful basis and rights of data subjects.
How do I implement Inspectlet correctly?
Block the script until consent is granted. Add the data inspectlet sensitive attribute to every input that may collect personal data. Disable keystroke capture for all input fields by default. Reduce the retention period to the minimum required. Sign the Inspectlet DPA. Update your privacy notice with the recording, the US transfer and the rights of data subjects.
Which alternatives to Inspectlet should I consider?
EU based alternatives include Contentsquare (France), Mouseflow (Denmark) and Smartlook (Czech Republic). US alternatives include Hotjar (now Contentsquare), FullStory, LogRocket and Microsoft Clarity. Self hosted open source options include OpenReplay and PostHog session replay.
How do I update the cookie policy when Inspectlet changes?
Whenever you change the masking rules, retention period or recording scope, update the Inspectlet entry in your cookie table and privacy notice, document the change in your records of processing, and consider invalidating previously collected consents by bumping the consent banner version.
LiveBy
LiveBy is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. LiveBy offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, LiveBy empowers organizations to optimize strategy and maximize return on investment.
ExtraWatch
ExtraWatch is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. ExtraWatch offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, ExtraWatch empowers organizations to optimize strategy and maximize return on investment.
Triggerbee
Triggerbee is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Triggerbee supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Triggerbee enables informed decisions that improve experience and drive results.
Piano Analytics
Piano Analytics is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Piano Analytics supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Piano Analytics enables informed decisions that improve experience and drive results.
Dema
Dema is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Dema supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Dema enables informed decisions that improve experience and drive results.
WildJar
WildJar is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. WildJar supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, WildJar enables informed decisions that improve experience and drive results.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.