> How the LiveSession session recorder works, why prior consent is required, what EU hosting means for transfers and which fields to mask before recording. > > Canonical: https://www.flowconsent.com/en/services/analytics/livesession Analytics # LiveSession Analytics LiveSession is a Polish session replay and product analytics platform headquartered in Wroclaw. The JavaScript snippet loaded from livesession.io records mouse movements, clicks, scrolls, form interactions and console errors of real visitors and replays them as videos in the LiveSession dashboard. Recordings are processed and stored on AWS Frankfurt, which is a competitive advantage over US session replay vendors. Because session replay is highly invasive, consent is required and the privacy controls of the recorder must be configured carefully. [Block LiveSession until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 4 - Third-party domains 4 - Servers European Union (LiveSession sp. z o.o., Wroclaw, Poland, headquarters); production hosted on AWS Frankfurt (eu central 1) by default, with a Mumbai region for non EU customers and a US optional region; data lake and machine learning workloads in the same EU region Overview ## What does LiveSession do? ## **What is LiveSession?** LiveSession is a session replay and product analytics platform operated by LiveSession sp. z o.o., a Polish company based in Wroclaw. Marketing teams, product managers and UX researchers install the LiveSession JavaScript snippet on their public site or SaaS application to record real user sessions, build heatmaps, configure funnels and segment behaviour by source, persona or conversion outcome. LiveSession competes with Hotjar (US/EU), FullStory (US), Microsoft Clarity (US/EU) and Mouseflow (Denmark). Its main differentiator in Europe is the EU only hosting on AWS Frankfurt for EU customers, which avoids the US transfer concerns that come with most US session replay vendors. ## **Cookies and data collected** The LiveSession recorder writes first party cookies (\_\_ls\_visitor, \_\_ls\_session, \_\_ls\_segments) and localStorage entries that link the session to a visitor ID. For each recorded session it captures mouse movements, click events, scrolls, form input events (with optional masking), keyboard activity (not the actual key values when masked), DOM mutations and JavaScript console errors. The recording is streamed to api.livesession.io and stored in AWS Frankfurt. By default, sensitive fields (passwords, credit card inputs) are masked at the SDK level, and additional fields can be excluded with CSS selectors or data attributes. ## **GDPR and ePrivacy implications** Session replay is one of the categories most aggressively scrutinised by EU regulators. CNIL, AEPD and the Italian Garante have all clarified that recording user behaviour is not strictly necessary to deliver a website and therefore requires prior consent under Art. 5(3) ePrivacy. The behavioural data captured by LiveSession qualifies as personal data under the GDPR. The legal basis can be consent or, in narrow B2B SaaS contexts, legitimate interest with a documented LIA, masking of sensitive fields and a clear right to object. ## **Consent and configuration** For EU traffic, do not initialise the LiveSession SDK until the analytics or product analytics category has been accepted in your CMP. Inside the dashboard, enable input masking globally, mark sensitive pages as do not record (login, sign up, payment, profile, account settings), restrict access to the LiveSession workspace to a small team and rotate API keys regularly. ## **International data transfers** For EU customers, LiveSession processes all recordings on AWS Frankfurt (eu central 1). Support and engineering staff in Poland may access recordings under contract. No US data centre is used by default. Customers in other regions can opt into Mumbai or US hosting, in which case standard transfer safeguards apply. ## **Practical compliance steps** Sign the LiveSession DPA, deploy the SDK behind a CMP toggle, set input masking and excluded pages, list LiveSession in your privacy notice and Article 30 record, run a DPIA covering session replay risks (re identification, sensitive content, mishandled masking), keep recordings for a short retention period and give users a way to opt out of recording at any time. Compliance ## LiveSession and the GDPR LiveSession is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for the LiveSession recorder loaded on visitor pages, because it stores a session identifier on the device and processes behavioural data far beyond what is needed to display the requested page. Contract performance (Art. 6(1)(b)) for authenticated B2B replays where the data subject is a known business contact, after a Legitimate Interest Assessment. - Risk level high - Applicable regulations GDPR, UK GDPR, ePrivacy Directive 2002/58/EC, US CCPA/CPRA (when serving US visitors) ### Impact assessment (DPIA) A DPIA is required because LiveSession involves systematic recording of user behaviour on the publisher's site, including mouse trajectory, form interactions and free text content. The DPIA should cover the masking of input fields, the exclusion of sensitive pages (login, payment), the retention of recordings, the access controls inside LiveSession and the rights of data subjects to opt out and to erase their recordings. ### Sample text for your banner > We use LiveSession (LiveSession sp. z o.o., Poland) to replay anonymised sessions of how visitors interact with our site. The LiveSession recorder sets a session cookie and streams behavioural data to AWS Frankfurt in the European Union. Sensitive fields are masked automatically. We only start the recording after you have accepted the analytics category. Cookies and trackers ## What LiveSession sets and contacts - Tracking method Session replay and product analytics platform: a JavaScript snippet loaded from livesession.io (and the legacy lswtracker.com host) records mouse moves, clicks, scrolls, form interactions and console errors, plus DOM mutations, into rrweb style session recordings; the recordings are streamed to the LiveSession backend, indexed and replayed in the LiveSession dashboard with heatmaps, funnels and segmentation - Server location European Union (LiveSession sp. z o.o., Wroclaw, Poland, headquarters); production hosted on AWS Frankfurt (eu central 1) by default, with a Mumbai region for non EU customers and a US optional region; data lake and machine learning workloads in the same EU region ### Cookies set (4) | Name | Type | Duration | Purpose | | ----------------------- | ------------ | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | \_\_ls\_visitor | first\_party | 1 year | Long lived LiveSession visitor identifier used to stitch together multiple sessions of the same browser for the publisher. | | \_\_ls\_session | first\_party | 30 minutes | Session level identifier used by LiveSession to mark which recording the current page view belongs to. | | \_\_ls\_segments | first\_party | 1 year | Stores the LiveSession segment membership for the visitor used to filter and group recordings. | | LiveSession.eventBuffer | first\_party | Persistent (localStorage) | localStorage buffer used to batch recorded events when the user is offline. Flushed to api.livesession.io once connectivity returns. | ### Third-party domains contacted (4) - `livesession.io` - `api.livesession.io` - `app.livesession.io` - `cdn.livesession.io` Questions ## Frequently asked questions about LiveSession Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does LiveSession set? The LiveSession SDK writes first party cookies \_\_ls\_visitor (long lived visitor identifier), \_\_ls\_session (recording session ID) and \_\_ls\_segments (segmentation membership), plus localStorage entries used for batching events offline. No third party cookies are set on the publisher domain. ### Do I need consent to use LiveSession? Yes. Session replay is not strictly necessary to deliver the page the visitor requested, and the SDK stores identifiers on the device. Art. 5(3) ePrivacy requires prior consent in the EU. Initialise the SDK only after the analytics or product analytics category has been accepted in your CMP. ### What is the legal basis for using LiveSession? Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for visitor recording. In tightly scoped B2B SaaS contexts, legitimate interest can support replays of authenticated business users after a documented Legitimate Interest Assessment, with field masking and a working opt out. ### Does LiveSession transfer data to third countries? For EU customers, no. LiveSession processes EU recordings on AWS Frankfurt (eu central 1). Support and engineering staff in Poland can access recordings under contract. The Mumbai and US regions are opt in for non EU customers and trigger standard transfer safeguards. ### Do I need a DPIA for LiveSession? Yes. Session replay involves systematic monitoring of user behaviour and can capture sensitive content if masking is misconfigured. Art. 35 GDPR triggers the DPIA obligation. The DPIA should cover masking, page exclusions, retention, access controls and opt out mechanisms. ### How do I implement LiveSession compliantly? Sign the LiveSession DPA, gate the SDK behind a CMP toggle, enable global input masking, exclude sensitive pages (login, payment, profile), set a short retention period, restrict workspace access to a small team, complete a DPIA and offer an in product opt out for recording. ### Are there alternatives to LiveSession? EU based session replay tools include Mouseflow (Denmark), Smartlook (Czech Republic with EU servers), Contentsquare (France, see our dedicated page), Plerdy (Ukraine and EU), Open Replay (open source, self hosted). US tools with EU residency include FullStory (US with EU regions on enterprise) and Microsoft Clarity (US with EU data centre). ### How should I update my cookie and privacy policy for LiveSession? List the LiveSession cookies in your cookie policy under the analytics or product analytics category, with their durations. In your privacy notice describe LiveSession as your session replay processor, the EU hosting on AWS Frankfurt, the masking strategy, the retention period and the user's right to opt out and to request erasure of recordings. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Luigi's Box](https://www.flowconsent.com/en/services/analytics/luigi-s-box) [Luigi's Box is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Luigi's Box offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Luigi's Box empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/luigi-s-box) [Analytics](https://www.flowconsent.com/en/services/analytics/luigi-s-box) · ### [SalesViewer](https://www.flowconsent.com/en/services/analytics/salesviewer) [SalesViewer is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. SalesViewer offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, SalesViewer empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/salesviewer) [Analytics](https://www.flowconsent.com/en/services/analytics/salesviewer) · ### [Microsoft Clarity](https://www.flowconsent.com/en/services/analytics/microsoft-clarity) [Microsoft Clarity is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Microsoft Clarity supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Microsoft Clarity enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/microsoft-clarity) [Analytics](https://www.flowconsent.com/en/services/analytics/microsoft-clarity) · ### [BizSpring](https://www.flowconsent.com/en/services/analytics/bizspring) [BizSpring is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. BizSpring supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, BizSpring enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/bizspring) [Analytics](https://www.flowconsent.com/en/services/analytics/bizspring) · ### [Wipe Analytics](https://www.flowconsent.com/en/services/analytics/wipe-analytics) [Wipe Analytics is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Wipe Analytics supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Wipe Analytics enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/wipe-analytics) [Analytics](https://www.flowconsent.com/en/services/analytics/wipe-analytics) · ### [uMarketingSuite](https://www.flowconsent.com/en/services/analytics/umarketingsuite) [uMarketingSuite is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. uMarketingSuite offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, uMarketingSuite empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/umarketingsuite) [Analytics](https://www.flowconsent.com/en/services/analytics/umarketingsuite) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)