Microsoft Clarity

Yes. Clarity sets cookies for session recording and visitor identification. It must not load until analytics consent is obtained. Session recording of non-consenting users is a serious GDPR violation regardless of Clarity being free.

Clarity records mouse movements, click positions, scroll depth, page navigation, rage clicks, dead clicks, and JavaScript errors. It creates playable recordings of individual user sessions. By default it may capture text content in form fields unless masking is configured.

Yes, completely free with no session limits. This makes it attractive but does not reduce GDPR obligations. The same consent, masking, DPIA, and DPA requirements apply as to paid session recording tools.

Clarity sets _clck (user identifier, 1 year), _clsk (session grouping, 1 day), and CLID (client identifier). These require analytics consent under the ePrivacy Directive before Clarity loads.

Yes. All Clarity data is processed on Microsoft Azure infrastructure in the US. SCCs are required. Microsoft's Online Services Data Protection Addendum covers Clarity. Accept the DPA before using Clarity on EU-facing websites.

In Clarity Settings, go to Masking. Enable "Strict" masking to hide all text content in recordings. Alternatively, apply masking selectively using HTML attribute data-clarity-mask="true" on specific elements. Test masking by recording a session and verifying sensitive fields are masked.

Yes. Recording individual user sessions at scale constitutes large-scale systematic monitoring, a specific DPIA trigger under GDPR Article 35. Despite being free, Clarity triggers the same DPIA obligation as Hotjar, FullStory, and Contentsquare.

Hotjar (EU data region available), Lucky Orange (US but similar consent requirements), and Contentsquare (French, DPIA required) are alternatives. No session recording tool avoids GDPR consent requirements. For aggregate-only analysis, Plausible (EU, cookieless) or Matomo (self-hostable) are alternatives that don't require consent.

_clck (user identifier, 12 months), _clsk (session, 24 hours), CLID (cross site identifier on c.clarity.ms, 12 months), MUID (Microsoft Universal Identifier, 13 months), ANONCHK and MR (operational, short lived).

Yes. Clarity captures session recordings and stores tracking identifiers that are non essential. Prior consent under Art. 5(3) ePrivacy is required. Use the clarity('consent') API to align the SDK with the visitor's decision.

Consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy). Legitimate interest is not appropriate due to session recording and Microsoft profile linkage via MUID.

Yes. Microsoft Corporation processes Clarity data on Azure with default storage in US data centres. Transfers are covered by EU SCCs and the EU US Data Privacy Framework.

A DPIA is recommended because Clarity records sessions of European visitors and ties them to a Microsoft profile (MUID). Document the masking, retention and US sub processing.

Sign the Microsoft Online Services DPA, block clarity.js behind your CMP, use the explicit consent API, mask all input fields and any custom field with data-clarity-mask, set retention to the minimum and document Clarity in your Article 30 record.

Hotjar (EU, Contentsquare), Smartlook (Czech Republic), Mouseflow (Denmark), FullStory (US), LogRocket (US), Contentsquare itself, or open source self hosted OpenReplay.

List each Clarity cookie with purpose, retention and legal basis (consent). Mention Microsoft as processor, the US transfer with the EU US Data Privacy Framework and the masking applied.