Mouse Flow
Mouseflow is a Danish behavioural analytics platform that records full user sessions, builds heatmaps, generates funnel reports, captures form analytics, and surfaces visitor feedback. The JavaScript tracker records mouse movements, clicks, scroll depth, and form interactions, replaying them as video-like session recordings. As a Danish (EU-headquartered) vendor with primary EU hosting, Mouseflow is a popular GDPR-friendly choice compared to US-based session-replay tools.
What does Mouse Flow do?
What Mouseflow is
Mouseflow is a Danish behavioural analytics platform founded in 2009, headquartered in Aarhus. It records full user sessions, builds heatmaps (click, movement, scroll, attention), generates funnel and form analytics, and collects visitor feedback. The JavaScript tracker captures granular interaction events and replays them as video-like session recordings. Mouseflow is widely used by EU-focused product, growth, and UX teams who prefer an EU-based session-replay vendor over US peers (Hotjar US, FullStory US).
What data Mouseflow processes
Per session: persistent visitor identifier (mf_user cookie), mouse trajectories, click coordinates, scroll position, keystroke events (excluding actual key values by default), form field interactions (masked by default for text inputs), URL, referrer, user agent, screen size, and (with replay) DOM snapshots used to reconstruct what was visible. IP addresses are processed for geo-attribution and can be truncated.
GDPR and ePrivacy implications
Session replay is one of the most consent-sensitive analytics technologies. The persistent visitor identifier qualifies as non-essential under ePrivacy and TTDSG, and the breadth of the behavioural capture (especially DOM snapshots) makes the consent requirement firm. Mouseflow provides extensive privacy controls (field masking, IP truncation, exclusion of specific URLs and elements) that should be configured before going live.
International data transfers
Mouseflow is a Danish company and primary processing is in EU AWS regions for EU customers. North American customers can opt for US residency. The cookieless mode (no persistent identifier) and the field masking defaults make Mouseflow a clearly EU-favourable choice. Subprocessors outside the EEA are documented in the DPA with relevant SCCs.
Practical compliance steps
Sign the Mouseflow DPA, gate the Mouseflow tracker behind your CMP, enable field masking and IP truncation, exclude payment and checkout pages from recording, configure short retention for session recordings (Mouseflow default is 6 months, can be shortened), document the DPIA for session replay activity, and inform visitors clearly in the privacy notice.
Mouse Flow and the GDPR
Mouse Flow is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR) for session recording and heatmap tracking due to the persistent identifier and the broad behavioural data capture
- Risk level
- high
- Applicable regulations
- GDPR, ePrivacy Directive (Cookie Law), TTDSG, Danish Data Protection Act
Impact assessment (DPIA)
Mouseflow records full user sessions, including mouse trajectories, clicks, scroll, form interactions, and (with replay) what was visible on the page. Key DPIA considerations: (1) session recordings can incidentally capture special category data, payment data, or other sensitive content if not masked; (2) the persistent visitor identifier qualifies as non-essential under ePrivacy and TTDSG and requires consent; (3) Mouseflow provides field masking, IP truncation, and exclusion rules that significantly reduce the risk if properly configured; (4) EU hosting and Danish controller jurisdiction simplify the compliance posture compared to US peers; (5) session recordings stored on the platform must be subject to retention limits and access controls.
Sample text for your banner
We use Mouseflow, a Danish behavioural analytics platform, to record anonymised user sessions and build heatmaps that help us understand how visitors interact with our pages. Mouseflow sets a first-party visitor identifier cookie and records mouse, click, scroll, and form interactions; we have configured field masking for all sensitive form fields and IP truncation. Mouseflow is loaded only after you have accepted analytics cookies.
What Mouse Flow sets and contacts
- Tracking method
- JavaScript tracking snippet (mouseflow.com/projects/<id>.js) that records user interactions and streams session data via mf-cdn.com
- Server location
- European Union (Mouseflow ApS is a Danish company headquartered in Aarhus, with primary EU hosting). Data residency in the United States is available for North American customers.
- Cookieless mode available
- Yes
Cookies set (3)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| mf_user | Analytics / Identification | 1 year | First-party persistent visitor identifier used by Mouseflow to associate page views, mouse movements, and form interactions with a unique visitor across sessions. |
| mf_*_session | Analytics / Session | Session | Short-lived session identifiers used to group recorded events into a single Mouseflow session record for replay and analysis. |
| mf_*_pageview | Analytics / Functional | Session | Tracks the current page view within a Mouseflow session, used to attribute events to the correct URL when the visitor navigates the site. |
Third-party domains contacted (6)
mouseflow.comwww.mouseflow.comapp.mouseflow.comcdn.mouseflow.comeu.mouseflow.commf-cdn.com
Frequently asked questions about Mouse Flow
Can't find your question? Write to us, we answer fast.
What cookies does Mouseflow set?
Mouseflow sets the mf_user cookie (first-party, ~1 year) for persistent visitor identification, plus short-lived session cookies (e.g., mf_*_session) to group events. In cookieless mode, the persistent identifier is not stored.
Does Mouseflow require user consent?
Yes. The persistent visitor identifier and the breadth of behavioural capture qualify as non-essential under ePrivacy and TTDSG. Mouseflow must be loaded only after explicit consent.
What is the legal basis for using Mouseflow?
Consent (Art. 6(1)(a) GDPR) for the session recording and heatmap module. Legitimate interest can be considered only in tightly anonymised configurations (cookieless, no IP, no DOM snapshots), with documented LIA.
Does Mouseflow transfer data to the United States?
For EU customers, no by default: Mouseflow processes data in EU AWS regions. North American customers may choose US residency. Subprocessors outside the EEA are documented in the DPA with SCCs.
Do I need a DPIA for Mouseflow?
Yes. Session replay is a high-risk processing activity according to most EU DPAs (CNIL, ICO, datenschutzbeauftragter Hessen). Document a DPIA covering the masking configuration, retention, access control, and lawful basis.
How do I implement Mouseflow compliantly?
Sign the Mouseflow DPA, gate the tracker behind your CMP, enable default field masking and IP truncation, exclude payment and checkout pages from recording, shorten the retention period, document a DPIA, and inform visitors in the privacy notice.
What are the alternatives to Mouseflow?
EU-based session replay and heatmap alternatives: Contentsquare (France, big enterprise), AB Tasty (France), Heap EU residency, Hotjar (UK/Finland with US transfers), Microsoft Clarity (US, free), and self-hosted options like OpenReplay or PostHog Session Replay.
How do I update the cookie policy for Mouseflow?
List the mf_user cookie and any session cookies in the analytics section of the cookie policy. Specify the controller (Mouseflow ApS, Denmark), the EU hosting, and the CMP toggle to refuse the tracker. Inform visitors about session recording in plain language.
Boomerang
Boomerang is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Boomerang integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Boomerang helps organizations maintain robust websites that meet user expectations and technical requirements.
HockeyStack
HockeyStack is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. HockeyStack offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, HockeyStack empowers organizations to optimize strategy and maximize return on investment.
Segment
Segment is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Segment offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Segment empowers organizations to optimize strategy and maximize return on investment.
Mint
Mint is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Mint supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Mint enables informed decisions that improve experience and drive results.
Chartbeat
Chartbeat is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Chartbeat supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Chartbeat enables informed decisions that improve experience and drive results.
SmartDX
SmartDX is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. SmartDX supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, SmartDX enables informed decisions that improve experience and drive results.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.