CNIL: Session Replay Tools Need Prior Consent Under Article 82

France's data protection regulator published its final recommendation on session replay tools on November 5, 2026. The CNIL's conclusion: because these tools read and write trackers on a visitor's device, they require prior consent under article 82 of the Loi Informatique et Libertés, with no exemption available.

Information last verified on November 6, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article covers France only: the CNIL's recommendation, article 82 of the Loi Informatique et Libertés, and the GDPR and ePrivacy context the CNIL cites. It does not state the position of session replay or screen recording under US federal or US state wiretap, one-party consent, or session replay litigation, which runs on an entirely different body of law. For the US picture on tracker disclosure, see our guide to cookie banner requirements under US and EU rules.

What Happened

On November 5, 2026 the Commission nationale de l'informatique et des libertés (CNIL), France's data protection authority, published its final recommendation on session replay tools. Session replay tools capture a visitor's full navigation path on a website or mobile app: mouse movements, touch interactions, clicks, page scrolling and, in some configurations, what the visitor types into forms. The captured interactions are grouped into sessions that a site operator can then watch back as video.

The CNIL announced the recommendation in a news release the same day, but the operative act is a formal deliberation. It was adopted as Délibération n° 2026-114 du 8 octobre 2026 portant adoption d'une recommandation concernant les outils de rejeu de session, and the deliberation was published in the Journal officiel de la République française n° 0259 of November 5, 2026 as text n° 70 (NOR CNIS2629115X). Article 1 of the deliberation adopts the text set out in its annex; article 2 orders publication in the Journal officiel. The annex is the substance: a twelve-page document titled "Outils de rejeu de session, Recommandation," marked as the version adopted on 08/10/2026.

The CNIL addresses the recommendation to two distinct groups. The first is the providers who build the tools and decide which settings and features exist. The second is the website and mobile app publishers who choose to deploy them. The recommendation applies to publishers and providers established in France or elsewhere in the European Union, and also to those whose processing concerns people located in the EU, under GDPR article 3, paragraphs 1 and 2.

The text went through a public consultation first. The CNIL opened that consultation on February 25, 2026, and its own account of the process says the consultation ran between February and May 2026. The published synthesis of contributions, dated October 2026, records twelve contributors: two professional associations, one civil society association, two private companies and seven individuals. The CNIL says those contributions led it to clarify the information content publishers must provide, splitting first-level and second-level information in consent management platforms, and to add an expectation of session replay specific information.

Alongside the professional recommendation the CNIL published a consumer-facing page the same day, aimed at readers rather than compliance teams. For the regulator's wider role and the French rules on cameras and personal data, see our overview of French privacy law.

What the Law Actually Says

Article 82 and its two exemptions

The legal hook is article 82 of Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés, in the version in force since June 1, 2019. The article does two things. First, it requires that any subscriber or user of an electronic communications service receive clear and complete information about the purpose of any operation that accesses information stored on their terminal equipment or writes information into it, and about the means of objecting. Second, it provides that such access or writing may only take place once the user has given consent after receiving that information.

Article 82 then sets out two exemptions, and their exact scope is why this recommendation matters. The obligations do not apply where the access or writing "a pour finalité exclusive de permettre ou faciliter la communication par voie électronique" (has the exclusive purpose of enabling or facilitating communication by electronic means), or where it "est strictement nécessaire à la fourniture d'un service de communication en ligne à la demande expresse de l'utilisateur" (is strictly necessary for the provision of an online communication service expressly requested by the user).

As the CNIL's own recommendation records in its section on the applicable legal framework, article 82 transposes article 5.3 of Directive 2002/58/EC, the ePrivacy Directive. That is why the French analysis tracks the wider EU tracker rules, whose own mechanics are set out in our explainer on the EU cookie law.

Why the CNIL says no exemption applies

Section 5.1 of the recommendation is the operative legal passage. The CNIL writes: "Les finalités poursuivies par le déploiement des outils de rejeu de session sont soumises au consentement préalable des utilisateurs," meaning the purposes pursued by deploying session replay tools are subject to the prior consent of users.

It then gives two reasons, tracking the two exemptions in order. The read and write operations do not have the exclusive purpose of enabling or facilitating electronic communication. And they are not strictly necessary to provide the services publishers offer, because, in the CNIL's words, publishers could provide those services without them. That second reason is the decisive one for most operators: a session replay tool helps the operator understand its own service, which is not the same thing as the service the visitor asked for.

Consent itself is assessed under the GDPR. The recommendation cites GDPR articles 4.11 and 6.1.a for the proposition that information is one of the conditions of valid informed consent, and it directs operators to collect consent under the conditions already set out in article 2 of the CNIL's guidelines of September 17, 2020 (délibération n° 2020-091) and article 2 of its "cookies et autres traceurs" recommendation (délibération n° 2020-092). In other words, France is not creating a parallel consent regime for session replay; it is routing session replay into the existing tracker consent rules.

Two downstream layers follow. Processing of the personal data generated by the trackers, which the CNIL calls "traitements subséquents," needs its own legal basis under GDPR article 6; the CNIL says consent is generally the most appropriate one but leaves the controller to determine it. Reuse for a different purpose, the "traitements ultérieurs" of GDPR article 6.4, requires consent to that new purpose unless the data has first been anonymised. Users must be able to withdraw consent at any time under GDPR article 7, as easily as they gave it, and withdrawal must actually stop the read and write operations, which the CNIL notes may require expiring existing cookies or deleting them with a local script.

Article 82 is already being enforced

The recommendation is soft law, but the article it rests on is not, and the CNIL applied it with a fine two weeks before publishing the recommendation. On October 22, 2026, the CNIL's formation restreinte, the body that issues sanctions, adopted Délibération n° SAN-2026-015 against FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT, announced on October 29, 2026. The total penalty was 7 million euros (EUR): 6 million euros (EUR) against FNAC DARTY PARTICIPATIONS ET SERVICES and 1 million euros (EUR) against FNAC DIRECT.

That case did not concern a session replay tool. It followed a complaint by the association None Of Your Business (NOYB) and a March 2024 inspection of the companies' mobile app. The breach was a tracker that sent an identifier assigned to the user, plus information about products viewed, to a third-party domain through an API, in order to display personalised product recommendations and train a recommendation algorithm. The third-party domain and the per-company turnover figures are redacted in the published decision, so they are not public.

What makes it relevant here is that the CNIL worked through the same two exemptions in article 82. It held that those operations fell outside the exemptions because they did not have the exclusive purpose of enabling or facilitating communication by electronic means and were not strictly necessary for providing an online communication service at the user's express request, and so could not be carried out without prior consent. The reasoning runs close to the recommendation's without being identical: the recommendation reframes the second limb around the services publishers themselves offer, while the decision turns on a tracker used for personalisation and commercial targeting. The CNIL cited a settled and well-established enforcement record on such trackers, which it said fall outside the article 82 exemptions.

The decision carried more than a fine. The CNIL added an injunction requiring the companies to demonstrate that the new tool they use now collects consent where necessary, within one month of notification of the decision, failing which they face a penalty payment (astreinte) of 10,000 euros (EUR) per day of delay. Notification dates are not published, so the point at which that month runs out is not public, and we do not state that it has passed. The published decision does not record any challenge to it, and we do not treat it as final or predict what happens next. The CNIL made the decision public, citing the seriousness of the breach, the scope of the processing and the number of people affected; the companies will no longer be named in the published version two years after publication. Our report on that decision sets out the Fnac Darty mobile app tracker fine in full.

What the recommendation expects in practice

The recommendation is explicit about its own status. Its introduction states: "Cette recommandation n'est pas exhaustive et ne présente pas de caractère règlementaire," that it is not exhaustive and has no regulatory character, and that its sole purpose is to help the professionals concerned with their compliance. The measures section repeats that the measures are not mandatory and that alternative actions are acceptable where they let the controller meet the rules, with the burden of demonstrating that falling on the controller.

Within that framing, the expectations are specific. Purposes must be determined, explicit and legitimate, and defined before the tool is deployed; the CNIL says they cannot be fixed after the data has been collected, nor derived from whatever the controller happens to see in the replays. The recommendation covers three purposes: detecting and understanding technical errors, improving user experience, and support for handling customer requests. A controller using session replay for some other purpose must satisfy itself that the use is lawful, and the CNIL adds that session replay should not be used for advertising retargeting, given that less intrusive options exist.

On information, the CNIL recommends a short purpose label at the first level of a consent interface, a fuller description at the second level, and separately, a dedicated short mention referring to the use of session replay at that first level, because users have little awareness that these tools exist.

On data minimisation the recommendation sets out a menu of technical features, labelled in the document, that providers should offer and publishers should use:

• Limiting the sessions collected, through random sampling (L1), collection triggered by a defined event (L2), or review and prompt deletion of sessions not needed for the purpose (L3).
• A masking tool (M0) to hide irrelevant data, covering images, forms, text fields, dynamically filled fields, mouse movements and clicks on numeric keypads, and the content of exchanges with chatbots. Where it is not configured, the CNIL says masking should apply by default to every category.
• Graduated consequences of masking: collection with unmasking restricted to a limited number of authorised users under an internal approval process (M1), collection with release to the publisher only on a reasoned request with the provider holding the decryption keys (M2), or no collection at all (M3).
• Limits on identifiers: a randomly generated session identifier that prevents linking a user's sessions or tying them to an account (I1), a pseudonymous per-user identifier (I2), or an identifier scoped to a single domain (I3).
• Security features: blocking collection of any password, banking information or similarly sensitive data (S1), and an authorisation policy with distinct roles and periodic review (S2).

An annex maps those measures to each of the three purposes and attaches retention guidance: a few months for error detection and for user experience work, so that analysis stays tied to the current version of the site, and a few hours after the end of the session for support use cases. The CNIL also recommends that providers ship the most protective default settings available, citing data protection by default under GDPR article 25.

The recommendation also sorts out roles. A provider that supplies the tool without reusing the data for its own purposes acts only as a processor. A provider that, with the publisher's agreement, uses the collected data for its own purposes (improving its product, for example) is a controller for that processing and a joint controller with the publisher for the read and write operations behind it, a position the CNIL footnotes to the Fashion ID line of case law and to its own 2020 article 82 guidelines. Where joint controllership applies, the CNIL says a contract clause simply assigning the consent obligation to the publisher is not enough.

The CNIL announced no compliance deadline and no transition period, and announced no inspection or enforcement campaign. The only dated next step it published is an online webinar on November 17, 2026 at 11:00, with 25 minutes of presentation and 35 minutes of questions, aimed particularly at data protection officers. Beyond that date the CNIL says it will support professionals over the coming months, and that where the rules are not respected a person may complain to the CNIL, which will carry out whatever checks it considers relevant and adopt corrective measures if necessary.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The legal conclusion here is not a surprise, and that is the interesting part. A tool that writes an identifier to a visitor's device and streams back their clicks and keystrokes was always going to sit inside article 82 rather than outside it. What the CNIL has done is close off the argument operators have leaned on in practice, which is that session replay is a technical necessity of running the site. The recommendation answers that in one clause: publishers could provide their services without it. Once that sentence is on the record from the regulator, the "strictly necessary" route is hard to run in France.

The second notable move is the first-level disclosure point. Treating session replay as something that needs its own mention in the consent banner, separate from the purpose labels, sits awkwardly with consent management platform designs that fold a replay tool into a broader analytics or performance category. The CNIL's stated reason is that visitors do not know these tools exist. Whether or not the measure binds, it is a specific design expectation a reader can check against any banner they meet.

The third point is about where the obligation actually bites. Much of the technical annex is addressed to vendors, not site operators: the masking tool, the default-on masking, the identifier options, the encryption-plus-reasoned-request model. A publisher cannot comply with a feature its vendor does not ship. The recommendation's own answer is that publishers must choose providers whose tools let them meet their obligations, which turns a privacy question into a procurement question.

Finally, the soft-law status deserves to be read carefully rather than dismissed. A recommendation is not a rule and the deliberation adopting it is not a sanction. But it tells anyone who is paying attention how the regulator reads article 82 in this context, and the consent requirement it describes is not the CNIL's invention: it is article 82 and the GDPR definition of consent, both of which already bind. The optional part is the technical menu; the consent part is the statute.

That distinction is why "it is only a recommendation" understates the exposure. The CNIL published this text, adopted two weeks earlier, fourteen days after fining two companies a combined 7 million euros (EUR) under the same article, on reasoning about the same two exemptions, and attaching a penalty payment of 10,000 euros (EUR) per day to an injunction to start collecting consent. The Fnac Darty decision was about a recommendation-personalisation tracker rather than session replay, so it does not decide anything about session replay tools; what it shows is that the exemption analysis in this recommendation is the live, applied reading of article 82 in France, not a theoretical one. An operator weighing whether to treat the recommendation's technical annex as optional is weighing a different question from whether to treat the consent requirement as optional.

How This Affects You

For readers in France and operators of French-facing sites, the practical shape of the recommendation is general and does not depend on anyone's individual circumstances.

Operators of websites and mobile apps that serve visitors in France generally need consent before a session replay tool runs, collected through the same interface and to the same standard as other non-exempt trackers, rather than treating replay as part of a strictly necessary bundle. Because the CNIL asks for a session replay specific mention at the first level of the consent interface, a banner that only names a broad analytics category is unlikely to match what the regulator describes.

Vendors in this market generally need to be able to answer a procurement question they may not have been asked before: which of the masking, session-limitation, identifier and access-control features the annex describes does the product actually offer, what are its defaults, and can it delete an individual session on request.

Organisations that run session replay as part of employee-facing tools should note that workplace monitoring in France carries its own layer of consultation and proportionality requirements beyond article 82; those are set out in our guide to monitoring employees under French law.

For visitors, the CNIL's consumer page frames the position in rights terms: consent must be requested, and it must be as easy to refuse or withdraw as it is to give. Section 6.1 of the recommendation itself adds that users hold the GDPR rights guaranteed by articles 15 to 20, including access, rectification, erasure, restriction of processing and portability, over the recorded sessions.

This is general legal information, not legal advice. It describes the position in France under article 82 of the Loi Informatique et Libertés and the CNIL's recommendation of November 5, 2026, as verified on November 6, 2026. It does not describe US federal or state law, it is not a substitute for advice from a qualified lawyer in the relevant jurisdiction, and the law can change after the date above. Anyone making compliance decisions should consult counsel admitted in France or the relevant EU member state.

Related articles

• Privacy Law in France: CNIL, Cameras and Your Rights
• Employee Monitoring in France: Geolocation and Workplace Video
• France Data Privacy Laws: GDPR and CNIL Compliance Guide
• EU Cookie Law (ePrivacy Directive) Explained
• Cookie Consent Laws by Country
• Cookie Banner Requirements: US and EU Rules
• CNIL Fines Fnac Darty Over a Mobile App Tracker
• Is It Legal to Record a Conversation in France Without Consent

Last updated: 2026-11-06. This is a developing story; details verified as of 2026-11-06.

Frequently Asked Questions

Do session replay tools require consent in France?

Yes, according to the CNIL. In the recommendation adopted by Délibération n° 2026-114 of October 8, 2026 and published on November 5, 2026, the CNIL states that session replay tools operate through trackers and are subject to the prior consent of users under article 82 of Loi n° 78-17 of January 6, 1978, because neither of the two exemptions in that article applies. This is the French position only.

Why is session replay not covered by the strictly necessary exemption?

Article 82 exempts read and write operations that are strictly necessary for providing an online communication service expressly requested by the user. In section 5.1 of its recommendation the CNIL reasons that session replay fails that test because publishers could provide their services without it, and that the operations do not have the exclusive purpose of enabling or facilitating electronic communication either.

Is the CNIL recommendation legally binding in France?

No. The recommendation states in its introduction that it is not exhaustive and has no regulatory character, and that its purpose is to help professionals with compliance. The deliberation adopting it is not a sanction. The underlying consent requirement, however, comes from article 82 of the Loi Informatique et Libertés and from the GDPR, which do bind.

Did the CNIL set a deadline for compliance with the session replay recommendation?

The CNIL announced no compliance deadline and no transition period when it published the recommendation on November 5, 2026, and it announced no inspection or enforcement campaign. The only dated next step it published is an online webinar on November 17, 2026 at 11:00. It also said it will support professionals over the coming months and will carry out whatever checks it considers relevant if someone complains.

What does the CNIL recommend masking in a session recording?

The recommendation asks providers to offer a masking tool covering images, forms, text fields, dynamically filled fields such as account information, mouse movements and clicks on numeric keypads, and the content of exchanges with chatbots, with masking applied by default to every category when the tool is not configured. It also recommends blocking collection of passwords and banking information outright.

Does the recommendation apply to companies outside France?

The CNIL states that the recommendation applies to website and app publishers and to session replay providers established in France or elsewhere in the European Union, and also to those carrying out processing that concerns people located in the EU, under GDPR article 3, paragraphs 1 and 2. It does not address US law.

Has the CNIL ever fined anyone under article 82?

Yes. On October 22, 2026 the CNIL adopted Délibération n° SAN-2026-015, fining FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT a combined 7 million euros (EUR) for breaching article 82 of the Loi Informatique et Libertés, with an injunction to demonstrate consent collection within one month of notification and a penalty payment of 10,000 euros (EUR) per day of delay. That case concerned a mobile app tracker used for product recommendations, not a session replay tool, but the CNIL applied the same two exemptions in the same way.

Who is responsible when a session replay vendor reuses the data?

Under the recommendation, a provider that supplies the tool without reusing the data for its own purposes is a processor. A provider that uses the collected data for its own purposes, with the publisher's agreement, is a controller for that processing and a joint controller with the publisher for the underlying read and write operations. The CNIL adds that a contract clause placing the consent obligation on the publisher alone is not sufficient.