Documentation Grafana Cloud Observe and act Monitor applications Frontend Observability Session replay Data privacy

Data privacy in Session Replay

Understand how Session Replay handles data privacy, who can access session recordings, and how to configure Session Replay to help meet your organization’s privacy requirements and comply with regulations such as GDPR, ePrivacy, and CCPA.

Session Replay is built on the Faro Web SDK and shares its session lifecycle, storage, and transport. Everything documented in Data privacy in Frontend Observability and Comply with CNIL requirements for Frontend Observability applies to Session Replay as well. This page describes what Session Replay adds on top of Faro: the additional data captured for recording, where those recordings are sent, who can access them, and the additional privacy considerations that come with recording user sessions.

What data Session Replay sends

Session Replay sends a structured representation of the browser session, not a video or pixel recording. It sends:

• DOM snapshots and mutations: The initial structure of the page when recording starts, plus incremental changes such as added or removed nodes and attribute and text changes. This includes rendered text content, subject to any masking that you apply.
• User interactions: Pointer movements, clicks, scrolls, viewport resizes, and input events. Input values are masked by default.
• Page URLs and navigation events: Full URLs, including path and query string. Personally identifiable information (PII) in URLs is not masked by default.
• Session metadata: Session ID, recording ID, app name, timestamps, and stack and organization identifiers used to correlate the recording with your other Faro telemetry.

Session Replay doesn’t capture:

• Video or audio content.
• Network request and response bodies, which are handled by separate Faro instrumentation.
• Console logs, which are handled by separate Faro instrumentation.
• Browser extensions or bookmarks.

Other data that might be recorded

Besides form inputs, which are masked by default, recordings can include:

• Page URLs: Including query strings, which might contain identifiers or user-specific parameters such as tokens, session IDs, or user IDs. URLs aren’t masked by default. Before you enable Session Replay, review your application’s URL structure and avoid placing sensitive values in query strings.
• Rendered text: All visible text on the page is masked by default through maskTextSelector: '*'. If you relax this setting, page copy, labels, and other text appear in replays.
• Input placeholder text: The placeholder attribute on form fields isn’t masked. Avoid using real personal data such as example email addresses or names as placeholders.
• DOM structure: The full structure of the page as the browser renders it, which might reflect logged-in state, feature flags, or account-specific content.
• Canvas content, cross-origin iframes, and inline images: Not captured by default. Each requires explicit opt-in through configuration.

Bookmarks and media content such as audio and video are not captured.

Prevent sensitive data from being recorded

You can control what Session Replay records using the following mechanisms:

• Default masking: All input values and text content are masked client-side, before anything leaves the browser. No configuration is required.
• SDK configuration: Use the maskTextSelector, blockSelector, maskInputOptions, and ignoreSelector options to tighten or customize masking. Refer to Privacy and masking options for the full reference.
• beforeSend hook: Use the beforeSend hook to filter or transform events programmatically before they’re sent. Return null to drop an event entirely.
• Disable Session Replay: Session Replay is off by default. It must be explicitly enabled per Grafana Cloud stack and then instrumented in your application. Refer to Turn Session Replay on and off.

Who can access session recordings

Session Replay events are sent to the Grafana Cloud stack you configure in the Faro Web SDK. Access to recordings is controlled the same way as access to any other data in that stack:

• Users in your organization: Access is controlled through Grafana authentication, team membership, and role-based access control (RBAC). For details on restricting recording access to specific users or teams, refer to Session Replay role-based access control.
• Grafana Labs staff: Can access recordings through internal administrative tooling for the purposes of operating and supporting the service, subject to Grafana Labs’ security and privacy practices.

Session Replay data isn’t shared with third parties and isn’t combined with marketing or advertising systems.

Data retention

Session recordings are retained for 30 days, aligned with the default retention for Grafana Cloud logs and traces. Retention isn’t currently configurable for Session Replay.

Legal basis and consent

Session Replay operates as a client-side instrumentation inside your own web application, so the legal basis for recording end-user sessions, and any consent required, is your responsibility.

Attest to compliance

By enabling Session Replay for your Grafana Cloud stack and instrumenting it in your application, you attest that:

• You have identified the legal basis, such as consent or legitimate interests, for recording end-user sessions in the jurisdictions where your application is used.
• You have informed your end users about session recording in your privacy notice or consent banner.
• You have complied with applicable law and obtained any consent required before implementing Session Replay and before recording begins.
• You have configured masking, sampling, and other Session Replay controls to minimize the data recorded to what’s necessary for your purpose.

Permitted and prohibited uses

Session Replay is intended for internal operational purposes only:

• Debugging: Understanding user interface (UI) issues that aren’t visible or are only partially visible through backend telemetry.
• Incident response: Investigating customer-reported or internally detected UI problems.

Don’t use Session Replay for purposes prohibited by applicable law, such as profiling for advertising, tracking end users, or any use that violates your end users’ data protection rights.

Consent requirements by jurisdiction

Different jurisdictions have different requirements for tracking technologies like Session Replay. The following is a non-exhaustive overview and not intended as legal advice. Consult with your legal counsel on your implementation compliance obligations.

• Opt-in jurisdictions: In jurisdictions that require opt-in consent, such as the European Economic Area, Switzerland, the United Kingdom, and South Korea, Session Replay must be off by default and only turned on after the end user consents, such as through a cookie banner. It must be turned off again if the end user withdraws consent.
• Opt-out jurisdictions: In jurisdictions that allow opt-out models, Session Replay can be on by default, but end users must have the ability to opt out at any time.
• All jurisdictions: When you present Session Replay in a cookie banner or consent management platform (CMP), categorize it as an analytics tracker.
• Opt-out controls: Ensure you have a method for users to opt out of tracking, such as a Privacy Choices link in the footer of your webpage.

Turn Session Replay on and off

Turning Session Replay on or off is a two-layer decision: the stack-level setting controls whether Grafana Cloud accepts Session Replay data at all, and the SDK instrumentation controls whether your application produces any.

Stack-level (Grafana Cloud)

Session Replay is disabled by default. It must be enabled per Grafana Cloud stack.

• To turn it on for a stack: Open a Grafana Support ticket listing the Grafana Cloud stacks you’d like to enable Session Replay on.
• To turn it off for a stack: Open a Grafana Support ticket asking to disable Session Replay for the listed stacks. Existing recordings remain accessible for the remainder of the 30-day retention window and are then automatically deleted.

Application-level (SDK)

After Session Replay is enabled for your stack, recordings are only produced by applications that include the @grafana/faro-instrumentation-replay package in their Faro Web SDK configuration.

• To turn it on for an application: Install the @grafana/faro-instrumentation-replay package and pass a ReplayInstrumentation instance to initializeFaro. Refer to Instrument Session Replay.
• To turn it off for an application: Remove ReplayInstrumentation from the instrumentations array in your initializeFaro call and redeploy your application. Sessions started after the redeploy aren’t recorded. Recordings from previous sessions follow the 30-day retention window.

Integrate Session Replay with your cookie banner

If applicable law requires you to obtain user consent before recording sessions, integrate Session Replay with your existing cookie banner or consent management platform (CMP).

Categorize Session Replay in your banner

Categorize Session Replay as an analytics tracker in your cookie banner. Describe it accurately based on What data Session Replay sends. For example: “We record a structured playback of your interactions with this application, such as pointer movements, clicks, and page navigations, so we can debug UI issues and investigate issues with our website and systems.”

Load Session Replay only after consent

In jurisdictions that require opt-in consent, conditionally initialize Faro with Session Replay only after the end user consents. This is the same pattern documented for Frontend Observability in CNIL compliance:

JavaScript Copy

if (userHasConsentedToAnalytics()) {
  const { getWebInstrumentations, initializeFaro } = await import('@grafana/faro-web-sdk');
  const { ReplayInstrumentation } = await import('@grafana/faro-instrumentation-replay');

  initializeFaro({
    url: 'YOUR_GRAFANA_CLOUD_URL',
    app: {
      name: 'your-app-name',
      version: '1.0.0',
    },
    instrumentations: [...getWebInstrumentations(), new ReplayInstrumentation()],
  });
}

Replace userHasConsentedToAnalytics() with the API from your consent management platform or your own consent logic.

Stop Session Replay when consent is withdrawn

The same guidance as Faro applies: reload the page so the Faro Web SDK—including Session Replay—isn’t initialized again. Existing recordings in Grafana Cloud follow the 30-day retention window and are then automatically deleted. Refer to Handle consent withdrawal in the Faro CNIL compliance guide for details.