Session Replay

Session replay tools record user interactions with a website — clicks, scrolls, mouse movements, form inputs — and reconstruct those interactions as a video-like playback. Rather than recording raw video, they capture changes to the page's DOM together with user events, then replay the session client-side. This produces smaller file sizes than raw video, makes sessions searchable by behaviour or property, and enables client-side PII masking before data leaves the browser (as-of 2026-06-23, Quantum Metric).

The primary ecommerce value of session replay is diagnosing friction that never surfaces in aggregated funnel data or support tickets: less than 1% of shoppers report a problem they encounter on an ecommerce site (Noibu buyer research 2025), making replay the only viable method to see what happened. Baymard Institute positions replay alongside heatmaps and funnel analytics as tools that show what is happening but cannot explain why — paired qualitative research is required to complete the diagnosis.

How it works

Session replay tools inject a lightweight JavaScript snippet that listens for DOM mutations and user events (clicks, scrolls, keyboard inputs, touch events). Each event is timestamped and streamed — or batched — to the vendor's servers. On playback, the tool reconstructs the page state and overlays the event stream, producing a "video" that mirrors what the user saw.

Key technical constraints relevant to ecommerce:

• Hosted checkout and PSP redirects break the recording. Many session replay tools lose the trace at the payment step, where third-party iframes and redirect flows fall outside the instrumented domain — precisely where shoppers convert or quit (Noibu companion content, 2026-05-18).
• Sampling vs. 100% capture. Most SMB-tier tools (Hotjar, LogRocket free tier) capture a fraction of sessions, meaning high-value or edge-case sessions are statistically likely to be missed. Enterprise tools (Glassbox, Noibu, Quantum Metric) capture 100% of sessions. Up to 75% of sessions can be missed under monthly quota limits, based on G2 user reviews of constrained-tier tools (Noibu, 2026-05-18 — vendor-sourced; treat as directional, not audited).

Tool landscape (as-of 2026-06-23)

The 2026 market includes tools across three tiers. All pricing figures are volatile and vendor-sourced; verify before procurement decisions.

Free / self-hosted:

• Microsoft Clarity — completely free, no session cap, no paid tiers. AI-powered grouped session summaries (up to 250 sessions in July 2025 update), Shopify App (launched July 2025), event-type filtering within individual replays. Positioned for SMB to mid-market. Privacy: masks all text inputs by default (as-of 2026).
• PostHog and OpenReplay — open-source / self-hosted options providing full data sovereignty; PostHog bundles session replay with feature flags and product analytics.

Mid-market:

• Hotjar / Contentsquare — Hotjar Ltd. legally merged into Contentsquare Group on 1 July 2025. Existing Hotjar customers are migrating through 2026 into three separately priced Contentsquare product lines: Experience Analytics ($49/month), Voice of Customer ($99/month), and Product Analytics (custom pricing). Contentsquare's free plan post-merger includes 200,000 sessions/month (usercall.co, 2026-08-01 — vendor-adjacent; treat as directional). Hotjar samples recordings at most legacy price tiers.
• LogRocket — free tier: 1,000 sessions/month. Team plans from ~$69/month (annual). Focuses on technical error replay for engineering teams as much as UX; strong error correlation.
• Amplitude — from ~$49/month with a limited free tier; primarily product analytics with session replay as one component.
• Mouseflow — mid-market; masks all text inputs by default. Positions session replay as an investigative tool: "most valuable when you already know where a problem exists and want to understand why" (Mouseflow, 2026-06-19).

Enterprise:

• Contentsquare (post-merger) — enterprise analytics with zone-based heatmaps, journey analysis, AI session summaries, Conversation Intelligence (Loris integration). Strength: deep ecommerce analytics. Weakness noted: fragmented UX built through acquisitions (Quantum Metric, 2026-06-23 — competitor-authored). Case studies: Olaplex 31% conversion lift (vendor-reported, CX Circle NYC 2025); Specsavers 14% ecommerce purchase rate improvement (vendor-reported, 2025); New Look –34% PDP drop-off addressed via heatmap + journey analysis → 16 PDP tests (2025).
• FullStory — launched StoryAI in April 2025; acquired Usetiful (November 2025); launched Guides and Surveys (February 2026). Minimum mid-market pricing ~$28,000/year (as-of 2026, usercall.co). Free tier: 30,000 sessions/month. Event model built around SaaS product usage rather than ecommerce funnels — ecommerce teams must build the checkout-specific framing themselves (Noibu, 2026-05-18 — competitor-authored).
• Quantum Metric — enterprise AI platform; Felix Agentic AI investigates behavioural changes autonomously, including root cause and revenue impact. Custom pricing.
• Glassbox — targets regulated industries (financial services, healthcare); automatic PII, PCI, PHI, NPI masking; 100% capture with instant retrieval; CRM integration for record-level replay. Custom pricing.
• Noibu — positions itself as the only session replay tool purpose-built for ecommerce, with revenue-mapped error prioritisation and Help Code linking customer support calls to the exact live session replay in real time (Noibu, vendor-sourced, 2026-05-18).

Analyst rankings (as-of 2025-Q3): The Forrester Wave: Digital Analytics Solutions Q3 2025 is the first-ever Forrester Wave covering this market; Amplitude and Adobe are named Leaders; Quantum Metric is a Strong Performer. Full rankings are paywalled — free excerpts available via Amplitude and Quantum Metric landing pages. IDC MarketScape: Worldwide Customer Analytics Applications 2025 names Contentsquare a Leader (excerpt freely available via Contentsquare form).

How practitioners use it

Workflow sequencing (Mouseflow, 2026-06-19): heatmaps first to identify the anomaly at scale; session replay filtered to that anomaly to diagnose the cause; heatmap comparison after the fix to verify behaviour shifted. Session replay is the middle investigative step, not a monitoring layer.

The 15-minute morning habit: Contentsquare practitioners describe watching session replays for 15 minutes each morning as sufficient to surface actionable UX issues through consistency (CX Circle NYC 2025 — vendor guidance, no attached metric).

Hidden friction: rage clickers who still complete a purchase represent a silent experience failure — the transaction succeeds but the customer friction never surfaces in support tickets or sales data. Julian Charnas (Director of Digital Commerce, Harman/JBL): "We've seen some cases where people will rage click but still convert — we've actually focused on fixing those that would've otherwise been hidden, because the purchase goes through, but maybe they don't come back" (Noibu CX Circle, 2026 companion content).

Customer support integration: session replay tools with Help Code features allow support agents to link a live customer call to the exact replay in real time. David's Bridal CDO Yoav Shargil: "With the Help Code, [virtual stylists] can see the exact session of the customer they're helping in real time and see exactly what the customer is seeing" (Noibu, 2026 companion content).

AI augmentation (2026 direction): Contentsquare's AI Session Replay Summaries can summarise up to 100 sessions at once. Quantum Metric's Felix AI autonomously investigates what changed in user behaviour, why it changed, who was impacted, and what it cost in revenue. Contentsquare launched an MCP server to connect session insights to external AI tools, and Conversation Intelligence connecting session replay data to customer service interactions (Contentsquare, 2026).

Ecommerce context

Contentsquare's 2026 Digital Experience Benchmark (99 billion sessions, 6,500+ websites, Q4 2025 data):

• Overall conversion rates fell –5.1% year-on-year; average order value rose +6% (as-of Q4 2025)
• Returning visitors convert at 2.9% vs 1.7% for new visitors; returning visitors represent 52.8% of all traffic (as-of Q4 2025)
• Desktop conversion rate was 74% higher than mobile; mobile accounts for 69.9% of all traffic (as-of Q4 2025)
• AI-referred traffic grew +632% YoY but accounts for only 0.2% of total traffic in Q4; its conversion rate rose +55% YoY to 1.3% — the only channel showing conversion growth (as-of Q4 2025)
• Organic search traffic fell –9% YoY as AI Overviews deliver answers without clicks (as-of Q4 2025)
• Frustration signals across all sites dropped –4.3% (retail specifically –6%) — cited as evidence that brands are actively removing experience friction (as-of Q4 2025)
• API errors rose +16% YoY — identified as an emerging frustration source as digital experiences depend on third-party integrations (as-of Q4 2025)

Baymard Institute frames the implication: the average large-scale ecommerce site can increase checkout conversion by 35% through UX improvements alone, without changing pricing, products, or marketing — making session-replay-informed UX research a direct revenue lever (Baymard, undated evergreen methodology page, 2026 copyright).

GDPR and privacy compliance

Session replay captures personal data under GDPR Article 4(1), including form inputs, chat messages, URL parameters containing user IDs or reset links, dynamically rendered account content, and behavioural mouse-movement patterns that can identify individuals without names (JustAnalytics, 2026-05-14).

CNIL draft recommendation (France, 2026): The French data protection authority opened a public consultation on a draft recommendation for session replay tools on 25 February 2026; the consultation closed 22 April 2026. The final recommendation had not been published as of 2026-08-05.

Key provisions of the CNIL draft (Clifford Chance analysis, 2026-03-06):

• UX optimisation, technical troubleshooting, and customer support do NOT qualify as "strictly necessary" purposes under ePrivacy Article 5(3); prior user consent is the default rule
• Passwords and payment data must be blocked by default in all session replay configurations
• Retargeting is an explicitly prohibited purpose for session replay data
• Blanket/100% recording is disfavoured — sampling or trigger-based collection is expected
• Retention periods: a few hours post-session for support use; a few months for UX or error analysis
• Role-based access controls and data minimisation are required
• Session replay must be disclosed at the first layer of the Consent Management Platform (CMP) — not buried in a secondary privacy policy
• Controllers must define purposes before deploying the tool; retrospective justification is not permitted

CNIL enforcement track record: 83 sanctions totalling €486.8 million in 2025, with cookies and tracking as stated enforcement priorities (Clifford Chance citing CNIL, 2026-03-06). The CNIL draft "sets out what will likely become the CNIL's enforcement benchmark" (Clifford Chance, 2026-03-06).

Lawful basis for session replay under GDPR Article 6 (JustAnalytics, 2026-05-14):

• Consent (Article 6(1)(a)): requires a separate explicit opt-in distinct from the cookie banner. Expected opt-in rates 15–30%; can be as low as 8% on aggressive-banner sites.
• Legitimate interest (Article 6(1)(f)): requires a documented Legitimate Interest Assessment; only defensible if masking genuinely minimises data.
• Contract performance (Article 6(1)(b)): described as "a stretch for most cases."

PII masking: Client-side masking (PII replaced before leaving the browser) is preferable to server-side masking — server-side masking still constitutes processing the PII under GDPR even if subsequently deleted (JustAnalytics, 2026-05-14). PCI DSS prohibits storing cardholder data in session replay recordings; tools requiring manual masking configuration should be assumed to be recording card numbers until explicitly tested.

US wiretap risk: LogRocket and FullStory have faced wiretap lawsuits under California's Invasion of Privacy Act (CIPA); Old Navy reportedly paid $1.4M to settle a class action in 2024 related to session replay recording (JustAnalytics, 2026-05-14 — vendor-authored; Old Navy figure is described as "reportedly"). Hundreds of CIPA cases have been filed over the past three years against websites using session replay tools (as-of early 2026).

Recommended GDPR-aligned data retention: 30 days as a default (JustAnalytics, 2026-05-14).

Key terms

Term	Meaning
DOM capture	Recording changes to the page's Document Object Model rather than raw video pixels; enables smaller files and behavioural search
PII masking	Redacting personally identifiable information before it is recorded or transmitted; can be client-side (preferred) or server-side
100% capture	Recording every user session rather than a statistical sample; required for reliably catching low-frequency but high-impact events (e.g. checkout errors on mobile Safari)
Rage click	Rapid repeated clicking on a non-interactive element; a frustration signal surfaced by session replay
Help Code	A session replay feature (Noibu) linking a live support call to the customer's exact current replay in real time
PSP redirect	Payment Service Provider redirect flow (e.g. 3DS authentication); typically breaks session replay capture because the user leaves the instrumented domain
Sampling	Capturing only a percentage of sessions; common at lower pricing tiers; creates risk of missing the edge cases most worth investigating

Benchmarks (as-of 2026-08-05)

All figures from Contentsquare 2026 Digital Experience Benchmark (99B sessions, Q4 2024 vs Q4 2025) unless noted:

Metric	Value	Source
Overall ecommerce conversion rate YoY	–5.1%	Contentsquare DXB 2026
Returning visitor conversion rate	2.9%	Contentsquare DXB 2026
New visitor conversion rate	1.7%	Contentsquare DXB 2026
Mobile share of traffic	69.9%	Contentsquare DXB 2026
Desktop conversion rate premium vs mobile	+74%	Contentsquare DXB 2026
AI-referred traffic growth	+632% YoY	Contentsquare DXB 2026
AI-referred conversion rate	1.3% (+55% YoY)	Contentsquare DXB 2026
Organic search traffic YoY	–9%	Contentsquare DXB 2026
Frustration signals (all industries)	–4.3% YoY	Contentsquare DXB 2026
Frustration signals (retail)	–6% YoY	Contentsquare DXB 2026
API errors YoY	+16%	Contentsquare DXB 2026
Checkout conversion improvement potential	35%	Baymard Institute (undated, 2026 copyright)
GDPR consent opt-in rate for session replay	15–30% (as low as 8%)	JustAnalytics, 2026-05-14