Open navigation menu
Session replay risk: what website owners should review
Find session-replay services that deserve a closer look, then review consent gating, sensitive-page exclusions and masking with the implementation owner. CertScore.ai provides the vendor and page evidence to start that investigation.
By CertScore.ai · Updated
Website privacy scanner. See the evidence.
Review cookies, trackers, consent behavior and privacy disclosures. Give your DPO, agency or developer retained evidence for GDPR/ePrivacy and CCPA review.
1. Identify the service and page
Open the retained vendor, script or request evidence and note when it appeared. A service signal may be a library download; it does not establish that recording was enabled.
2. Review sensitive-page settings
Check masking, excluded fields, page suppression and consent settings in the replay tool. Give the owner the affected page and report reference. A form elsewhere in the scan is not evidence that the replay service appeared on that form’s page.
3. Retest after the configuration change
Repeat the scan with the same page and region. Compare service timing and available choice-path evidence. Review the tool’s internal configuration separately, since a public-page scan cannot establish every masking or recording setting.
Read the original research
The session-replay study distinguishes service detection from verified same-page form context. Neither observation proves that visitor inputs were entered, transmitted or recorded.
Sources & further reading:Session-replay study and measurement limits
Sample finding JSON from scans
Supporting JSON examples for the finding types discussed on this page. Each example identifies its source; examples do not describe the website you are reviewing.
Session replay service signal observed
session_recording_services_detected
Illustrative public evidence sample
Session replay service signal observed
session_recording_services_detected
Illustrative public evidence sample
{
"finding_id": "session_recording_services_detected",
"finding_label": "Session replay service signal observed",
"category": "Third-party tracking",
"criticality": "high",
"evidenceConfidence": "review_signal",
"directVsInferred": "direct_observation",
"observed": "Retained runtime evidence showed a script, request, or vendor pattern associated with session replay, heatmaps, recording, or behavior analytics in the observed public-page scope.",
"evidence": {
"summary": "Retained runtime evidence showed a script, request, or vendor pattern associated with session replay, heatmaps, recording, or behavior analytics in the observed public-page scope.",
"examples": [
{
"title": "Session replay service signal",
"lines": [
"artifact=req_005",
"role=finding_supporting_artifact",
"url=https://example.com/",
"request_origin=https://replay.example",
"request_path=/recorder.js [query_redacted=true]",
"resource_type=script",
"vendor_category=session_replay_or_behavior_analytics",
"detected_pattern=replay_library_or_collection_endpoint",
"consent_timing_context=manual_review_recommended",
"review_caveat=manual review should confirm active collection, masking, sampling, consent state, page exclusions, and vendor configuration"
]
}
],
"automationLimits": [
"Automated replay evidence does not determine keystroke capture, sensitive-value capture, visual capture, full recording retention, or legal status.",
"Manual review is needed to confirm active collection, masking, sampling, consent state, payload contents, and page exclusions."
]
},
"evidenceVersion": "2.0",
"scanContext": {
"domain": "example.com",
"requestedUrl": "https://example.com/",
"finalUrl": "https://example.com/",
"publicWebObservation": true,
"legalConclusion": false
},
"artifacts": {
"runtimeAnchors": [],
"requestSamples": [],
"cookieOrStorageSamples": [],
"policyAnchors": [],
"rawValuesRetained": false
},
"classification": {
"section": "Review signal",
"criticality": "high",
"evidenceConfidence": "review_signal",
"directVsInferred": "direct_observation",
"legalStatusDetermined": false
},
"coverage": {
"coverageFlags": [],
"coverageReliableForTopRanking": true,
"notDetectedMeans": "not_observed_in_scan_scope",
"manualReviewNeeded": true
},
"topFindingCalibration": {
"minimumToSurface": [
"Replay-related script/request/vendor artifact."
],
"highConfidenceRequires": [
"Endpoint or service classification plus page/timing/vendor context."
],
"criticalOrTopRankingRequires": [
"Collection endpoint.",
"Sensitive page.",
"Pre-consent/post-reject.",
"No masking/exclusion observed."
],
"demoteOrSuppressWhen": [
"Vendor name only.",
"Generic analytics.",
"Policy text only."
]
},
"automationLimits": [
"Automated public-web observations do not determine legal status, compliance status, proof that a law was breached, proof of data capture, or tracking lawfulness.",
"Manual review is needed to confirm purpose, necessity, jurisdiction, configuration, exemptions, and remediation quality."
],
"redaction": {
"rawIdentifiersRetained": false,
"storageValueContentsRetained": false,
"completeQueryStringsRetained": false,
"requestBodiesRetained": false,
"renderedPageImagesRetained": false,
"sourceMarkupRetained": false,
"userEnteredValuesRetained": false
},
"selectionReason": "Illustrative public sample selected to show retained evidence, directness, limits, and top-finding calibration.",
"sessionReplayEvidence": {
"replayArtifactObserved": true,
"replayCollectionEndpointObserved": "unknown",
"maskingOrPageExclusionObserved": "not_determined",
"captureOrRetentionDetermined": false,
"manualReviewNeeded": true
}
}Related CertScore.ai pages
Website privacy scanner. See the evidence.
Review cookies, trackers, consent behavior and privacy disclosures. Give your DPO, agency or developer retained evidence for GDPR/ePrivacy and CCPA review.