Session replay signals appeared on nearly 1 in 8 websites we analyzed
By CertScore.ai · Updated
Across 5,000 production scans, 3,199 distinct destination domains had usable evidence. Of those, 383 showed an observable session-replay service signal.
12.0%
383 / 3,199 analyzed domains
An observable replay-service signal. A service signal does not prove active recording or capture of visitor inputs.
1,756 executions with unknown or insufficient evidence were excluded, not treated as negatives.
What we found
12.0%
showed a replay-service signal
383 of 3,199 distinct domains with usable evidence. This describes the analyzed sample, not the entire web.
69.2%
of replay-positive domains included Clarity
Microsoft Clarity appeared on 265 of 383 replay-positive domains, making it the most commonly observed service in this sample.
50.3%
also had a form or input surface
191 of 380 evaluable replay-positive domains. The comparison was 47.9% without an observed replay signal; this does not establish an unusual association.
Services observed
Microsoft Clarity was the most commonly observed service, followed by Hotjar. These are canonical service identities, not parent-company market shares.
- Microsoft Clarity265
- Hotjar116
- Contentsquare18
- FullStory8
- Quantum Metric5
Forms and input surfaces: useful context
About half of replay-positive pages with evaluable form evidence also contained a form or input surface during the observed visit. The inventory includes search fields and controls outside native forms.
Form/input co-presence in the analyzed sample
Co-presence does not establish that field values were entered, transmitted to the replay service or recorded.
What CertScore.ai actually detects
CertScore.ai recognizes known replay-service evidence in a bounded public-page visit. For this study, each positive required a retained canonical service identity and a product-specific network request tied to the measured page. Requests can include library downloads or unsuccessful requests.
The public finding is a service signal. It does not establish a recorded session, keystroke capture, form submission capture or a GDPR/CCPA violation. Reviewers still need to check the website’s configuration, masking and disclosures.
Tracking & embeds
Service signalSession replay service signal observed
- Example service
- Example replay service
- Evidence source
- Retained product-specific network request
What this evidence would establish
A recognized replay-service request tied to the measured page. It may be a library download.
It would not establish active recording, captured inputs, a successful transmission or a consent violation.
Methodology
We selected the latest 5,000 production bot executions before October 1, 2026 at 08:30 UTC. Execution creation times ranged from September 18, 2026 at 18:30:48 UTC to October 1, 2026 at 08:27:40 UTC. All ran from California (us-west-1); that describes the scanner’s location, not a website’s jurisdiction.
- Selected production executions
- 5,000
- Completed executions
- 4,988
- Usable representative passive executions
- 3,244
- Unknown / insufficient executions — excluded
- 1,756
- Distinct usable destination domains
- 3,199
The 1,756 excluded executions include the 12 that did not complete and 1,744 completed executions without usable evidence.
We used the most recent usable visit per destination registrable domain, with Public Suffix List private suffixes enabled. Redirects were attributed to the observed destination. This is a production convenience sample, not a random or representative sample of the web. We report descriptive proportions rather than population confidence intervals or significance tests, which would not account for this sample’s selection and coverage limitations.
Retained runtime evidence was verified against its artifact identity, byte size and hash. Only representative pages with usable passive runtime coverage entered the primary analysis. Failed or insufficient visits remained unknown. Services were deduplicated by canonical identity within each domain.
The analysis covered five service families classified by CertScore.ai as session replay: Microsoft Clarity, Hotjar, Contentsquare, FullStory and Quantum Metric. This does not measure every product capable of session replay. Passive observations do not measure consent-gating effectiveness or after-consent-only deployment.
Form evidence required a hash-bound inventory from the same runtime lane and page. Limited inventories could support retained positive observations; missing controls under limited coverage were not proof of absence. Evaluable form evidence was unavailable for 3 of 383 replay-positive domains and 35 of 2,816 domains without an observed replay signal. Both groups were excluded from the form comparison, leaving denominators of 380 and 2,781.
Measurement checks and field classification
The launch figures were reproduced offline from the retained research export and cross-checked against domain, service and form tables. Manual agent spot-checks informed the research audit; they are not an independent human validation study.
A field-classification audit found a birthday-themed option incorrectly categorized as a date-of-birth field. We do not publish the combined sensitive-field aggregate. Removing all date-of-birth labels leaves the replay prevalence, service counts and forms result unchanged.
How to read these results
- These are CertScore.ai bot visits, not representative human browsing sessions. Results can vary by time, page, region and interaction.
- Observation is bounded and detection depends on recognized services and retained evidence. “Not observed” does not mean “not installed.”
- A service signal does not prove recording or collection of field values. A form on the same page is context, not evidence of capture.
- Results are descriptive. They establish neither legal compliance nor non-compliance.