See when session-replay technology appears on a website
By CertScore.ai
Identify observable session-replay service signals, inspect the retained evidence, and give your privacy review a clearer starting point.
Session-replay tools can help teams understand website journeys. Privacy reviewers need to know where these services appear and what the evidence actually shows.
CertScore.ai surfaces observable session-replay service signals and preserves supporting page, service and request context where available. A recognized service is a starting point for review; it does not prove that visitor sessions or field values were recorded.
Nearly 1 in 8 analyzed websites showed a replay-service signal
Across 5,000 selected production scans, 3,199 distinct destination domains had usable evidence. CertScore.ai observed a session-replay service signal on 383 of them — 12.0%. Microsoft Clarity appeared on 265 of the 383 replay-positive domains (69.2%).
This is a production convenience sample, not a measure of the entire web. The 1,756 executions with unknown or insufficient evidence were excluded, not counted as negatives.
Primary sources:Read the original study and methodology
Start with the observed evidence
Review the recognized service and its retained evidence in the scan report. Known product-specific requests may include a library download; a request alone does not establish recording or successful transmission.
Tracking & embeds
Service signalSession replay service signal observed
- Example service
- Example replay service
- Evidence source
- Retained product-specific network request
What this evidence would establish
A recognized replay-service request tied to the measured page. It may be a library download.
It would not establish active recording, captured inputs, a successful transmission or a consent violation.
Put form context beside the service signal
In the study, 191 of 380 replay-positive domains with evaluable form evidence had a form or input surface on the same measured page (50.3%). The corresponding figure among evaluable domains without an observed replay signal was 1,331 of 2,781 (47.9%).
These descriptive results do not establish an unusual association. Co-presence does not establish that field values were entered, transmitted to the replay service or recorded.
A practical review workflow
A bounded scan can miss services that load later, require interaction or are not recognized. “Not observed” does not mean “not installed.” Findings guide review; they do not determine legal compliance.
- 1Run a public website scan and review the observed services and retained evidence.
- 2Check the page context and any available Forms & fields evidence. Keep separate visits and pages distinct.
- 3Ask the site owner to verify replay configuration, masking, consent settings and relevant disclosures. Retest after configuration changes.
Try it
See what appears on your website
Explore the cookies, trackers, consent behavior, session-replay signals and other privacy evidence CertScore.ai can observe from the public web.
Loading scan form…
Start with a free scan of one public page. Results describe the scan’s conditions and coverage.