Yes, as long as you get consent before the tool starts.
According to the CNIL, fixing bugs, improving the experience or helping customers doesn't exempt you from asking. Then check what the script does before the click and after a refusal, because the banner won't show you.
The benchmark
The position comes from a CNIL draft recommendation, open for consultation from February 25 to April 22, 2026.
In early October 2026, the consultation page still announced a final version to come. The text ties session recording to Article 82 of the French Data Protection Act, which governs any reading or writing on a user's device.
We stumbled on this ourselves. When a site launched, one of us had added a recording tool next to an analytics setup configured to run without consent. "Are you sure that's GDPR-compliant?" someone asked.
Our colleague answered with another question: "Doesn't it normally need to depend on consent?" The draft says yes.
As we read it, the analytics exemption doesn't cover these tools: it requires producing only anonymous statistical data, and they "reconstruct individual browsing sessions."
The draft identifies three purposes and recommends a retention period for each:
| Purpose | Recommended retention |
|---|---|
| Customer support | A few hours after the session ends |
| Experience improvement | A few months, on the current version of the site |
| Technical error detection | A few months, on the current version of the site |
The rule
Nothing should be placed or recorded before the visitor clicks accept. The CNIL already penalizes this failure for cookies.
On November 20, 2025, the company that publishes vanityfair.fr received a €750,000 fine because cookies loaded as soon as the site opened and others kept being read after a click on "Reject all."
In September 2026, we listed the trackers on two stores we support, on a clean session and before any choice.
Six were already set on one and seven on the other, including those from the recording tools. The cleanup was estimated at 9 hours for the first and 11 for the second, or one to two development days.
The steps
- The wording. Give each purpose a short label and a one-sentence explanation, with a refusal as easy as acceptance. The CNIL offers sample wording, which you can reuse on the banner's second layer.
- The loading. Make the script wait until the visitor accepts and stop it on withdrawal. Keep what you need to demonstrate the mechanism, since the text only asks for proof of the process.
- The masking. Block all collection of passwords and banking details. In Clarity, the default mode, Balanced, masks numbers and email addresses in addition to input fields, so a name or order history shown in the customer account stays readable. Switch to Strict mode, or mask these areas one by one in Settings > Masking.
- The retention. Record the actual period in your register, which the provider sometimes sets for you: Clarity keeps recordings for 30 days, and up to 9 months for favorites and a sample.
- The contract. Sign a data processing agreement (GDPR Article 28) when the provider acts on your behalf. Microsoft declares itself a data controller for Clarity: say so in your privacy policy.
The trap
A refusal doesn't necessarily stop the tool. According to Clarity's documentation, when consent is refused, the tag still loads and keeps collecting, without a cookie.
The number of recordings goes up, since every page view becomes a session. Yet as we read the draft, the CNIL requires consent for recording, with or without a cookie. So make loading the tag depend on consent.
On Shopify, Clarity reads the choice saved by the platform's native banner. In the two stores we audited, the banner came from another provider and controlled the tag manager (GTM). Clarity, installed as an app, didn't go through it.
Our developer had labeled this point "doable, but GTM isn't enough" and recommended that the banner also pass the choice to Shopify.
The test to run
Open your site in a private window, without touching the banner.
In the browser's developer tools, you should find no cookie starting with _clck (Clarity) or _hjSession (Hotjar), and no request to clarity.ms or hotjar.com in the Network tab.
Then reject everything from the banner, visit two pages and look again. Here is the note to copy for your leadership, then rewrite with your findings:
"Before any click on the banner, our site already sets [N] trackers, including the recording tool's, and it keeps collecting after a refusal. The fix represents [one to two] development days. I propose scheduling it this month and having our DPO validate the setup."
This guide is not legal advice: have your data protection officer validate your setup.
