Using Microsoft Clarity in a GDPR-compliant way

Microsoft Clarity (clarity.ms) provides heatmaps and session recordings and transmits data to Microsoft (USA).

The fact that Clarity is free does not change the legal situation: session recording and heatmaps capture the behaviour of individual visitors and therefore clearly require consent. According to its own statements, Microsoft also uses the aggregated data for its own purposes — this makes classifying it as pure processing on behalf debatable, and the clean DPA plus the check for joint controllership all the more important.

The most important technical lever is masking. If it is set to “Balanced” or “Relaxed”, plain-text input and page content can end up in the recordings — including inadvertently visible personal data of third parties. “Strict” masks all text and input and is the data-frugal default setting.

The same applies to the US transfer as for other Microsoft services: via the EU-US Data Privacy Framework, the transfer to Microsoft is in principle safeguarded as long as the certification exists. This belongs in the privacy policy as the transfer basis.

Clarity can be linked with Google Analytics and with Microsoft Advertising. These integrations widen the purpose: from pure behaviour understanding it becomes a data basis for advertising analysis and optimisation. Anyone who activates the link has to reflect the extended purpose in the consent and the privacy policy — consent obtained as “statistics” does not cover advertising purposes.

In practice, Clarity can be limited via the project settings: recordings can be restricted to certain areas by URL rule or excluded from sensitive pages (login, account, checkout), and individual elements can be controlled specifically via data-clarity-mask / data-clarity-unmask. The less is recorded, the easier the justification.

Is this a risk?

As with other session recording, § 25 (1) TDDDG applies: use only after prior consent. In addition, a data-processing agreement with Microsoft is required and the third-country transfer must be justified.

What you can do

• Classify Clarity in the consent-requiring category and load it only afterwards.
• Set masking to “strict” so that text and input are not recorded.
• Conclude a DPA; in the privacy policy, name Microsoft as recipient and the US transfer.

Häufige Fragen

Can Microsoft Clarity be used without a cookie banner?

No. Clarity sets cookies and records behaviour — that requires consent under Section 25(1) TDDDG. Without active consent the script must not load.

Do I need a data processing agreement for Clarity?

Yes. Microsoft provides the contractual terms; they should be documented and noted in the record of processing. Since Microsoft partly uses the data for its own purposes, it should also be checked whether joint controllership exists.

Which masking level should I choose?

“Strict”. This masks all text and form input in the recordings, which significantly reduces the risk of inadvertently captured personal data.

How does Clarity differ from Google Analytics in terms of the GDPR?

Both require consent. Clarity additionally captures concrete session sequences (mouse movement, clicks, scrolling), which intrudes more deeply into privacy than GA4's aggregated reach measurement.

How long does Microsoft Clarity store the data?

Microsoft states a retention of the recordings and heatmap data of around 30 days, after which they are deleted or aggregated. The specific period and the processed data categories still belong in the privacy policy.

Can Clarity load only on certain pages?

Yes, and that is advisable. Via URL rules in the Clarity project, recording can be restricted to non-critical pages and excluded from login, account and checkout pages. This significantly reduces the risk of inadvertently captured personal data.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.