Using Microsoft Clarity in a GDPR-compliant way

Microsoft Clarity (clarity.ms) provides heatmaps and session recordings and transmits data to Microsoft (USA).

Is this a risk?

As with other session recording, § 25 (1) TDDDG applies: use only after prior consent. In addition, a data-processing agreement with Microsoft is required and the third-country transfer must be justified.

What you can do

• Classify Clarity in the consent-requiring category and load it only afterwards.
• Set masking to “strict” so that text and input are not recorded.
• Conclude a DPA; in the privacy policy, name Microsoft as recipient and the US transfer.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.