Online Tracking Technologies (Session Replay & Fingerprinting) Compliance Check

Why this matters

Most businesses treat “cookie compliance” as a solved problem once a consent banner is installed, but the Privacy and Electronic Communications Regulations (PECR) actually cover any technology that stores or accesses information on a user’s device — not just cookies. Session replay tools, heatmap trackers, device fingerprinting scripts, tracking pixels embedded in emails, and CNAME-cloaked first-party trackers all fall under Regulation 6 and generally require the same informed consent as a cookie. The Information Commissioner’s Office has run a sustained programme of audits and warning letters targeting the UK’s most-visited websites over their use of these technologies, and its updated online tracking guidance makes clear that consent must be as easy to refuse as to accept, that pre-ticked or bundled consent for analytics and marketing tools is not valid, and that fingerprinting techniques used to circumvent cookie consent altogether are a direct compliance risk.

Session replay and heatmap tools are a particular blind spot because they can capture far more than businesses realise: mouse movements, keystrokes, and on-screen content including, in poorly configured setups, form fields that were never meant to be recorded such as passwords, card numbers, or health information typed into a support chat. Where that content amounts to personal data, or special category data, it triggers UK GDPR obligations on top of PECR — including a lawful basis, appropriate technical masking, and inclusion in the record of processing activities — regardless of what the cookie banner says. Any UK business running analytics, marketing pixels, replay/heatmap software or A/B testing scripts should check what those tools actually capture and how consent is obtained, rather than assuming a compliant-looking cookie banner covers everything running on the page.

What you'll need

• Which tracking, analytics, heatmap, session replay or fingerprinting tools are installed on your website
• Whether your cookie/consent banner covers every tracking technology in use, not just cookies
• Whether any tool could capture form inputs, keystrokes, or on-screen content
• Whether tracking scripts load before or only after a user gives consent
• Whether you use any first-party or CNAME-cloaked tracking domains

What you'll get

A personalised compliance report covering: a score out of 100, an executive summary, a list of findings ranked by severity, and a prioritised action plan with timeframes.