FranceLégifrance
CNIL adopts recommendation on session-replay tools
Délibération 2026-114 of 8 October 2026 adopts a GDPR guidance text on tools replaying full user navigation; neither prescriptive nor exhaustive, published in the JORF of 5 November 2026.
By Taxxa AI OyPublished 6 November 2026
Industry: Across industries
The Commission nationale de l'informatique et des libertés (CNIL) has adopted a recommendation on session-replay tools. Délibération n° 2026-114 du 8 octobre 2026Legifrance adopts the recommendation annexed to the act (article 1er)
Legifrance and provides for its publication in the Journal officiel de la République française (article 2); the annex points to the authenticated electronic JORF, n° 0259 du 5 novembre 2026, for the full text. The act was taken on the report of Mme Laurence Franceschini, commissaire, after hearing the observations of M. Damien Milic, commissaire du Gouvernement, and cites as its legal bases the règlement (UE) 2016/679 du 27 avril 2016 (règlement général sur la protection des données) and the loi n° 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés, notably its article 8-I-2°.b.
The recommendation concerns outils de rejeu de session: tools that capture and display the complete navigation path of a website or mobile-application userLegifrance. They make it possible to reconstruct all navigation actions — mouse movements, clicks or tactile interactions, scrolling of visited pages or screens, user inputs and other interactions. They serve specific needs, as a replacement for or complement to more classic tools such as audience-measurement instruments.
The stated objective is to help professionals bring their practices into compliance with the RGPD. The text aims to clarify the applicable legal requirements and to frame these practices better, so as to promote processing that respects individual freedoms. Two qualifications define its status: it is neither prescriptive nor exhaustiveLegifrance. It was prepared following consultation with representatives of the sector and associations representing civil society, and it was put to public consultation between February and May 2026.
For organisations — or their service providers and advisers — that run session-replay or analytics tools on websites or applicationsLegifrance, the operational consequence is a reading task against a dated source: retrieve the annexed recommendation as published in JORF n° 0259 du 5 novembre 2026
Legifrance, identify which of the deployed tools capture the navigation actions it describes, and use its clarifications to check the corresponding processing. Because the text presents itself as neither prescriptive nor exhaustive, it serves as a compliance aid for the described practices, not as a complete statement of every obligation a given deployment may carry under the RGPD and the loi du 6 janvier 1978
Legifrance.
Legal basis: CNIL délibération n° 2026-114 du 8 octobre 2026, adopted under the règlement (UE) 2016/679 and the loi n° 78-17 du 6 janvier 1978 (article 8-I-2°.b), recommendation published in JORF n° 0259 du 5 novembre 2026.
Retrieve the recommendation annexed to CNIL délibération 2026-114 as published in JORF n° 0259 of 5 November 2026 and check the session-replay tools deployed on your sites or apps against its clarifications.