Session Replay and Privacy Concerns
Session replay lets you see exactly what each user does with your site: where they click, what they type, where they scroll. This is powerful but raises serious privacy concerns.
The key question: Is recording user behavior a privacy violation? It depends on what you record and how you protect it.
Core Privacy Principles in Session Replay
1. Data Minimization
Only record what you actually need. If you don't need form data, mask it. If you only want to see clicks, there's no need to record typed text.
2. Transparency
Inform users that their behavior is recorded. Usually done with a small cookie banner or footer link.
3. Consent
Under many regulations (like GDPR), you need user consent before recording behavior. For Iranian websites, specific laws may vary, but following ethical guidelines is recommended.
4. Data Security
Recorded data should be encrypted and only accessible to authorized personnel.
What Data Should Be Masked?
- Passwords: Never recorded — even as plain text.
- Credit card numbers: Financial information must be fully masked.
- Personal information: Name, phone, address, national ID.
- Health information: If applicable.
- Sensitive field text: Any field where users enter private information.
Masking in Didka
Didka provides powerful privacy protection tools:
- Automatic field masking: Didka automatically detects and masks sensitive fields (passwords, card numbers) based on HTML field names.
- Manual masking: Mask any element with a CSS selector.
- Full page exclusion: For highly sensitive pages (like checkout), disable recording entirely.
- Data encryption: All recorded data is encrypted with TLS 1.3 in transit and AES-256 at rest.
Best Practices
1. Define sensitive pages upfront: Create a list of pages that shouldn't be recorded: checkout, signup, account pages.
2. Set the boundary: Ask: "Do I really need this data?" If not, mask it.
3. Limit team access: Only people who need to see sessions should have access.
4. Keep retention short: Don't keep data longer than needed. Didka lets you set retention periods per plan.
Summary
Session replay and privacy aren't in conflict — with the right tools, you can do powerful analysis while respecting user privacy. Didka provides automatic masking, encryption, and access control to achieve this balance.