Does OpenReplay require cookie consent?

Yes. OpenReplay is a session replay and product analytics platform that records user interactions including clicks, scrolls, and navigation paths. This constitutes personal data processing under GDPR, requiring prior consent. CCPA opt-out rights apply to California residents.

What does OpenReplay record on websites?

OpenReplay captures session replays with DOM snapshots, user input interactions (sensitive fields are masked by default), network requests, console logs, and performance metrics. Recordings are tied to session identifiers and may be enriched with user identity if configured.

How does ConsentStack detect OpenReplay on my site?

ConsentStack detects the OpenReplay tracker script and assigns it to the analytics consent category. When visitors deny consent, ConsentStack blocks OpenReplay from initializing, preventing session capture. Recording begins only after a visitor grants analytics consent.

What tracker domains does OpenReplay use?

ConsentStack has catalogued tracker domains for OpenReplay including openreplay.com. These are the network destinations OpenReplay's scripts contact, which a consent platform blocks until a visitor agrees.

OpenReplay - Session Replay Privacy & Consent

Back to Vendor Library

Overview

OpenReplay is an open-source session replay and product analytics platform. Teams deploy it to record user interactions in their web applications — capturing clicks, scrolls, input events, and errors — to reproduce user-reported issues and analyze user behavior. Operators may self-host OpenReplay on their own infrastructure or use OpenReplay's cloud offering.

What This Script Does

The OpenReplay tracker script records detailed user session data. Captured events include mouse clicks and coordinates, scroll positions and depth, keyboard input events (with configurable sanitization for sensitive fields), page navigation, network requests and responses (with configurable redaction), and JavaScript console output. DOM snapshots are taken to reconstruct the visual state of the page at any point during the session for replay. An anonymous session identifier is assigned per recording session, stored in __or_id (or equivalent) as a first-party cookie or localStorage item. If user identity is explicitly passed to the tracker via setUserID(), sessions become linked to authenticated user accounts. Scripts transmit data in real-time to OpenReplay's ingestion endpoint (self-hosted or api.openreplay.com). Error monitoring captures stack traces, browser environment, and the state of the DOM at the time of exception.

Consent & Compliance

Session replay scripts collect detailed behavioral data — mouse movements, scroll patterns, and interaction sequences — that constitutes personal data under GDPR because it can be used to identify individuals or reveal sensitive interactions. The EDPB and multiple national DPAs have specifically scrutinized session replay tools, noting that keystroke capture and form interaction recording raises particular concerns. Under ePrivacy, setting cookies or accessing storage for session recording requires prior informed consent. GDPR Article 6(1)(a) (consent) is the most defensible lawful basis; legitimate interest requires a DPIA and may be difficult to justify given the granularity of behavioral capture. For self-hosted deployments, data stays within the operator's infrastructure, which simplifies the transfer analysis. Cloud deployments involve OpenReplay (US) receiving EU personal data, requiring SCCs. Under CCPA/CPRA, session recordings may capture sensitive information and must be disclosed. Consent category: analytics.

Should You Block This Without Consent?

Yes. Session replay scripts capture detailed behavioral and interaction data that regulators have specifically flagged as requiring consent. Do not load OpenReplay's tracker until the user has affirmatively consented to analytics. Implement input masking and field sanitization regardless of consent status to prevent inadvertent capture of passwords or payment card data that may appear in form fields.

Is OpenReplay GDPR compliant?

OpenReplay typically loads analytics trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So OpenReplay can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads OpenReplay, not on OpenReplay itself.

Visit website