OpenReplay

Overview

OpenReplay is an open-source session replay and product analytics platform. Teams deploy it to record user interactions in their web applications — capturing clicks, scrolls, input events, and errors — to reproduce user-reported issues and analyze user behavior. Operators may self-host OpenReplay on their own infrastructure or use OpenReplay's cloud offering.

What This Script Does

The OpenReplay tracker script records detailed user session data. Captured events include mouse clicks and coordinates, scroll positions and depth, keyboard input events (with configurable sanitization for sensitive fields), page navigation, network requests and responses (with configurable redaction), and JavaScript console output. DOM snapshots are taken to reconstruct the visual state of the page at any point during the session for replay. An anonymous session identifier is assigned per recording session, stored in __or_id (or equivalent) as a first-party cookie or localStorage item. If user identity is explicitly passed to the tracker via setUserID(), sessions become linked to authenticated user accounts. Scripts transmit data in real-time to OpenReplay's ingestion endpoint (self-hosted or api.openreplay.com). Error monitoring captures stack traces, browser environment, and the state of the DOM at the time of exception.

Consent & Compliance

Session replay scripts collect detailed behavioral data — mouse movements, scroll patterns, and interaction sequences — that constitutes personal data under GDPR because it can be used to identify individuals or reveal sensitive interactions. The EDPB and multiple national DPAs have specifically scrutinized session replay tools, noting that keystroke capture and form interaction recording raises particular concerns. Under ePrivacy, setting cookies or accessing storage for session recording requires prior informed consent. GDPR Article 6(1)(a) (consent) is the most defensible lawful basis; legitimate interest requires a DPIA and may be difficult to justify given the granularity of behavioral capture. For self-hosted deployments, data stays within the operator's infrastructure, which simplifies the transfer analysis. Cloud deployments involve OpenReplay (US) receiving EU personal data, requiring SCCs. Under CCPA/CPRA, session recordings may capture sensitive information and must be disclosed. Consent category: analytics.

Should You Block This Without Consent?

Yes. Session replay scripts capture detailed behavioral and interaction data that regulators have specifically flagged as requiring consent. Do not load OpenReplay's tracker until the user has affirmatively consented to analytics. Implement input masking and field sanitization regardless of consent status to prevent inadvertent capture of passwords or payment card data that may appear in form fields.