Do I need consent to run Smartlook on my site?

Yes. Smartlook is an analytics tool that sets persistent cookies to identify returning visitors and records full session replays including mouse movements, clicks, and scroll behavior. Under GDPR and ePrivacy, prior consent is required before the recording script initializes.

What cookies does Smartlook set?

Smartlook sets two key cookies: a session cookie (SL_C_..._SID) that links page views into a single replay, and a persistent cookie (SL_C_..._KEY) lasting up to 2 years that stitches returning visitor sessions into a user journey timeline.

How does ConsentStack handle Smartlook?

ConsentStack blocks Smartlook from loading until a visitor grants analytics consent. Once granted, the recording script initializes normally. Visitors who decline or ignore the banner never have their session recorded or their visitor ID cookie set.

What tracker domains does Smartlook use?

ConsentStack has catalogued tracker domains for Smartlook including smartlook.com, rec.smartlook.com and web-sdk.smartlook.com. These are the network destinations Smartlook's scripts contact, which a consent platform blocks until a visitor agrees.

Smartlook - Tracking, Cookies & Consent Info

Back to Vendor Library

Overview

Smartlook is a session recording, heatmap, and event analytics platform used by product teams and UX researchers to understand how real users interact with web interfaces. Acquired by Cisco in 2023, Smartlook integrates with web apps and mobile apps (iOS, Android, React Native, Flutter), capturing replays of individual user sessions alongside aggregated interaction maps. The tool is widely deployed on SaaS products, e-commerce stores, and marketing sites where teams want to diagnose usability problems or identify conversion drop-off points.

Session recordings capture the full rendered state of the browser DOM throughout a visit, including mouse movements, clicks, scroll behavior, keyboard input (with masking available for sensitive fields), and navigation between pages. Heatmaps aggregate interaction data from many sessions to show hot and cold zones across a page.

What This Script Does

Script loading: Smartlook injects a primary JavaScript snippet from rec.smartlook.com/recorder.js or web-sdk.smartlook.com, typically via a small initialization tag embedded in the site's <head>. The snippet is keyed to a project API key that links recordings to the customer's Smartlook account.

Cookies and storage:

SL_C_23361dd035530_SID — First-party session cookie, session duration, identifies the current recording session and links page views into a single replay.
SL_C_23361dd035530_KEY — First-party persistent cookie, up to 2 years, stores an anonymized visitor identifier used to stitch returning visitor sessions into a user journey timeline.
SL_GWPT_Show_Hide_tmp / localStorage entries — Used to manage recording state and suppress duplicate initializations.

Data collected per session:

Full DOM snapshot at page load and incremental mutations (MutationObserver-based) for replay reconstruction
Mouse pointer coordinates and velocity (mousemove events at ~50ms sampling rate)
Click targets, scroll depth, and rage-click detection
Network request URLs (not response bodies) for error correlation
JavaScript console errors and exceptions
Custom events tagged via smartlook.track() calls by the site operator
Device and browser metadata: user agent, viewport size, screen resolution, language, referrer URL, and timezone

Data masking: Smartlook supports input field masking via CSS classes (sl-hide, sl-mask) and global masking modes. Sensitive form fields should be masked before deployment to avoid recording personal data.

Data transmission: Recording data streams to manager.smartlook.com and associated API endpoints. Recordings are processed and stored in Smartlook's cloud infrastructure (AWS-hosted, EU region available).

Consent & Compliance

Smartlook falls under the analytics consent category.

GDPR/ePrivacy: Session recording requires explicit prior consent under Article 5(3) ePrivacy (cookies) and GDPR (behavioral profiling). Recordings may inadvertently capture personal data on screen (names, addresses, order details) even with input masking, heightening the disclosure obligation. Smartlook acts as a data processor; a Data Processing Agreement is available and required for GDPR compliance.
CCPA/CPRA: The persistent visitor identifier (SL_C_23361dd035530_KEY) and behavioral session data constitute personal information under CCPA. Businesses must disclose session recording in their privacy policy and honor opt-out requests.
Sensitive data risk: Without thorough masking configuration, recordings may capture health information, financial data, or other sensitive categories if users enter such data on recorded pages.

Should You Block This Without Consent?

Yes. Smartlook sets persistent visitor identification cookies and captures detailed session replay data including behavioral patterns across visits. These are non-essential analytics functions that require explicit consent before the recording script initializes.

Is Smartlook GDPR compliant?

Smartlook typically loads analytics trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Smartlook can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Smartlook, not on Smartlook itself.

Visit website