Session replay: setup, masking and playback

Session replay records a masked reconstruction of a visit so an analyst can watch it later. A tenant administrator records the legal basis and sets the policy for each domain, a web developer installs the browser pieces, and analysts play sessions back in Backoffice.

What it is

Availability: Controlled availability. Replay is off until it is armed for a domain, and it runs when enabled for your organisation.

The recorder runs in the visitor’s browser, from the extensions script. It captures page structure, input events and console and network metadata, masks them before they leave the page, and uploads them in chunks to the ingest host. The collector applies the masking and block rules again on its side, whatever the browser sent. Analysts play the result back in Backoffice.

Three settings arm capture for a domain:

1. An active replay legal basis recorded by a tenant administrator.
2. An enabled replay policy on the domain.
3. The platform-wide recording service, which Noxtica operates. You cannot read its state in Backoffice.

Arming is not enough on its own. Each visit must also pass four checks before anything is stored:

• Consent. On domains whose client consent mode is api or cookie, the visitor’s replay category must be granted. The replay category is the one your consent banner controls.
• Do Not Track and Global Privacy Control. With the policy set to Honor, a visitor who sends either signal is excluded. The browser checks this and the collector checks it again.
• Sampling. The sample rate decides which visitors are drawn.
• Minimum duration. A session shorter than the configured minimum is not recorded.

Replay records sampled visits, not every visit, and it is not a complete record of everything a visitor saw. Treat what you watch as evidence to review, not as a verdict.

Prerequisites

• Roles. A tenant administrator records the replay legal basis. A superadmin cannot record it for the tenant. Changing the policy needs the Admin role and a fresh step-up verification. Listing sessions needs the Analyst role or higher. Playing a recording needs the separate replay-payload permission, held by Admin, plus a fresh step-up verification.
• Browser install. The core script and the extensions script are loaded and the page allows the ingest host in its Content Security Policy. See Install & Browser Runtime and Content Security Policy, hosts and relay.
• Consent. If the domain uses a consent mode, your banner can grant the replay category. See Consent modes, GPC and Google Consent Mode.
• Plan. A save that asks for more sessions per day than your plan allows is refused. Backoffice shows the values in force.
• Flags. Live replay and Feature Flags are separate switches. Both work when enabled for your organisation.

Steps

1. Record the replay legal basis

Backoffice → Privacy & Legal → Legal Basis Register → Replay legal basis.

1. Choose the Domain.
2. Set Action to Record a legal basis.
3. Enter the Legal basis reference (DPA / DPIA). Use the real reference. A placeholder is refused.
4. Tick the acknowledgement of the disclosure text and select Record legal basis.

Recording a legal basis does not turn replay on. To change it later, choose Replace the active basis. To stop capture for the domain, choose Revoke the active basis: the record stays for the audit trail and capture stops until a new basis is recorded. Details are in Legal basis register and receipts.

2. Add the recorder head (optional, for early capture)

The recorder head is a small synchronous script that buffers early page activity in memory, with no network transport. Without it, the recorder starts later and misses the earliest page activity.

Copy the tag from Backoffice → Integrations & API → Script & Consent → Snippets. The stable tag and the pinned variant are documented once, in Replay recorder head on the install page; this page does not repeat the tag.

• Place it before every other script in <head>. Never add async, defer or type="module".
• data-cfasync="false" stops Cloudflare Rocket Loader from deferring it.
• It keeps at most 256 events and 64 KiB. If the core script does not take the buffer within 60 seconds, the buffer is discarded.
• The core script drains the buffer after the consent, legal-basis and policy checks pass. If a check fails, it discards the buffer.

3. Grant the replay category from your banner

Call this when the visitor accepts session replay:

window.noxticaClient.setConsent({ replay: 'granted' });

window.noxticaClient.setReplayConsent(false) withdraws consent: the recorder detaches and its in-memory buffers are cleared before the call returns.

4. Set the domain’s replay policy

Backoffice → Web Analytics & Privacy → Capture Policies → Session replay policy.

1. Pick the domain.
2. Switch Enabled on.
3. Set Requires end-user consent and DNT/GPC policy.
4. Choose the Masking mode (next step).
5. Set the limits below, then select Save replay policy and complete the step-up verification.

If the domain has no active legal basis, the save is refused, nothing changes and the form returns to the last saved values. Turning replay off needs no legal basis.

Bounds can change. Backoffice shows the values in force.

Requires end-user consent. Leave it off to record without per-visitor consent. Turn it on when each visitor must have consented. The banner consent satisfies it on domains whose consent mode is api or cookie. On other domains a per-subject grant written by your controller is needed, and without one nothing is recorded. Visitors who send a DNT or GPC signal are excluded either way when the policy is Honor.

Sampling and anonymous visitors. The draw is made per identified subject. Any effective rate below 100% records no anonymous web visitors. To record anonymous visitors, keep the sample rate at 1,000,000 ppm. The effective rate is also bounded by the domain’s capture level; see Client Computation Cost Levels in Backoffice.

Daily quota. When the session ceiling is reached, Session Replay shows a banner and recording resumes at 00:00 UTC.

The same card also holds Rehost page assets (CSS, fonts, images) and Capture network request/response bodies. Both are off by default. Body capture applies to fetch and axios calls your code wraps with the capture plugin, and to structured text bodies.

5. Choose the masking mode and mark sensitive elements

The Masking mode has three values:

In every mode, password and secret fields stay masked. That includes card and one-time-code fields and fields whose name, id or autocomplete value looks like a password, token or similar secret. The exact length of a masked value does not leave the browser. Any element you mark with the attributes below stays masked too.

Relaxing the mode needs an active legal basis with a real reference and a risk acknowledgement that Backoffice asks for on save. Tightening it asks for confirmation: sessions already captured under the looser mode are permanently deleted by replay retention and this cannot be undone. Changing the mode does not change the consent setting.

Mark elements in your page:

<div data-nox-mask>Order notes</div>
<div class="nox-mask">Account number 12345</div>
<section data-nx-replay-obscured>Support chat</section>
<aside data-nx-replay-hidden>Card form</aside>
<aside data-nx-replay-block="card-form">Billing panel</aside>

Narrowing capture never needs permission, so the hidden marker works without a policy entry.

6. Check the recorder in the browser

In the page, with the visitor’s consent granted:

window.noxticaClient.getReplayConsentState(); // 'POLICY_READY' when the recorder may start
window.noxticaClient.getReplayRecorderState(); // 'active' while recording

getReplayRecorderState() returns idle, loading, active, stopped or error.

7. Find and play sessions

Backoffice → Session Insights → Session Replay. The page has two tabs: Sessions and Install & status. The status tab lists each domain as Armed, Not armed or Not configured and shows whether consent is Required or Not required.

• Sessions. The Recorded sessions list shows Session, Domain, State, Recorded, Duration, Size, Expires, Signals and Playable. Signal badges count rage, dead, error-click, quick-back, excessive-scroll and mouse-thrash events. Advanced search opens an omni-search over server-indexed, privacy-safe signals, and Segments saves a filter set under a name. Open a row to reach the player.
• Player. The session page shows the recording and a Session events area with the tabs Overview, Console, Network, Network detail, Exceptions, Performance, Long tasks, Backend logs and Access log. Access log lists who read the recording’s bytes. Add ?t=<ms> to the page address to open at a time offset. View console logs for this session jumps to the console lines.
• Review aids. Flag for recommendations marks a session so similar sessions are suggested.
• Live Assist. Backoffice → Session Insights → Session Replay → Live Assist lists sessions that are recording now. The visitor must grant sharing before anything of their page is visible. Your page loads the live runtime separately with window.noxticaClient.loadReplayAssist(), and the visitor is asked for their own consent.

An analyst sees the list and session details. Playing the recording needs the replay-payload permission and a step-up verification, and Backoffice says so when a role lacks it.

8. Review retention, quotas and deletion

• Retention. Recordings expire after the policy’s Retention (days). The default is 7 days on every package. A session past its deadline shows This recording has passed its retention deadline.
• Delete one or many. Delete recording and the bulk delete in the list remove recordings permanently. Their stored chunks are queued for physical deletion. The action needs the manage-replay permission, held by Admin.
• Purge. Backoffice → Web Analytics & Privacy → RUM Data Lifecycle offers a scoped purge of the replay data. Preview the matching session count before you run it. A purge cannot be undone and can empty the Session Replay list.
• Requests about a person. Use the data subject workflow in Data subject scope, erasure requests and account deletion.
• Usage. Replay is metered. See Usage, quotas and metering.

9. Optional: feature flags and conditional recording

Backoffice → Administration → Feature Flags controls per-domain visitor experiences, experiment splits and conditional-recording keys. It works when enabled for your organisation, and a new flag starts off.

Verify it works

1. In Session Replay → Install & status, the domain shows Armed.
2. In the page, getReplayConsentState() returns POLICY_READY and getReplayRecorderState() returns active.
3. After a visit longer than your minimum duration, a session for the domain appears under Sessions, and its Playable column reads Playable.
4. Open it. The recording shows your page with masked text and inputs, and the Access log tab shows your own read.
5. A password field and any element you marked show masks, not values.

Troubleshooting

Who it fits

Replay adds context to a signal. It does not replace the signal or your policy. It is a separate data path from risk lookups and has its own admission gates.

• What happened around a risk signal? A score tells you what changed. A replay can help explain where it happened and what the visitor experienced.
• Where did a journey break? Interaction evidence and diagnostics can help support and engineering teams find the step that failed.
• Can support join a live session? For eligible in-progress sessions, a live view can support consented investigation. It asks for its own consent and a separately authorised role. See Live Assist in step 7.

How teams connect

Replay uses the same browser collector as the rest of Noxtica. You connect it in three places:

• Your pages. Load the browser scripts and, for early capture, the recorder head. See step 2 and Install & Browser Runtime.
• Your consent tool. Report replay consent through the browser consent call. See step 3 and Consent modes, GPC and Google Consent Mode.
• The Noxtica console. Set the replay policy, masking, sampling and retention. See step 4 and step 5.

Limits

Replay records sensitive interaction content. These limits apply to every deployment.

• Controlled availability. Recording is off until a tenant enables it, and access is agreed with Noxtica for each tenant.
• You are responsible for notices, consent, masking, sampling and retention. You must also make sure special-category data and government identifiers are not recorded without a lawful basis.
• A replay is a reconstruction of page structure and interactions, not a video. Some styles, images or elements may not appear as the visitor saw them. Sampling and plan limits apply.

Common questions

Does replay record every visitor?

No. Replay records sampled visits that pass every admission check. See What it is and step 2.

Who decides how much is masked?

Your team does. Masking mode is a tenant setting; see step 5. Review the setting with your privacy advisers.

Does monitoring consent also cover replay?

No. Replay has its own consent category, replay, separate from analytics, which covers RUM and other monitoring. See Consent modes, GPC and Google Consent Mode.

Related

• Observability overview: RUM, replay, APM and ingest — where replay sits among the other tools.
• Custom events, session tags and request tracing — tags, identity hashes and timeline events that appear in replay.
• Behavior analytics: heatmaps, journeys and funnels — heatmaps can show a masked page background from a recording.
• Legal basis register and receipts — the register behind step 1.
• Install & Browser Runtime — recorder head, consent categories and storage keys.
• Privacy and Cookies — the public policies.