What is session recording and heatmapping, and what are the rules?
Tools that capture how people actually behave on a page — where they move, click, scroll and hesitate — filling the gap between analytics, which tells you what happened, and user research, which tells you why.
What each produces:
Heatmaps aggregate behaviour across many sessions: click maps showing where people click — including on things that are not clickable, which is genuinely diagnostic; scroll maps showing how far down people get, which frequently reveals that important content sits below where most people stop; and movement maps, which are the least reliable, since cursor position correlates only loosely with attention.
Session recordings replay individual visits, which is where the insight concentrates — you see the hesitation, the repeated clicking on a dead element, the form field abandoned, the rage-clicking.
Form analytics, showing which field causes abandonment. This single view frequently pays for the tool, since one badly worded or over-validated field can account for a large share of drop-off.
What they are good for: diagnosing why a page underperforms, generating hypotheses to A/B test, finding usability failures nobody reported, and settling internal arguments with evidence.
What they are bad for: proving anything statistically, since watching ten sessions is not a sample, and confirmation bias is severe — people find what they expected.
The legal and privacy position, which is frequently ignored:
This is personal data processing in most cases, requiring a lawful basis, disclosure in your privacy notice, and — where the tool sets cookies or accesses device storage — consent under electronic privacy rules.
Sensitive data must be masked. Passwords, payment details, health information and identifying fields should be excluded at capture. Reputable tools mask by default, and verifying that yourself is essential — regulators have acted where recordings captured payment or health data.
Keystroke capture raises the risk sharply.
Retention limits should be set deliberately.
Data subject rights apply, including access and erasure.
Tell people, plainly, in the notice rather than in a footnote.