Member Avatar for tiger86
tiger86 16 Posting Pro

I don’t write articles much anymore, but today I felt that this really deserved to be written about. A Website software called Clicktale is quite creepy.
What Is Clicktale?
Clicktale, is a product designed to record everything you do on a Webpage to the website owner who has paid for the service. Only Websites that use clicktale's JavaScript are recorded. However Clicktale does make it very clear that your use of the site will be revoked if you do not exclude information that is deemed sensitive by Clicktale such as Social Security Numbers, Credit card numbers, etc. If you do type text into a box and submit it, the user will be able to see what you typed, excluding passwords. If you don’t hit submit the video does not record your text.
Clicktale has a free option, but from what I’ve read you get better results by using their paid version. The Clicktale site says the software is to figure out exactly why users leave your site, etc. They also say in the terms of service that they do not record any Identifiable information that isn't submitted voluntarily, my interpetation of their use of the word voluntarily is that you supply it to the website.

Isn’t This An Invasion Of Privacy?
In my honest opinion, yes this is an invasion of privacy and shouldn’t be used unless the site has something similar to monitored phone calls in the United States, like a mandatory pop up box that says “this website visit will be recorded for quality assurance. Click if you would like to continue or exit the site.” Thus letting you know that your visit will be recorded if you agree to the popup.

How Many Website’s Use This Software and can I disable it?
According to Clicktale, tens of thousands of Websites use their software. Yes you may disable the use of Clicktale, although I discovered if you do click the disable Clicktale button and you erase your cookies clicktale is re-enabled.

Is This Spyware?
Hmm, well I am not sure if this fits the old school definition of Spyware, but it sure feels like spyware since the software takes down every keystroke, and mouse click, plus video. Some spyware and viruses take down every keystroke and mouse click, but I've never heard of one that also included video. In my opinion this is a form of Spyware since it isn't prominently displayed on the site with a popup that you're Website visit is being recorded.
Are there other software companies like Clicktale?
Yes, there are a few who are similar. I haven’t read about them, but the website I was on that was marketing Clicktale as an analytic tool had links to alternatives. I would like to state that there is a software that would probably give you just as good results finding out why visitors leave your site and why. The software I am referring to is called Crazy Egg, it shows anywhere on the page a user clicks like a graphic or area that they think is a link. This isn’t nearly as invasive as Clicktale and provides you with new results on how your users think about your site that you didn’t have access to before. I believe anyone who uses Crazy Egg should make it very clear to their users, but again, in my opinion it wouldn't be a mandatory popup like I think Clicktale and other software like it should be required to have.

Edited by happygeek because: spelling, links removed
  • 1 Contributor
  • 0 Replies
  • 127 Views

Dani AI

Generated

The point raised by is important: session-replay tools deserve scrutiny beyond the marketing copy. The short technical reality is that these services serialize DOM changes plus mouse/keyboard events and rebuild them server‑side to create a playback of interactions. That reconstruction can expose sensitive data unless the recorder or the site actively masks or excludes it.

Clarifications the thread did not cover: many vendors capture input events as they happen (not only after form submit), so unmasked fields can appear in replays even if the visitor never completed a transaction. Password fields are usually masked by default, but other sensitive inputs (SSNs, card numbers, addresses) are not always protected automatically. Whether a recorder actually captures personal data depends on configuration, not just the product name.

Practical checklist for site owners deploying session replay:

  • Exclude entire paths that handle PII (login, checkout, account pages).
  • Use vendor masking by selector or regex; test masking with sample PII.
  • Anonymize session identifiers and minimize retention windows.
  • Put vendor data processing agreements (DPA) in place and store/process data in compliant jurisdictions.
  • Publish clear disclosure in the privacy policy and implement consent where required by local law.
  • Validate the setup by inspecting network calls in DevTools and confirming that excluded fields are not transmitted.

Operational mitigations for visitors and auditors: block or sandbox third‑party scripts with script blockers (uBlock Origin, Privacy Badger, NoScript), use private windows when entering sensitive data, and review a site’s privacy policy or cookie banner for explicit disclosure of recording. Session replay can be a legitimate UX tool, but only when configured with privacy-by-default controls and lawful processing practices.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.