Microsoft Clarity: Tracking Behavior & Litigation Context
What Microsoft Clarity Is
Microsoft Clarity is a free behavioral analytics tool that records how visitors use a website, producing session replays, heatmaps, and interaction analytics.
What It Does
Clarity's script captures DOM mutations, mouse movement, scrolling, clicks, and keystroke events (with masking rules), reconstructing a visitor's session as a playable recording on Microsoft's servers. It also aggregates rage-click, dead-click, and scroll-depth metrics.
Browser Communications Generally Observed
Continuous batched requests to clarity.ms endpoints during a visit, carrying serialized DOM and interaction data, page URLs, and a persistent visitor identifier. Recording typically begins at page load; masking of text inputs depends on configuration and can be incomplete for custom form controls.
How Our Scanner Detects It
Our scanner detects Clarity's script and network traffic, observes whether recording begins before consent, and uses synthetic form interaction with marker values to test whether typed input is transmitted before submission.
Common Implementation Behavior
Often added directly or via tag manager with default settings. Common issues observed include recording enabled on pages containing forms with sensitive fields, incomplete input masking, and recording beginning before any consent interaction.
Litigation & Risk Context
Session replay tools including Clarity have been named repeatedly in website tracking lawsuits invoking state interception statutes, on the theory that recording a visitor's interactions constitutes capturing the contents of a communication. Presence of Clarity is a potential risk indicator meriting configuration review, particularly on form-heavy or sensitive-category sites; it is not a determination that any statute was violated.
Tracked Cases Involving This Technology
No tracked cases currently link to this technology in our source set. This reflects our tracked sources, not an absence of litigation involving the category.
Remediation Options Operators Commonly Consider
- Inventory every third-party script, pixel, and embed on the site and document what each transmits, to whom, and when (page load, pre-consent, during interaction, pre-submission).
- Gate non-essential tracking behind a consent management platform configured to actually block network transmission before consent — not merely hide a banner.
- Review and, where appropriate, disable optional data-capture features (advanced matching, automatic event capture, input/keystroke capture, session recording of form fields).
- Update the privacy policy and any consent language to accurately describe the third-party technologies in use and the data they receive.
- Re-scan after every tag manager or website change; tracking configurations drift over time.
Frequently Asked Questions
Is session replay illegal?
No court has held that session replay is categorically unlawful, and no statute names it. Plaintiffs have argued that specific implementations amount to interception under specific state statutes, with mixed public outcomes. This page is informational, not legal advice.
Does Clarity record what visitors type?
Clarity captures interaction events and, depending on masking configuration, may capture typed content in unmasked fields. Our scanner tests this empirically with synthetic marker input.
Related Intelligence
Sources
This page is based on direct technical observation by our scanner and vendor documentation; tracked litigation sources will be listed as the intelligence engine links them to this technology.
About This Page
Publisher: Inspection-Ready Institute, Inc. (DBA Crandall Consulting), an independent website compliance and risk consultancy. We are not a law firm and nothing on this page is legal advice.
How this content is produced: Facts are extracted from publicly available sources — court and government materials, recognized legal press, professional analysis, and industry reports — by our litigation intelligence engine, stored with full source provenance, and rendered from the database. Risk guidelines are computed by a deterministic formula, never by an AI model directly. See the full methodology.
Limitations: Counts labeled "Tracked" reflect matters identified in our source set and are not official court statistics. We report what courts decided and did not decide; we do not predict outcomes.
Corrections: If you believe anything on this page is inaccurate, contact us via the contact page and we will review the underlying sources promptly.
Is Your Website Creating Hidden Tracking Risk?
Scan your site for third-party tracking and potential wiretap exposure. Free, no account required.
Scan My Website