Session recording tool present but not mentioned in privacy policy

Session recording tools such as Hotjar, FullStory, or Microsoft Clarity capture a visitor's actual mouse movements, scrolling, and sometimes keystrokes as they use the site, effectively recording a replay of their visit. This check looks for such a tool running on the site and whether the privacy policy mentions it. On this site, a session recording tool was detected, but it isn't named anywhere in the privacy policy. Because these tools capture detailed behavioural data, including potentially what someone types, they're considered sensitive data requiring explicit disclosure. A visitor reading the privacy policy currently has no way to know their session, including their exact mouse movements and clicks, is being recorded and replayed by a real person on the other end. Your developer and privacy lawyer should add a 'Session Recording' section to the privacy policy naming the specific tool in use and its purpose, and include it as its own category in the cookie consent banner rather than lumping it in with general analytics. This is typically about an hour of combined drafting and configuration.