Does Microsoft Clarity require disclosure in a privacy policy?

Yes. Because Microsoft Clarity collects session recordings, IP addresses, and device identifiers, you must disclose it in your privacy policy. This transparency is required under GDPR, CCPA, and other privacy regulations. Your policy should specify that session recordings occur and explain how users can opt out if applicable.

What specific data does Microsoft Clarity collect?

Microsoft Clarity collects session recordings, heatmaps showing click and scroll patterns, device information (browser, OS, screen size), and IP addresses. The _clck cookie creates a unique user ID, while _clsk stitches together actions within a single session. Clarity may record form interactions, mouse movements, and navigation patterns.

Does Microsoft Clarity require a cookie consent banner?

Yes, under GDPR and similar regulations. The _clck and _clsk cookies are non-essential analytics cookies that require explicit user consent before being set. Session recording itself may also require affirmative consent depending on your jurisdiction. Ensure your consent banner allows users to opt out of Clarity before the script loads.

Who processes Microsoft Clarity data and where is it stored?

Microsoft Corporation, a United States-based company, is the data processor. Session data is processed and stored on Microsoft servers. If you operate in the EU or serve EU users, ensure you have a Data Processing Agreement with Microsoft and assess whether standard contractual clauses adequately protect data transfers to the US.

Analytics

Privacy policy clauses for Microsoft Clarity

Microsoft Clarity is a free analytics service that records user sessions and generates heatmaps to help website owners understand how visitors interact with their sites. It captures clicks, scrolling, and device information to identify usability issues and optimize user experience.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data Microsoft Clarity collects

Your privacy policy must disclose each of the following data types when you use Microsoft Clarity.

Session recordings

Heatmaps

Click patterns

Scroll behavior

Device info

IP address

When does Microsoft Clarity trigger privacy obligations?

Installation triggers immediate data collection

The moment Microsoft Clarity's JavaScript snippet is deployed on your site, it begins collecting session recordings, heatmaps, click patterns, scroll behavior, device information, and IP addresses. No user interaction is required—data flows to Microsoft's US servers immediately upon page load.

Cookie	Duration	Category	Purpose
_clck	1 year	analytics	Unique user ID
_clsk	1 day	analytics	Session stitching

Privacy policy clauses for Microsoft Clarity

What data Microsoft Clarity collects

When does Microsoft Clarity trigger privacy obligations?

Installation triggers immediate data collection

GDPR applies if you have EU visitors

CCPA applies if you have California visitors

First concrete step

Where data goes

Cookies set by Microsoft Clarity

Common compliance pitfalls

Pitfall 1: Installing Clarity without updating the privacy policy

Pitfall 2: Treating Clarity consent the same as analytics consent

Pitfall 3: Forgetting the Data Processing Agreement (DPA) with Microsoft

Legal note

Sample privacy policy clause

What regulators look for

What DPAs audit first

CCPA enforcement priority

Relevant precedent

Frequently asked questions

Does Microsoft Clarity require disclosure in a privacy policy?

What specific data does Microsoft Clarity collect?

Does Microsoft Clarity require a cookie consent banner?

Who processes Microsoft Clarity data and where is it stored?

Don't ship without Bandit.