See you
You opened the banking app at 2 a.m. Someone can watch that session on Tuesday, at 2x. It is not a video. It is session replay.
On this page›
Last night you opened the banking app at 2 a.m. to see if payday had landed. You hesitated for a few seconds before tapping Transfer. You closed the app.
Someone can watch that session on Tuesday. At 2x. With coffee.
It is not paranoia. It is called session replay. Tools like PostHog, Quantum Metric, and Glassbox record what you do inside a page or an app, then reconstruct it so another person can walk through it as if they had been sitting behind you.
It is not a video. It is worse
The picture of "they are recording your screen" is short, and it is inaccurate. In most web products there is no video file. There is a log.
The script watches the DOM. It notes when a node appears, when text changes, where the cursor was, what scrolled, what was clicked, what was typed, and what was deleted. The player then rebuilds the page from that log. That is why it feels like a video. It is not one.
It is worse for you because it is data, not a tape. It can be searched. Someone can filter "every session that typed an amount and did not confirm". A video would have to be watched. This can be queried.
Why the notice is usually enough for them
The uncomfortable part is the legal floor they operate on, not a plot.
In Mexico the piece is the aviso de privacidad. For data that is not sensitive, consent can be tacit: they put the notice in front of you and you did not object. Yes, the one you accepted without reading. Financial data and other sensitive data ask for a more explicit consent, and that is where a bank reconstructing balances, account numbers, and amounts you never even sent is walking a gray line. In practice, the argument they use is the notice. Almost nobody reads it. Almost nobody objects. On Tuesday, someone watches the session.
In the United States the vendor pitch is the same: it is in the privacy policy. It is not that uniform. California has seen lawsuits under the Invasion of Privacy Act against sites that dropped in third-party session replay. The answer depends on the state, on whether that script is treated as interception, and on what fell inside the recording. "It is legal" is the pitch. It is not one law.
On an iPhone nobody asks for camera permission, because this does not use the camera. The script runs inside the page you already opened, or inside the app you already installed. The notice, if it exists, is in the policy or in the App Store privacy label. That is the other text we do not read.
What they cannot record
They do not see other apps. They do not see your camera or your microphone just because session replay is on: that asks for another permission, and it is another tool. They do not get into your keychain or your password manager.
A type="password" field is usually masked. PostHog, FullStory, and most of these tools hide it by default, unless someone breaks that on purpose. Your bank password should not show up in the replay. If it does, the integrator did a bad job. It is not the normal behavior of the product.
They also do not reconstruct what you did outside that tab. Switching to messages to copy a code is invisible to the script on the bank's page. The code, if you paste it into a field that is not masked, is no longer invisible.
What they record anyway
The text you typed and deleted. The amount you entered before you changed your mind. The search inside the app. The draft to support. The email in an ordinary text field. Sometimes the card number, if the person who installed the script did not mark that field as sensitive.
None of that requires you to confirm the transfer. The session exists from the moment you opened the screen. Closing the app does not delete the log that already left for their server.
If you prefer to see it explained:
How to defend yourself without a tinfoil hat
Blocking JavaScript entirely knocks over the banking app. That is not a plan.
A blocker that already knows these scripts does help: uBlock Origin and the lists that include analytics and session replay. Firefox, in strict mode, cuts more of this tracking than the default setup in Safari or Chrome. Safari does not stop first-party replay just by being Safari.
Do not type a secret into a field that is not a password field. An in-app search, a "reason for the transfer", a support chat: that is free text, and free text is the first thing that gets reconstructed.
If the service gives you an opt-out, use it. And if you are a customer of a bank, the useful question is not "are they reading my mind?". It is "which session-replay tool runs on the web and in the app, and which fields do they mask?". If they cannot answer, you already know how it is operated.
A confession
When I published this, my own site was recording you too. PostHog, with session replay. Passwords stayed masked because the tool does that if you do not disarm it. What did not look good was the rest: clicks, scrolling, and text fields that were not passwords. The notice lived in the privacy policy, not in a moment where you could say no. I said I would be honest, not consistent.
This version of the site does not reconstruct sessions. It measures aggregated events, without rebuilding your visit as if it were a video. I am writing that down because the earlier article said I was recording you, and repeating that sentence on a site that no longer does it would be the actually inconsistent part.
Serious question: have you ever read your bank's privacy notice? Neither had I, until I wrote this.
I said I would be honest, not consistent.
— from this article
References
- Englehardt, S., Acar, G., & Narayanan, A. (2017). No boundaries: Exfiltration of personal data by session-replay scripts. Freedom to Tinker, Princeton CITP.
- Future of Privacy Forum. Understanding Session Replay Scripts: a Guide for Privacy Professionals.
- PostHog. Session replay privacy controls.
- Video: Session Replay: A Serious Online Privacy Matter, Switched to Linux.
> What did you think?
> Thread [00]
moderatedLoading replies…