Session replay is one of the most powerful debugging tools available to mobile engineers. It's also one of the most legally complex, particularly for apps with users in the EU. The type of session replay you use — video-based versus event-based — determines whether you need a consent banner, what you must declare in your App Store privacy label, and how much data liability you carry.

What Makes Video Session Replay a GDPR Risk

Video-based session replay captures the visual state of your app at regular intervals — screenshots or a DOM-diff equivalent. The problem is that "visual state" includes everything visible on screen at capture time:

Password fields (even partially masked)
Banking account numbers and balances
Private messages in chat apps
Medical information in health apps
Credit card numbers in checkout flows
Government ID numbers in verification flows

GDPR Article 9 defines special categories of data — health, financial, biometric, racial/ethnic origin, religious beliefs, sexual orientation — that require explicit consent rather than legitimate interest. Video replay that captures health or financial data on screen automatically triggers these higher requirements.

Even with masking configuration, video replay is risky:

Custom input components may not be recognized as sensitive
Third-party payment SDK screens are outside your masking control
Web views within apps (in-app browsers, OAuth screens) bypass masking rules
A single unmasked frame containing personal data constitutes a data incident

The Consent Problem

For crash reporting and debugging tools, GDPR's legitimate interest lawful basis typically applies — you have a legitimate interest in debugging your own product, and that interest isn't overridden by user privacy rights when data collection is minimal and non-intrusive.

But video replay changes the calculus. Capturing screen content that may include personal data is not "minimal." Regulators have increasingly found that video-based analytics fails the legitimate interest balancing test when:

Sensitive data could be captured (health, financial)
Users aren't meaningfully aware of the recording
The same purpose (debugging) could be achieved with less intrusive means

The last point is key: if you can debug the same crash with event-based replay that doesn't capture any visual PII, using video replay instead fails the necessity test that GDPR's legitimate interest framework requires.

What GDPR Requires If You Use Video Replay

If you do use video session replay:

1. Legal basis: Consent is the safest basis. Legitimate interest is possible but requires a documented Legitimate Interest Assessment (LIA) and must be disclosed in your Privacy Policy.

2. Transparency: Users must be informed about session recording before their session begins — typically via a consent banner or prominent privacy notice.

3. Data minimization: Masking must be configured for all sensitive fields. You must be able to demonstrate masking coverage in an audit.

4. Retention: Video session data should have a defined retention period and be deleted automatically.

5. Data Processing Agreement: Your session replay vendor must be covered by a GDPR-compliant DPA.

6. Right to erasure: If a user requests data deletion, you must be able to delete their sessions from the replay platform.

Event-Based Replay: The Compliant Alternative

Event-based replay captures structured events — taps, navigation, network requests, crashes — without any visual data. From a GDPR perspective:

No visual personal data is ever captured (no Article 9 risk)
Data is minimal: behavioral metadata, not content
Legitimate interest lawful basis applies without requiring consent
No masking configuration needed (nothing to mask)
App Store privacy labels are cleaner — no "User Content" or "Screen Recording" category

// What event-based replay captures
{ "type": "tap", "target": "CheckoutButton", "timestamp": 1706000100 }
{ "type": "network", "url": "/api/checkout", "status": 500, "duration": 312 }
{ "type": "crash", "message": "TypeError: Cannot read property 'orderId'" }

A crash from this data is as debuggable as one from video — you know exactly what the user was doing, what the API returned, and where the code failed. You don't know what the checkout form looked like, which is not relevant to fixing the bug.

Practical Decision Framework

Scenario	Video Replay Appropriate?	Event-Based Appropriate?
Debugging crashes	No (overkill + risk)	Yes
Understanding navigation flows	Risky	Yes
Reproducing UI-rendering bugs	Conditionally (with consent)	No
EU/UK users in the data	Extra caution required	Yes
Healthcare or fintech app	No	Yes
Testing new UI designs (UX research)	With explicit consent	Limited

For the vast majority of mobile debugging use cases — crashes, navigation errors, network failures — event-based replay is strictly better from both a privacy and a practical standpoint. It gives you the data you need without the data you don't need.

Summary

GDPR creates meaningful compliance risk for video-based mobile session replay because pixel capture may include sensitive personal data that triggers elevated requirements. Event-based replay — which records behavioral events, not visual state — is cleaner under GDPR, has a simpler legitimate interest justification, and produces a better App Store privacy label. For apps serving EU users, the choice of session replay architecture is a compliance decision, not just a product preference.