Microsoft Clarity: Free Heatmaps and Session Recordings
Microsoft Clarity is free and offers heatmaps, session recordings and Copilot. What it includes today, how to protect sensitive data and what consent requires.
What does it offer today?
Microsoft’s official documentation names three core pieces: session recordings, heatmaps, and “ML Insights,” which are observations generated with machine learning (Microsoft Learn: Clarity FAQ). It also has Copilot in Clarity, a generative AI layer with chat and summaries of single sessions, groups of sessions, and heatmaps. Microsoft warns that it can generate incorrect information and that its takeaways are not expert recommendations, so check them against the recordings (Microsoft Learn: Copilot in Clarity). Admins can turn its features on or off in Settings > Copilot.
For a designer, the most useful piece is the session recording: you see what one person did, in what order, where they hesitated, and on which screen they left. Heatmaps give you the aggregate view: where on the page people click and how far they scroll.
How much does it cost?
The official FAQ is direct: “Clarity is a free service forever.” It says there are no traffic limits and no obligation to move to a paid version. It does have technical limits: it records up to 100,000 sessions per project per day, and each heatmap is limited to 100,000 page views. Check that FAQ before relying on any number, because Microsoft can change its terms.
How is it installed?
The usual process is to create a project in Clarity, add its script to the site’s <head>, and wait for the first data to arrive. If you already use Google Analytics 4, Clarity can connect to it, so you can jump from a GA4 event to the recordings of that same session. That jump is useful for research: you find the problem in the numbers first, then watch it happen in a session.
How do you protect personal data?
This is the part many teams skip, and it matters most. Clarity has three masking modes, set by administrators in Settings > Masking (Microsoft Learn: Clarity masking):
| Mode | What it does | When to use it |
|---|---|---|
| Strict | Masks all content | Sites with health, financial, or identity data |
| Balanced | Masks only sensitive content; treats numbers and email addresses as sensitive | Default mode |
| Relaxed | Masks no content (input boxes and dropdowns are still masked) | Only for sites with no personal data |
Input boxes and dropdowns are always masked and cannot be customized. For specific cases, you can add a CSS selector (by class, id, or tag) in the settings, or mark an element in code with data-clarity-mask="True". To show something the mode would hide, there is data-clarity-unmask="true". Setting changes can take up to an hour to apply and are not retroactive: earlier recordings are not changed.
What does it say about GDPR and consent?
Microsoft says Clarity is designed to be GDPR ready and operates as a data controller. But the same FAQ states that, in the European Economic Area, the UK, and Switzerland, explicit user consent is required before cookies are placed. Since 31 October 2025, Clarity also requires the site to send it the consent signal (through its Consent API or a compatible consent manager such as CookieYes) for full functionality in those regions (Microsoft Learn: Consent Mode). Without consent, Clarity cookies cannot be used and sessions are fragmented, which affects recordings and funnels. The tool respects Global Privacy Control but does not respond to the Do Not Track header.
Other practical details from the FAQ: recordings are retained for 30 days (favorited recordings and a random sample are kept up to nine months), and heatmap data can be accessed for up to nine months. To delete one person’s data, you have to delete the entire project. And Clarity should not be used on sites aimed at users under 18.
A common trap: having a consent banner is not enough if it does not pass the signal to Clarity. Check that your consent manager has the Clarity-specific integration or that your code calls the Consent API.
Before you open the recordings, define the questions you want to answer. A research plan with two or three questions keeps you from watching sessions for hours without a hypothesis.
When should you NOT use it?
- On checkout, login, or any form that collects personal data, without strict masking and without excluding those routes.
- As your only source of decisions. Recordings show cases, not proportions. One unusual session can look like a general problem.
- If your project needs product analytics with events and experiments, Clarity does not replace a tool like PostHog.
Illustrative example
Illustrative example: an online store sees in GA4 that 40% of users never complete shipping. In Clarity, the team filters sessions on that page and sees many people clicking repeatedly on a postal code field that is disabled. The problem was not the price or the form; it was a field that looked editable and was not. The team fixes it and measures again. Before treating that observation as a conclusion, review research bias: three sessions are not a pattern; they are a lead to test.
Common mistakes
- Installing the tool without checking the masking mode.
- Assuming the default settings cover all personal data.
- Forgetting that recordings are retained and that deleting one person means deleting the project.
- Taking one session as evidence of a general problem.
- Ignoring consent in the EU, the UK, or Switzerland.
What you can do tomorrow
- Open the masking settings for your project and confirm which mode is active.
- Pick one important page and watch ten session recordings, noting what people do before they leave.
- Write a hypothesis about what you saw and decide how you would test it with a usability test.