Hey Mana, Thank you for contacting Mixpanel's Support -- I am Dorothy, and I'd be happy to help! 🌻
Before we jump in, I'd like to include a disclaimer that although we can share what we've seen so far, at the end of the day, how it is implemented within your product is a decision for your team to make; whether session replay requires its own consent banner under ePrivacy is ultimately a legal question and how your legal team interprets the use case and we can't provide a definitive answer on that. We would recommend reviewing your privacy notice with legal counsel to ensure it remains accurate and compliant with data privacy laws.
Diving into your questions,
- 1.
When and how do you ask for consent? (e.g., a popup on first launch, an item added to an existing consent screen, a separate prompt shown only to sampled users)
Based off what we've seen thus far, some customers handle this by updating their Privacy Policy to disclose that session recording technology is in use, what is captured, and the purpose (e.g. improving product usability); while others implement a new explicit opt-in consent toggle added at the "functional" consent level in their existing consent framework.
- 1.
Is consent optional (the app works without it), or is it bundled into a mandatory consent at sign-up?
This is entirely your product decision. Mixpanel's SDK supports both models — you can gate Session Replay behind an optional consent, or bundle it into a broader mandatory consent. The opt-out API respects Session Replay as well.
- 1.
How do you show users that recording is in progress?
This is also a product decision for you/your team to make. We do not have any built-in recording indicator in the Mixpanel SDK. Implementing a visual/audible indicator (as required by Guideline 2.5.14) would be your responsibility in your app's UI layer.
- 1.
If you record existing users, did you re-collect consent from them?
Similarly, it is a legal and product decision you should make with legal counsel.
- 1.
Have you received any App Store review feedback related to Session Replay?
Unfortunately, there isn't that much feedback that I can share so far.
A practical rollout plan would be:
- 1.
Verify replay is enabled in the relevant SDK/project.
- 2.
Use a low sampling rate at first and record internal test traffic. Configure masking deliberately. We recommend starting with auto-masking all content by default, then selectively unmasking only elements you've confirmed are non-sensitive. This is the safer direction to work in.
- 3.
Review a few test replays for unexpected sensitive data exposure.
- 4.
Tighten masking/blocking rules where needed.
- 5.
Only then expand sampling to production traffic.
