Analytics and Session Replay Rollout Across EU and Brazil
Cartograph is a B2B workforce-analytics SaaS with 8,000 EU users and 2,000 Brazilian users. Product wants to turn on session replay and behavioral analytics. Today, only marketing cookies are gated by a banner; analytics cookies fire on page load under a legitimate-interest assessment that is three years old. Session replay masks password fields but captures free-text search queries and chat messages. The company plans to use the data to improve features and to train a recommendation model. Legal has asked whether the existing banner is enough, whether legitimate interest can cover the new processing, and what must be documented before launch. The launch date is in six weeks; engineering says consent gating will add two weeks. There is no DPIA on file. The company has an EU representative but no EU establishment. Brazilian customers include public-sector clients. The DPO is part-time and also runs product marketing.
1. Can Cartograph rely on legitimate interest for the new session-replay and behavioral-analytics processing? Explain the legal and practical reasoning, including the ePrivacy and LGPD dimensions.
Read the worked answer
No, not as currently designed. Under the ePrivacy Directive, storing or reading information on a user's device for analytics or session replay requires consent unless it is strictly necessary for a service requested by the user. A legitimate-interest assessment under GDPR does not displace that consent requirement. Cartograph's analytics cookies fire on page load, so the existing banner is insufficient for the new processing.
Under GDPR, session replay that captures free-text queries and chat content is likely to process content users did not intend to submit as structured personal data, increasing intrusiveness and the need for a DPIA. Legitimate interest could in theory support product analytics, but only after a fresh three-part assessment and with safeguards such as masking, aggregation, retention limits, and opt-out.
Under Brazil's LGPD, legitimate interest is a legal basis but requires a balancing test and respect for data subjects' reasonable expectations; public-sector clients raise additional risk. For session replay, consent is the safer basis. Recommendation: gate analytics and replay behind granular opt-in consent, keep strictly necessary cookies separate, and document the LGPD balancing test if legitimate interest is retained for any aggregated analytics.
2. What should the consent and documentation package include before the six-week launch?
Read the worked answer
The package should separate strictly necessary, analytics, session replay, and model-training purposes. Consent must be granular, opt-in, not pre-ticked, and as easy to withdraw as to give. The banner must name the purposes and any third-party recipients, and a consent record must capture timestamp, version, scope, and withdrawal.
Before launch, complete a DPIA because session replay involves systematic monitoring and potentially large-scale processing of free-text content. Also refresh the legitimate-interest assessment for any processing that will rely on it, with a necessity and balancing test. Document retention periods, masking rules, access controls, and vendor contracts. Update the privacy notice and the EU representative's records. For LGPD, document the legal basis for each purpose and the balancing test for legitimate interest. Engineering should implement consent gating before any non-essential script fires. The DPO's product-marketing role creates a conflict-of-interest risk, so assign independent review of the DPIA and consent design. Finally, test that withdrawal stops replay and analytics within a defined period and log the test evidence.
3. Identify the DPIA triggers and the top three risks the DPIA must address.
Read the worked answer
Triggers include systematic monitoring of users through session replay, large-scale processing, innovative use of data for model training, and processing of free-text content that may reveal sensitive information. The DPIA should address three risks first.
First, content capture: free-text queries and chat messages may contain health, financial, or other sensitive data, and masking passwords alone is inadequate. The DPIA should require field-level redaction, sampling, and retention limits. Second, opacity and consent validity: analytics firing on page load undermines user control and may invalidate consent for the new processing. The DPIA should require clear notices and separate choices. Third, secondary use for model training: repurposing replay data to train a recommendation model may exceed the original purpose and reasonable expectations. The DPIA should assess necessity, proportionality, and whether aggregated or synthetic data would suffice. It should also cover vendor access, cross-border transfers, and the inability to erase data once embedded in a model. Each risk needs an owner, mitigation, residual-risk decision, and review date.