Iframe Calendar Creates Dead Clicks and Replay Leaks PII
Wayfarer is an online travel agency with 3.2 million monthly sessions. It uses Mixpanel session replay on web and mobile. The checkout team sees a 14% drop between flight selection and passenger details. Replay shows repeated clicks on dates in the fare calendar, but the calendar is a third-party iframe and the replay canvas records only the parent page, so clicks appear as dead clicks. The team also captures 100% of sessions for all users, including a passport-number field that is not masked. Mobile replays include a screen showing saved payment methods. Replay quota is exhausted by the 10th of each month, so no replays are available for the checkout drop later in the month. Support reports a few users seeing incorrect dates after selecting a fare.
1. How would you determine whether the calendar clicks are a real usability problem or a replay artifact, and what evidence would you collect?
Read the worked answer
Treat the replay as a hypothesis generator, not proof. Because the calendar is a cross-origin iframe, the replay cannot see its DOM or internal clicks; a dead click in the parent canvas may simply mean the click landed inside an uncaptured frame. Cross-check with independent signals: instrument the iframe through its supported API or postMessage events for date selection, disabled dates, and errors; inspect whether fare_date_selected follows the apparent clicks. Look at time-to-date-selection, repeated-click counts from the SDK's own click events, JavaScript errors, and support tickets mentioning wrong dates. Reproduce the flow on the same browser and device mix. If users click repeatedly and no selection event fires, that is a real failure; if the selection event fires but replay shows a dead click, it is an artifact. Also segment by browser and calendar version to see whether the failure is isolated.
2. What sampling and privacy policy would you set for replay, and how would it protect checkout while keeping enough coverage to diagnose the drop?
Read the worked answer
Move away from 100% capture. Use tiered sampling: a low baseline such as 5-10% of all sessions, a higher rate such as 25-50% for checkout sessions, and a priority trigger for sessions with errors or repeated clicks. That preserves quota for the checkout funnel throughout the month instead of exhausting it by the 10th. For privacy, default to masking all text and input fields, then explicitly block the passport-number field, saved payment methods, and any screen or route that displays government IDs or full payment credentials. Disable request-body capture on those pages, exclude sensitive mobile screens, and honor regional consent requirements. Audit selectors after every checkout release. Validate with a test account containing dummy PII and confirm that neither the web replay nor the mobile replay exposes it. Then use the preserved checkout replays to compare failed and successful date selections.