Landing page heatmaps and session replays: a UK evidence guide

What to take away

Heatmaps show where clicks, taps and scrolls cluster; replays show the order of actions, hesitation and drop-off.
Landing page behaviour analytics pays off when a recording changes a page, not when it fills a dashboard.
A lawful basis, field masking and a retention limit come before you switch recording on.
Replays produce hypotheses, not proof, so confirm each change with a controlled test.
Keep a dated evidence log so every edit traces to a recording, a segment and an owner.

Heatmaps vs Session Replays

Heatmaps

What it records: Clicks, scrolls, moves
What it shows: Attention zones
What it misses: Why visitors stop
Example tools: Crazy Egg, Hotjar

Session Replay

What it records: DOM events, cursor paths
What it shows: Actions and errors
What it misses: Aggregate patterns
Example tools: Clarity, FullStory, Mouseflow

What heatmaps and session replays record

Start with a question, because landing page heatmaps UK teams collect often sit unread. Heatmaps aggregate behaviour into click maps, scroll maps and move maps. They show where attention concentrates and where it thins out, but not why.

Session replay on landing pages records DOM events, rage clicks, cursor paths and field interactions in tools such as Microsoft Clarity, Hotjar, Crazy Egg, Mouseflow, FullStory and Smartlook. Microsoft Clarity is free and includes masking, which helps smaller UK teams begin. Paid tiers add funnels, filters and longer retention.

Matching the method to the question

Method

Where do people click?: Click heatmap
How far do people scroll?: Scroll map
Why did one visitor stop?: Session replay
Did the change work?: Controlled test

Shows

Where do people click?: Concentrated and ignored zones
How far do people scroll?: Depth reached
Why did one visitor stop?: Actions and errors
Did the change work?: Difference from a holdout

Consent and data minimisation duties

A replay that can single out a person is personal data, so UK GDPR applies. You need a lawful basis before recording starts and a privacy notice naming the replay vendor.

Consent suits most lead-capture pages, and the ICO consent guidance covers opt-in wording and record keeping. UK GDPR session replay consent is easiest to defend when reject is as easy as accept.

Cookies and similar technologies need consent before they run, and the PECR 2003 text is the source for that rule. Data minimisation means masking form fields, limiting retention and excluding pages with no analytic purpose. The Data Protection Act 2018 supplies the UK framework for these duties.

A masking checklist before recording starts

A masking checklist

Mask every form field, including name, email, phone and payment inputs.
Suppress keystrokes at capture, not later in a dashboard.
Exclude pages that show orders, balances or health details.
Set a short retention window, then delete on schedule.
Name the vendor and the purpose in your privacy notice.

Reading heatmap evidence without fooling yourself

Heatmaps blend every visitor into one image, so a strong mobile signal can vanish inside a desktop average. Split by device, traffic source and new against returning visitors before you judge.

Check the sample size first, because thin segments produce noisy maps. Heatmap evidence should feed landing page testing, not replace it. Confirm any pattern with a controlled test that fixes its sample in advance.

Example: from a replay to a testable change

From a replay to a testable change

Filter replays to mobile visitors who opened the lead form and did not submit.
Watch twenty recordings and note the last field touched before exit.
Write one hypothesis, such as the postcode field blocking completion.
Change that element alone, then run a controlled test for two weeks.
Log the outcome beside the original recording identifiers.

Turning evidence into defensible changes

A defensible change has three parts: the heatmap or replay that prompted it, the hypothesis, and the test result. Store them together with dates and the approver's name. Whenever an edit touches a price, a testimonial or a comparison, run the England pre-release claims checks first.

Choosing tools with UK data residency

Ask where replay data is stored, processed and deleted before you buy. Request the sub-processor list, the default retention period and the masking controls. Ecommerce teams weighing Shopify apps, GBP pricing and UK hosting can use our UK ecommerce builder comparison to shortlist vendors.

Where the market is heading

Watch consent tooling, browser privacy features and automated summaries of recordings. Our 2027 landing page watch items list dated sources and counter-signals for each shift.

Common questions

Do I need consent to record session replays in the UK?

Yes in most cases. Consent is the clearest basis for a marketing page, though documented legitimate interests can cover limited, well-masked research.

How long should I keep heatmap and replay data?

Keep it only as long as the stated purpose needs. Write your own retention period down and delete on schedule.

Can I run a free tool such as Microsoft Clarity on a UK site?

Yes, if you configure masking, name the tool in your privacy notice and hold a lawful basis. Free tools still process personal data.

What is the difference between a heatmap and a session replay?

A heatmap aggregates many visitors into one visual summary of clicks, taps or scroll depth. A replay follows one visitor in order, which exposes hesitation, errors and drop-off points.