Microsoft Clarity Cookie Consent — Does It Wait?
ConsentProof is a cookie consent checker that scans any website with a real browser and records which cookies and third-party trackers fire before the visitor consents.
Session replay is not ordinary analytics
Clarity records session replays and heatmaps. Replay captures interaction with the page, which can include content typed into forms unless masking is configured correctly, so it sits at the high-risk end of the analytics spectrum rather than alongside page-view counting.
That raises the stakes on the timing question. A page-view counter firing before consent is a compliance failure; a session recorder firing before consent is a compliance failure that may also have captured something sensitive.
Check it rather than assume it
Clarity, like most modern analytics, supports a consent signal, and whether it waits on your site depends on how it was installed. Installed via a consent-aware tag manager with a trigger, it waits. Pasted into a theme header, it does not.
A scan answers this in one run: look for the Clarity host in the pre-consent third-party request list. If it is there, the script ran before the visitor chose.
If it is firing early
Move the tag behind the consent trigger, confirm masking settings for form fields, and re-scan. Then, because this class of tag is usually added by whoever is running a campaign, put the site on a schedule so the next one is caught by an email rather than by an audit.
Frequently asked
- Does Microsoft Clarity need cookie consent?
- In the EU and UK, yes. It is analytics with session replay, which is not strictly necessary to deliver a service a visitor requested, so it needs prior consent.
- How do I know if Clarity is loading before consent?
- Run a scan and look for its host in the pre-consent request list, or check the network tab in a clean browser session before touching the banner.
- Is session replay riskier than page analytics?
- It carries more risk, because a recording can capture page content and input unless masking is configured. That makes the pre-consent timing question more consequential, not less.
Related
Try ConsentProof
Free public scan, no account needed.