Session Replay privacy excellence

Follow the steps below to roll out Session Replay for your web applications.

Enable Session Replay and start using it right away

Integrate Session Replay with your existing consent solution

Fine-tune Session Replay in a lower-level environment first

Assign permissions to Session Replay users according to their needs

Enable Session Replay and start using it right away

Start using Session Replay in your web applications by simply enabling it in your application settings in the Dynatrace web UI.

• The default Session Replay settings mask user input before capture, so no personal or associable data is collected, thereby providing best-in-class data privacy.

• By default, Real User Monitoring does not identify specific users. Instead, it anonymizes each user session.

  

• Session Replay automatically responds to end user changes to privacy preferences, such as the "Do not track" browser privacy setting, in real time and complies with them.

Integrate Session Replay with your existing consent solution optional

Turn on the Session Replay opt-in mode, and Session Replay won't record anything until the API method to start recording is called. In this way, you can easily integrate Session Replay with your existing consent solution, fully controlling when the opt-in occurs as well as the information presented to your end user for them to opt in. The API also allows opt-out from Session Replay, allowing for fine-grained control over user consent.

Fine-tune Session Replay in a lower-level environment first best practice

Start using and fine-tuning Session Replay in a staging environment. Session Replay is flexible and supports your processes by offering a means to fine-tune and later migrate your settings to another environment.

• Start by enabling Session Replay with the default configuration, shown in the illustration below, in your development or staging environment.

  

  With this configuration, you get relevant information such as how a page is rendered on a specific device and resolution, how the user navigates the application, and how various help elements like tooltips are used. You can see this by simply recording the page layout and the format of content without capturing personal data. The image below shows Session Replay for our own web UI with all content masked (Mask all content masking option). Note, however, that the default masking option is Mask user input.

  

  The default masking option was changed to Mask user input starting with Dynatrace version 1.262. Before that, the default option was Mask all.

• If you need to see more information, gradually fine-tune what is recorded and masked by leveraging the rich set of preconfigured masking options. For instance, you can use the Allow list content masking option. This option gives you complete flexibility in what is captured but is based on safe defaults. This means that nothing else is recorded beyond what you allow.

  In the example shown below, a masking rule was defined to record only the content shown in the Dynatrace timeframe selector.

  

• Adjust the cost control setting for Session Replay to limit the number of recorded sessions as part of risk management.

• Exclude non-relevant pages that you may not want or need to record for your specific purposes. Use the URL exclusion setting to specify URLs that you want to exclude.

  

• Export the configuration to your production environment by using the provided configuration API. For more details, check the links under Further reading.

Assign permissions to Session Replay users according to their needs

By default, all your Dynatrace users have access to session playback with the most restrictive set of masking rules applied.

During the recording (called "at capture"), all content is anonymized by default in the browser before this data is sent to Dynatrace. During the playback (called "at display"), all content is anonymized again by default as a risk management measure, preventing the viewing of personal data by your Dynatrace users.

To gain greater insight into user experience, you may elect not to anonymize some content at capture and at display. Additionally, you can decide who can play back user sessions by utilizing user permissions and management zones.

Depending on the needs of your Dynatrace users, assign the following Session Replay permissions:

• For users that don't need to play back sessions, disable the Replay sessions with masking and Replay sessions without masking permissions in user and group settings.

  

• For users that need to play back user sessions for specific purposes, such as improving user experience, but don't need to see all captured information, assign the Replay sessions with masking permission.

  

• For users that need to play back sessions and see all recorded information, such as a developer addressing a support case, assign the Replay sessions without masking user permission. This disables playback masking controls. This permission is disabled by default for all users.

  

The ability to view and play back user sessions is further protected by management zones. If a user session traverses applications within different management zones, Dynatrace users with Session Replay permissions may only view those parts of the session associated with applications in the management zones that they have access to.

Follow the steps below to deploy Session Replay for your mobile apps.

Instrument your app

Assign permissions to SR users according to their needs

Enable Session Replay in production

Instrument your app

• Add the Session Replay dependency to your application code.

  Session Replay can only operate for a mobile app once developers introduce changes in application code to include the Session Replay dependency. The required changes are explained in the Dynatrace web UI. For detailed instructions, see Enable Session Replay on crashes for iOS apps.

  Once the dependency is included, Session Replay is enabled.

• Adjust the masking settings.

  By default, Session Replay does not record any text, user input, and images. Session Replay only captures the framing and positioning of elements and user interactions with your app. If you need to change the default masking strategy for content capture, you can do so during instrumentation with just a few lines of code. For detailed instructions, see Enable Session Replay on crashes > Mask sensitive data.

  The image below shows examples of different masking options applied to the same screen. There are two predefined options to mask all the information (Safest level, which is the default one) and to mask the text entered by the user (Safe level) (developers need to add only one line of code to implement this option). If you need to record more information, one option is to opt for the Custom level, which records only the controls you specify.

  

• optional Include Session Replay in your consent solution.

  We offer an API that enables you to integrate Session Replay with your existing consent solution.

  Once your consent solution is updated to include a transparent description of Session Replay, it can use the Dynatrace API to enable Session Replay. The API also allows opt out from Session Replay, allowing for fine-grained control over user consent in your mobile app.

  The image below is an example consent solution visible to the end user to enable Session Replay to capture sessions when a crash occurs.

  

Assign permissions to Session Replay users according to their needs

For Session Replay on crashes, you can control who has the ability to play back captured user sessions.

Users with the Replay sessions with masking or Replay sessions without masking permissions can view session recordings. Both these permissions behave almost in the same way, allowing access to user-session playback as recorded.

For more details, see Configure Session Replay > User permissions and management zone.

Enable Session Replay in production

Once you've tested your app instrumentation in development and staging environments, it's time to enable Session Replay in production.