MousePlayer and Consent

Why consent is required

MousePlayer records mouse movement, clicks, scrolling and DOM changes. That is behavioural observation under Recital 24 GDPR and access to the visitor's device under Section 25 TDDDG and its equivalents. It requires consent. Legitimate interest does not carry it.

The burden of proving valid consent lies with you as the controller. MousePlayer therefore records not only that consent existed, but where the signal came from, when it arrived, and which configuration was in force at the time.

1Option 1 — let your consent tool block the script

The snippet is embedded with type="text/plain" and your CMP's category attribute. Before consent it is not executed at all. Nothing can happen too early, because nothing runs. This is the only option that does not depend on a signal arriving correctly.

<script type="text/plain" data-cookieconsent="statistics">
window.mp_config = {
    channel: 'YOUR-CHANNEL-ID',
    mode: 'web_only'
};

window.mp = window.mp || function() { (window.mp.q = window.mp.q || []).push(arguments); };
(function(w, d, s, id) {
    w.mp_channelid = id;
    var f = d.getElementsByTagName(s)[0], j = d.createElement(s);
    j.async = true; j.src = 'https://www.mouseplayer.com/mp.js';
    f.parentNode.insertBefore(j, f);
})(window, document, 'script', 'YOUR-CHANNEL-ID');
</script>

2Option 2 — your own banner

Use the standard snippet and tell MousePlayer yourself. The line below works before and after the script has loaded, so the order in your page does not matter. Withdrawal works at any time — including minutes later.

After the visitor agrees:

(window.mp_q = window.mp_q || []).push(['consent', true]);

On withdrawal, at any time:

(window.mp_q = window.mp_q || []).push(['consent', false]);

3Option 3 — automatic detection

The standard snippet on its own. MousePlayer detects Google Consent Mode v2, the IAB TCF v2 and seven common consent tools (Consented.eu, Usercentrics, Cookiebot, OneTrust, Consentmanager, Borlabs, Complianz) by itself, and honours Global Privacy Control unconditionally. Use this only where neither option above is possible: detection depends on the other tool behaving as expected, and you will not notice when it does not.

What happens on withdrawal

The stop is immediate, not at the end of the page:

• every recording listener is removed and both observers are disconnected; only listening for a renewed consent remains
• all timers are cleared and the connection is closed without reconnecting
• the buffer is discarded, not sent — otherwise closing the tab would deliver exactly the data that was just refused
• the identifiers and markers MousePlayer stored in local and session storage for recording are deleted; if your consent tool blocks the script entirely after the withdrawal so that it no longer starts, they remain until browser data is cleared but are no longer used
• the withdrawal is reported to the server while the connection is still open and recorded, so the event remains provable

Project settings

Under Project → Settings → Consent and regions you decide whether the server accepts recordings only with a consent signal (recommended) or, in explicitly released regions, also without one. The script itself opens no connection without a consent signal; a release relaxes only the check on the server, not this one. The EU/EEA, the United Kingdom, Switzerland, Brazil and Canada cannot be released — they require prior consent by law. The region is determined server-side from the IP address; the IP address is stored only in truncated form (without the last octet or block), together with the country.

What belongs in your privacy policy

• MousePlayer as a processor, with the purpose: analysing usage behaviour through session recordings and heatmaps
• that the recording requires consent, and how visitors can withdraw it
• the retention period agreed for recordings

No recordings arriving?

• Check the category attribute against your CMP's documentation — a wrong one blocks the script permanently
• Make sure the consent line runs before or after the snippet, not inside a block that never executes
• Global Privacy Control in the visitor's browser overrides every yes, worldwide and unconditionally
• Pages on your exclusion list are never recorded, regardless of consent